---
schema_version: "1"
id: bab67cc193ecb79d95711f5c1b3b3d3664a9c8b11641faa75a3fbb90b852682b
title: Set Your Internal Organization-Wide Sharing Defaults
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/admin_sharing.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c350f78f968c608c1ef3cde7e81683e6b6c747e1fe3fda40a9ee4e0b45e9d8cf
description: Internal organization-wide sharing defaults set the baseline access for your internal users for your records. You can set the defaults separately for different objects.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Set Your Internal Organization-Wide Sharing Defaults

Internal organization-wide sharing defaults set the baseline access for your internal users for your records. You can set the defaults separately for different objects.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d43765e75">User Permissions
              Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d43765e75 ">To set default sharing access:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d43765e75 ">Manage Sharing</td>

          </tr>
        </tbody>
      </table>

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/images/icon_tip.png)

Tip Instead of completing this task manually, get help from Setup with Agentforce. For example, tell the Setup agent, “Set the internal org-wide default access for the Account object to Private.” For more information, see [User Access Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_user_access.htm&language=en_US).

Watch how you can restrict access to records owned by other users.

1. From Setup, in the Quick Find box, enter Sharing Settings, then select **Sharing Settings**.
2. Click **Edit** in the Organization-Wide Defaults area.
3. For each object, select the default internal access that you want to use.
    
    You can assign the following access levels for custom objects and most standard objects.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
            <colgroup>
              <col style="width:44.85049833887043%">
              <col style="width:27.57475083056478%">
              <col style="width:27.57475083056478%">
            </colgroup>
            <thead class="slds-text-title_caps ">
              <tr class="">
                <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d43765e163">Access Level</th>
                <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="vertical-align:top;" id="d43765e166">Description</th>
              </tr>
            </thead>
            <tbody>
              <tr class="">
                <td data-label="Access Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d43765e163 "><samp class="parmname">Controlled by Parent</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" colspan="2" style="vertical-align:top;" headers="d43765e166 ">
                  <p>
                    <span id="admin_sharing__owd_controlled"><a name="admin_sharing__owd_controlled"><!-- --></a>Users can perform actions (such as view, edit, delete)
                      on a record on the detail side of a master-detail relationship if they can
                      perform the same action on all associated master records.</span>
                  </p>
                  <p style="margin-bottom:0;">The default internal and external access must match if either one is set to
                    <samp class="parmname">Controlled by Parent</samp>.
                  </p>
                </td>

              </tr>
              <tr class="">
                <td data-label="Access Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d43765e163 ">
                  <samp class="parmname">Private</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" colspan="2" style="vertical-align:top;" headers="d43765e166 ">
                  <span id="admin_sharing__owd_private"><a name="admin_sharing__owd_private"><!-- --></a>Only users
                    who are granted access by ownership, permissions, role hierarchy,
                    manual sharing, or sharing rules can access the
                    records.</span>
                </td>

              </tr>
              <tr class="">
                <td data-label="Access Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d43765e163 ">
                  <samp class="parmname">Public Read Only</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" colspan="2" style="vertical-align:top;" headers="d43765e166 ">
                  <span id="admin_sharing__owd_publicread"><a name="admin_sharing__owd_publicread"><!-- --></a>All users
                    can view all records for the object.</span>
                </td>

              </tr>
              <tr class="">
                <td data-label="Access Level" class="slds-cell-wrap" style="vertical-align:top;" headers="d43765e163 ">
                  <samp class="parmname">Public Read/Write</samp>
                </td>

                <td data-label="Description" class="slds-cell-wrap" colspan="2" style="vertical-align:top;" headers="d43765e166 ">
                  <span id="admin_sharing__owd_write"><a name="admin_sharing__owd_write"><!-- --></a>All users can
                    view and edit all records for the object.</span>
                </td>

              </tr>
            </tbody>
          </table>
    
    For other access levels available only for specific objects, see [Organization-Wide Default Access Settings](https://help.salesforce.com/s/articleView?id=platform.sharing_model_fields.htm&release=264.0.0&type=5 "For most objects, you can assign default access to Controlled by Parent, Private, Public Read Only, or Public Read/Write. Other access levels, like Public Full Access and View Only, are available for only specific objects.").
4. To disable automatic access using your hierarchies for custom objects, deselect **Grant Access Using Hierarchies**. You can only deselect this setting for custom objects that don’t have a default access of Controlled by Parent. For more information, see [Controlling Access Using Hierarchies](https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&release=264.0.0&type=5 "Determine whether users have access to records they don’t own, including records to which they don’t have sharing access, but someone below them in the hierarchy does.") in Salesforce Help.

When you update organization-wide defaults, sharing recalculation applies the access changes to your records. If you have a lot of data, the update can take longer. You receive a notification email when the recalculation completes. Refresh the Sharing Settings page to see your changes. You can also monitor the progress of your organization-wide default updates on the Background Jobs page or view recent sharing operations on the View Setup Audit Trail page.

If you increase the default access, such as from Public Read Only to Public Read/Write, your changes take effect immediately. All users get access based on the updated default access. Sharing recalculation is then run asynchronously to ensure that all redundant access from manual or sharing rules is removed. When the default access for contacts is Controlled by Parent and you increase the default access for accounts, opportunities, or cases, the changes take effect after recalculation is run. If you decrease the default access, such as from Public Read/Write to Public Read Only, your changes take effect after recalculation is run.

The organization-wide sharing default setting can’t be changed for some objects or in some scenarios:

- User provisioning requests are always Private.
- If the default access for Account is set to Private, the default access for Opportunity and Case must be set to Private as well. The default access for Contact must be set to Private or Controlled by Parent.
- If you set the organization-wide default on products to a value other than Public Read/Write, and you use custom code or installed a package, unexpected behavior can occur.
- The ability to view or edit a document, report, or dashboard is based on a user’s access to the folder in which it’s stored.
- Users can view forecasts only of users and territories below them in the forecast hierarchy, unless forecast sharing is enabled.
- When a custom object is on the detail side of a master-detail relationship with a standard object, its organization-wide default is set to Controlled by Parent and it’s not editable.
- The organization-wide default settings can’t be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom object Invoice\_\_c (represented as `Invoice__share` in the code), you can’t change the object’s organization-wide sharing setting from private to public.

#### See Also

- [Organization-Wide Default Access Settings](https://help.salesforce.com/s/articleView?id=platform.sharing_model_fields.htm&release=264.0.0&type=5 "For most objects, you can assign default access to Controlled by Parent, Private, Public Read Only, or Public Read/Write. Other access levels, like Public Full Access and View Only, are available for only specific objects.")
- [Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&release=264.0.0&type=5 "Define the default access that users have to records they don't own with organization-wide sharing settings. Organization-wide sharing settings can be set separately for custom objects and many standard objects. You can set different levels of access for internal and external users.")
- [_Designing Record Access for Enterprise Scale_](https://developer.salesforce.com/docs/atlas.en-us.draes.meta/draes/draes_preface.htm)