Tool Guide · User Access Review

WHAT A SALESFORCE USER ACCESS REVIEW COVERS BEFORE YOU CHANGE PERMISSIONS.

User access in Salesforce is the combination of a profile and every permission set assigned to that user. Reviewing one layer without the other gives you an incomplete picture. A structured access review workbook surfaces the full permission structure before any changes are made.

Read-only diagnostics · Review-ready workbooks · No package install · No Connected App

01 — The Additive Access Problem

EFFECTIVE ACCESS IS THE SUM OF PROFILE PLUS ALL PERMISSION SETS.

A user's actual Salesforce access is not just what their profile grants. It is their profile permissions plus every permission set they have been assigned — and in most orgs, permission sets accumulate over time without a corresponding cleanup process.

A user who was given a permission set for a project two years ago may still have that access. A user who changed roles may now have permission sets from their previous role still attached. A user may have Modify All Data access through a permission set that was created during a data migration and never deactivated.

A user access review that only checks the profile is checking a fraction of the actual access picture.

02 — What This Helps You Review

ACCESS REVIEW SIGNALS THE PERMISSION & FLS AUDIT SURFACES.

What this helps you review

  • Object permissions by profile and permission set — create, read, edit, delete, view all, modify all
  • Field-level security per field — which profiles and permission sets can read or edit each field
  • System permissions by profile — Modify All Data, View All Data, and similar elevated permissions
  • Permission set and permission set group assignment counts as sprawl reference signals
  • Over-assigned and over-privileged access patterns flagged as first-pass review candidates
  • FLS gaps — fields that may be more broadly readable or editable than intended
  • Integration user access — broad permissions granted to integration accounts that rarely get re-reviewed
  • External and community user exposure — access patterns that reach beyond internal staff
  • Inactive users with live assignments, and stale assignments left over from old roles or projects

Relevant Workbook

Permission & FLS Audit

The Permission & FLS Audit workbook maps object permissions, field-level security, system permissions, and permission set assignment counts — formatted for structured access review before changing user permissions.

Learn more →Open Permission & FLS Audit →View sample workbook →
03 — Access Review Triggers

WHEN TO RUN A USER ACCESS REVIEW.

Common access review triggers

  • Admin or consultant handoff — new owner needs to understand existing access structure
  • Employee offboarding or team restructure — ensure no residual access remains from old roles
  • Compliance or security review — document current access state for audit purposes
  • Permission cleanup project — identify and remove redundant or over-broad permission sets
  • Before any significant permission change — establish a baseline before modifying access
04 — Start With Evidence

ACCESS REVIEW STARTS WITH EVIDENCE, NOT IMMEDIATE REMOVAL.

The instinct in a messy org is to start pulling permission sets the moment something looks excessive. That is how access incidents happen. A permission set that looks redundant may be the only thing granting a small team the field access they rely on. An integration user's broad access may be load-bearing for a nightly sync.

Review before removal means documenting the current state, comparing assignments against what each role actually needs, and prioritizing changes by risk — before anyone deactivates a single assignment. The goal of the first pass is a defensible list of review candidates, not a cleanup spree.

Document and compare first. Remove second — deliberately, and with a record of why.

05 — Before You Change Access

WHAT TO EXPORT OR REVIEW BEFORE MAKING ACCESS CHANGES.

Capture a baseline you can return to. If a change causes a problem, the export below is what lets you see what access looked like before — and restore it deliberately.

Capture before you change

  • Each user's profile plus the full list of assigned permission sets and permission set groups
  • Object permissions and field-level security for the objects and fields in scope
  • System permissions in play — Modify All Data, View All Data, and similar elevated grants
  • Integration and external/community user access, noted separately from internal staff
  • Inactive users with live assignments and any stale assignments tied to old roles
  • The rationale for each planned change, so the reasoning survives the next handoff
06 — What This Does Not Replace

METADATA ACCESS REVIEW VS. FULL COMPLIANCE REVIEW.

What this does not replace

  • User activity logs or login history — activity analysis is outside metadata scope
  • Formal compliance sign-off with documented rationale per user or role
  • Sharing rules and row-level security review — not covered by profile and permission set metadata
  • Business-context validation — understanding why access was granted and whether the reason still applies
07 — Related Resources

RELATED GUIDES.

FAQ

FREQUENTLY ASKED QUESTIONS.

What is a Salesforce user access review?
A user access review examines which users have access to which Salesforce objects, records, and fields — and whether that access is appropriate, documented, and still needed. It typically covers profile permissions, permission set assignments, field-level security exposure, and system-level permissions like Modify All Data and View All Data.
How often should Salesforce user access be reviewed?
Access reviews are commonly triggered by personnel changes (employee offboarding, team restructures), compliance requirements, security incidents, consultant handoffs, or any significant org change project. For high-sensitivity orgs, periodic reviews are a governance best practice regardless of specific triggers.
What is the difference between a profile review and a permission set review?
Profiles define baseline object and field access for a group of users. Permission sets grant additional access on top of the profile — often for specific projects, integrations, or temporary needs that were never revoked. A complete user access review covers both layers, because effective permissions are the combination of profile plus all assigned permission sets.
Does KeelCadence surface user login history or activity data?
No. KeelCadence diagnostics are metadata-focused. The Permission & FLS Audit surfaces permission structure — what access exists in the org configuration — not user activity logs, login history, or usage events. Activity analysis requires separate tools or Salesforce event log review.
Does KeelCadence confirm whether access is compliant?
No. The workbook surfaces access signals — over-privileged profiles, permission set sprawl, FLS exposure by field, and user assignment counts. Confirming compliance requires formal access review with documented decisions and sign-off from appropriate stakeholders. KeelCadence provides the starting materials for that process.
Do I need to install a Salesforce package to run a user access review with KeelCadence?
No. KeelCadence does not require a package install, Connected App, or persistent OAuth token. The Permission & FLS Audit runs read-only for the session and does not export customer record data.
Before You Change Access

REVIEW WHO HAS ACCESS TO WHAT BEFORE MODIFYING PERMISSIONS.

KeelCadence Permission & FLS Audit surfaces object permissions, field-level security exposure, and permission set assignments — formatted as a structured XLSX workbook for access review before any permission change.

Run Permission & FLS AuditView sample workbook
See what Permission & FLS Audit covers →

Opens permissions.keelcadence.com. Best run from desktop, since the diagnostic uses your active Salesforce browser session. On mobile, view the sample workbook or save this page for later.

Read-only · No package install · No Connected App setup · No Salesforce writes

KeelCadence uses session cookies and Google Analytics 4 for site usage insights. GA4 does not receive Salesforce credentials, Org IDs, Report IDs, or payment data. You can opt out for this browser.