Salesforce User Access Review: A Quarterly Permissions Check

A Salesforce user access review is a quarterly check of who can see, export or delete your data. You list every user with View All Data, Modify All Data, Export Reports, Weekly Data Export or Bulk API Hard Delete. A manager confirms each one. You remove the rest.

Access hides in profiles, permission sets and groups at once, so the listing takes longest. Clientell AI, the AI Salesforce admin, lists every high-access user, traces each grant to the profile or permission set behind it, and drafts the fix. Start with the free, read-only permissions audit.

What does a Salesforce user access review have to prove?

It proves three things. Each person with powerful access still needs it. Someone with authority approved it. Every change since the last review is on record.

Salesforce's own SOX (Sarbanes-Oxley, the US financial controls law) best-practices paper says user access should be "reviewed on a set cadence to ensure their access is still appropriate". It names View All Data, Modify All Data and Modify Metadata as permissions to keep in scope (Salesforce SOX best practices). SOC 2 asks the same thing in criterion CC6.3: access roles are "reviewed on a periodic basis" (AICPA Trust Services Criteria). PCI DSS sets a hard number:

"All user accounts and related access privileges, including third-party/vendor accounts, are reviewed as follows: At least once every six months." PCI Security Standards Council, PCI DSS v4.0.1, Requirement 7.2.4 (PCI SSC document library)

The review is your job, not Salesforce's. Salesforce states that customers are responsible for "configuration, access controls, custom code, and data governance" (Salesforce Architects).

This post covers the recurring people check. To audit how access is built (profiles, sharing, field-level security), use the Salesforce permissions audit guide.

Which permissions let a user see, export or delete everything?

Nine permissions carry most of the risk. The field names are the ones you filter on in SOQL (Salesforce Object Query Language).

Three traps catch most reviews:

• Export Reports and Weekly Data Export are different permissions. Weekly Data Export is granted by default only to the System Administrator profile. Users who hold it can see all exported data and every custom object and field on the Export Service page (Salesforce Help).
• Data Loader respects sharing, until it does not. It exports only the records the user can read (Data Loader Guide). Pair API Enabled with View All Data and that means every record.
• Bulk API Hard Delete is not on the standard System Administrator profile. It comes only through a cloned profile or a permission set, so a profile-only check misses it (Salesforce Help). A normal delete sits in the Recycle Bin for 15 days. A hard delete skips it (Salesforce Help).

How do I run a quarterly Salesforce user access review, step by step?

Run these 8 steps in order. The queries run with sf data query -o <your-org> -q "..." or in the Developer Console. SOQL is Salesforce's query language. All of them are read-only.

1. Fix the scope and the reviewers. Write down the nine permissions above, the manager who confirms access for each team, and the review date. Name one owner for the integration and agent users.

2. Pull the user list. In Setup > Users > Users, or with SOQL, count active users. Then list the ones with no login since the last review. Those are the first to remove.

   SELECT COUNT() FROM User WHERE IsActive = true
   SELECT Name, Username, LastLoginDate FROM User WHERE IsActive = true AND (LastLoginDate < LAST_N_DAYS:90 OR LastLoginDate = null)
   

3. List who holds each high-risk permission. Query PermissionSetAssignment, or open each permission set in Setup > Users > Permission Sets and click Manage Assignments. Every profile owns a permission set, and every permission set group has one too, with the combined permissions of its members (PermissionSet object reference). So one query finds all three sources. PermissionSet.Type tells you which: Profile, Regular or Group.

   SELECT Assignee.Name, Assignee.Username, Assignee.Profile.Name, PermissionSet.Name, PermissionSet.Type, Assignee.LastLoginDate FROM PermissionSetAssignment WHERE Assignee.IsActive = true AND (PermissionSet.PermissionsModifyAllData = true OR PermissionSet.PermissionsViewAllData = true OR PermissionSet.PermissionsDataExport = true OR PermissionSet.PermissionsBulkApiHardDelete = true OR PermissionSet.PermissionsManageUsers = true OR PermissionSet.PermissionsAssignPermissionSets = true OR PermissionSet.PermissionsModifyMetadata = true)
   

   Run Export Reports and API Enabled as two more queries. Swap the WHERE filter for PermissionSet.PermissionsExportReport = true, then PermissionSet.PermissionsApiEnabled = true. One row is one assignment, so a user with two grants shows twice.

