Salesforce Best Practices When using S-Docs

A quick-reference guide to Salesforce access and security best practices. Learn how to manage profiles, permission sets, OWD, MFA, and more.

Salesforce Access & Security Best Practices

Best Practice	Core Details	Official Documentation
Use Profiles for Baseline Permissions	• Assign profiles to define a user's absolute minimum baseline access. • Limit permissions strictly based on core job roles. • Apply the "Least Privilege" principle.	User Profiles
Utilize Permission Sets & Groups	• Assign permission sets to grant extra access without modifying profiles. • Helps avoid messy and excessive profile creation.	Create, Edit, Delete, and Assign a Permission Set
Leverage Role Hierarchies	• Define roles to control record visibility vertically. • Higher roles inherit access from lower roles, but do not override object-level security.	Add Roles to the Role Hierarchy
Implement OWD & Sharing Rules	• Set Organization-Wide Defaults (OWD) to restrict baseline access (e.g., Private). • Use Sharing Rules to grant additional access laterally.	Organization-Wide Sharing Defaults
Enforce Field-Level Security (FLS)	• Restrict the visibility and edibility of sensitive fields at the profile or permission set level. • Prevent unauthorized viewing of critical data.	Set Field-Level Security for a Field Set FLS on Permission Sets
Separate Object & Record Access	• Object-level: Determines if a user can see/edit the object at all (Profiles/Perm Sets). • Record-level: Determines which specific records they can see (OWD/Roles/Sharing).	Data Access and Security Overview
Audit & Monitor System Usage	• Use Setup Audit Trail and Field History Tracking. • Review user access and system changes periodically.	Setup Audit Trail
Mandate Multi-Factor Auth (MFA)	• Enforce Multi-Factor Authentication (MFA) to add an essential extra security layer.	Verification Methods for Multi-Factor Authentication
Minimize System Admins	• Limit the System Administrator role strictly to essential personnel. • Audit users with “Modify All Data” permissions (Consider Delegated Admins	Define Delegate Administrators