Salesforce Docs Portal

Troubleshoot External User Access Errors

Resolve common issues with authenticated external user and unidentified external user access to Data 360.

Issue Resolution
An authenticated external user sees 0 accessible records.
  • In the Data Governance tab, confirm that the data model object (DMO) has the correct access level tag (ExternalData.Visibility.Portal or a custom tag).
  • If no tag exists, add one and save.
  • Wait a few minutes and retest access.
  • Verify that an Allow policy exists for authenticated external users.
  • Verify that the policy restricts access based on the custom permission assigned to the authenticated external user profile.
An unidentified external user accesses data without a policy.
  • Confirm that the DMO doesn't have the ExternalData.Visibility.Public tag.
  • Remove any ExternalData.Visibility.Public tags from internal objects.
Note
Note Data 360 is secure by default. Data without tags or policies remains inaccessible to users who aren't explicitly granted access.
An agent action fails for an authenticated external user.
  • Verify that the Agent Service Account uses external org-wide default access (not internal).
  • Check that the DMO has the correct authenticated external user tag (ExternalData.Visibility.Portal or custom).
  • Confirm that an Allow policy exists for authenticated external users with the custom permission assigned to the authenticated external user profile.
  • If the AI agent is configured as Digital Agent External User in Summer '26 or later releases, verify that the DMO has the ExternalData.Visibility.Public tag. Also verify that an Unidentified External User policy exists.
An agent action succeeds in the sandbox but fails in production.
  • Confirm the Agent Service Account org-wide default setting matches across environments.
  • Verify that tags exist on the same DMOs in both environments.
  • Check that Allow policies exist with identical custom permission restrictions in both environments.
Policies work in the home org but not in the companion org.
  • Confirm multi-org policies are enabled in the home org and synced to the companion org.
  • Verify that the companion org admin has mapped attribute placeholders to local values.
  • Check that custom permissions referenced in policies exist in the companion org.
  • Contact Salesforce Support to verify the companion org policy sync status.