4. Check object-level overrides on sensitive objects. View All Records and Modify All Records (Setup > Users > Permission Sets > Object Settings) override sharing for one object (Salesforce Help). Put your finance or health objects in the list.

   SELECT Parent.Name, Parent.Type, SobjectType, PermissionsViewAllRecords, PermissionsModifyAllRecords FROM ObjectPermissions WHERE SobjectType IN ('Opportunity', 'Contact') AND (PermissionsViewAllRecords = true OR PermissionsModifyAllRecords = true)
   

5. Split out the non-human users. Integration users carry the API Only User permission on their profile. Agentforce Service agents run as agent users on the Einstein Agent User profile (Salesforce Help). Their owner reviews them, not a line manager.

   SELECT Name, Username, Profile.Name FROM User WHERE IsActive = true AND (Profile.PermissionsApiUserOnly = true OR Profile.Name = 'Einstein Agent User')
   

6. Send each manager their list. One row per grant: user, permission, source, business reason, keep or remove, reviewer and date. No answer by the deadline means remove.

7. Remove what nobody confirmed. Unassign the permission set, or move the user to a narrower profile in Setup > Users > Users. Test any change to an integration user in a sandbox first. The next section covers the undo plan.

8. Pull the change evidence and sign off. Setup Audit Trail (Setup > Security > View Setup Audit Trail) records every assignment and permission change. This query lists the quarter's access changes and who made them.

   SELECT CreatedDate, CreatedBy.Username, Action, Display FROM SetupAuditTrail WHERE CreatedDate = LAST_N_DAYS:90 AND (Action IN ('PermSetAssign', 'PermSetUnassign', 'PermSetEnableUserPerm', 'PermSetGroupUserPermEnabled') OR Action LIKE 'changedprofileforuser%') ORDER BY CreatedDate DESC
   

   Attach the query results and the signed sheet. You are done when the quarter's folder holds four files: the signed sheet, the holder list from step 3, the Setup Audit Trail export and the Login History export.

What can go wrong when you remove access, and how do I undo it?

Removing access breaks things that quietly depended on it. Four cases come up most:

• An integration stops. Its user lost API Enabled or object access. Test the reduced permission set in a sandbox first.
• A user cannot be deactivated. Salesforce blocks deactivation in some cases, for example when the user sits in a custom hierarchy field. Freeze the account first (Setup > Users > Users, then Freeze) to stop logins, reassign what it owns, then deactivate (Salesforce Help). Integration users and the Automated Process user cannot be deactivated at all (Salesforce Help).
• A scheduled export stops. The weekly export runs as one user. To change that user, delete the scheduled job and schedule it again with Modify All Data and Weekly Data Export on the new user (Salesforce Help).
• A group still grants the permission. Removing a permission set does nothing if a group still carries it. Use a muting permission set inside the group, or remove the group assignment (Salesforce Help).

The undo plan: before step 7, export the PermissionSetAssignment rows you plan to delete, with AssigneeId and PermissionSetId. To restore access, insert those rows again with Data Loader. Unfreezing takes one click.

What evidence does the auditor want, and how long does Salesforce keep it?

Auditors want two things: the signed review, and the history behind it. Salesforce keeps that history for a limited time, as of October 2026.

Store the exports outside Salesforce, where your auditor already looks. Next quarter's review is shorter when access sits in a few named permission sets. Salesforce recommends the Minimum Access - Salesforce profile plus permission sets (Salesforce Help).

Do I need a tool for a Salesforce access review?

Not for one org and one review. A tool pays off when you repeat the review every quarter, run several orgs, or want the fix drafted.

How does Clientell AI help with the quarterly review?

Clientell AI runs steps 2 to 5 and step 8 for you. It finds every user with high access, shows the profile, permission set or group that grants it, and flags users with no login since the last review. For each finding it drafts the fix.

Safety, in plain words. The audit is a read-only scan. Clientell AI asks before it changes anything in production, and you can test every fix in a sandbox first. Each change it makes shows up in your own Setup Audit Trail. Details are on the security page.

Try it in Clientell AI: "List every active user with Modify All Data, View All Data, Export Reports or Weekly Data Export, show the profile or permission set that grants it, and flag anyone who has not logged in this quarter." Start the 14-day trial, no card.

Want it on paper first? The access review checklist is a one-page version of this post for your team and your auditor. The step-by-step access review guide adds the Setup click paths for each step.

Last updated: October 22, 2026