---
schema_version: "1"
id: 7de49466dc0bc9acc3dba2aa4e54d0f72d983f9c8b99ad3a934d1396255fdb14
title: Example Queries for Troubleshooting Access Issues
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/admin_troubleshoot_queries.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_queries.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 52036a67d4b3f960fe9987935205a6b624d73030912fe6000c0b3c8afce2edd8
description: Review these sample queries on returning information about users’ permissions or access.
products:
- Security
- Salesforce Platform
release: "264"
---
# Example Queries for Troubleshooting Access Issues
Review these sample queries on returning information about users’ permissions or access.
### Required Editions
Available in: both Salesforce Classic and Lightning Experience
The available user and data management options vary according to which Salesforce edition you have.
Tip Setup with Agentforce can help you troubleshoot access issues more efficiently. For more information, see [Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_overview.htm&language=en_US) and [User Access Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_user_access.htm&language=en_US).
Note Most of the example queries for permissions use permission sets. However, these queries also work for profiles and permission set groups, because they have an associated permission set. For more information, see the "Profiles and Permission Set Groups" section.
## Object Permissions
Return permission sets that have the Read object permission for cases enabled.
```sql
SELECT ParentId,Parent.ProfileId,Parent.Name,Parent.PermissionSetGroupId
FROM ObjectPermissions
WHERE SobjectType = 'Case'
AND PermissionsRead = true
```
Return permission sets that a user is assigned that grant the Read object permission for cases.
```sql
SELECT AssigneeId,ExpirationDate,Id,IsActive,PermissionSetGroupId,PermissionSetId,
PermissionSet.Name FROM PermissionSetAssignment
WHERE PermissionSetId IN
(SELECT ParentId
FROM ObjectPermissions WHERE SobjectType = 'Case'
AND PermissionsRead = true)
AND AssigneeId = '005XXXXXXXXXXXXQAT'
```
## Field Permissions
Return field permissions associated with a permission set.
```sql
SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,SobjectType,SystemModstamp
FROM FieldPermissions
WHERE ParentId = '0PSXXXXXXXXXXXX'
```
Return permission sets that have a specific field permission enabled.
```sql
SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,SobjectType,SystemModstamp
FROM FieldPermissions
WHERE Field = 'Account.CustomerPriority__c'
AND PermissionsEdit = true
```
Return the permission sets that a user is assigned that grant a specific field permission.
```sql
SELECT AssigneeId,ExpirationDate,Id,IsActive,PermissionSetGroupId,PermissionSetId,
PermissionSet.Name FROM PermissionSetAssignment
WHERE PermissionSetId IN
(SELECT ParentId
FROM FieldPermissions
WHERE Field = 'Account.CustomerPriority__c'
AND PermissionsEdit = true)
AND AssigneeId = '005XXXXXXXXXXXXQAT'
```
## User Permissions
Return the permission sets that a user is assigned that grant specified permissions.
```sql
SELECT AssigneeId,ExpirationDate,Id,IsActive,
PermissionSetGroupId,PermissionSetId,
PermissionSet.Name,PermissionSet.PermissionsViewAllData,
PermissionSet.PermissionsCustomizeApplication
FROM PermissionSetAssignment
WHERE AssigneeId = '005XXXXXXXXXXXXIAS' AND
(PermissionSet.PermissionsViewAllData = true OR
PermissionSet.PermissionsCustomizeApplication = true)
```
Return the user permissions that a user has when logged in as that user.
```sql
SELECT FROM UserPermissionAccess // or specify permissions
```
## Profiles and Permission Set Groups
Each profile or permission set group has an associated permission set. You can first get the associated permission set ID for a profile or permission set group, then use this permission set ID in other queries. The two queries below can be modified for object permissions, user permissions, and access settings.
Return permissions associated with a profile, using the associated permission set.
```sql
#Get the profile's associated permission set
SELECT Id from PermissionSet
WHERE ProfileId = '00eXXXXXXXXXXXX'
SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,
SobjectType,SystemModstamp
FROM FieldPermissions
WHERE ParentId = '0PSXXXXXXXXXXXXWAU' //ID of the associated permission set
```
Return permissions associated with a permission set group, using the associated permission set.
```sql
#Get the permission set groups's associated permission set.
SELECT Id from PermissionSet
WHERE PermissionSetGroupId = '0PGXXXXXXXXXXXX'
SELECT Field,Id,ParentId,PermissionsEdit,PermissionsRead,
SobjectType,SystemModstamp
FROM FieldPermissions
WHERE ParentId = '0PSXXXXXXXXXXXXWAU' //ID of the associated permission set
```
## Record Access
Return whether a user has access to a record and what level of access is given.
```sql
SELECT RecordId,HasReadAccess,HasEditAccess,HasDeleteAccess,HasTransferAccess,HasAllAccess,MaxAccessLevel
FROM UserRecordAccess
WHERE RecordId = '001XXXXXXXXXXXXIAC'
AND UserId = '005XXXXXXXXXXXXQAT'
```
Return the users that have access to a specific account record.
```sql
SELECT AccountAccessLevel,AccountId,CaseAccessLevel,ContactAccessLevel,Id,IsDeleted, LastModifiedById,LastModifiedDate,OpportunityAccessLevel,RowCause,UserOrGroupId
FROM AccountShare
WHERE AccountId = '001XXXXXXXXXXXXIAC'
```
Return whether the queried user has Read and Transfer access to a record, and the user’s maximum access level for the record.
```sql
SELECT RecordId,HasReadAccess,HasTransferAccess,MaxAccessLevel
FROM UserRecordAccess
WHERE UserId = '005XXXXXXXXXXXXQAT'
AND RecordId = '001XXXXXXXXXXXXIAC' //or Record IN [list of IDs]
```
Return all records that the queried user has Read access to.
```sql
SELECT RecordId
FROM UserRecordAccess
WHERE UserId = '005XXXXXXXXXXXXQAT'
AND RecordId IN [list of IDs]
AND HasReadAccess = true
```
## Access Settings (SetupEntityAccess)
Access settings can be specified in permission sets and profiles and include Visualforce pages, Apex classes, and custom permissions. For more information, see [Permissions and Access Settings](https://help.salesforce.com/s/articleView?id=platform.permissions_about_users_access.htm&release=264.0.0&type=5 "User, object, and field permissions and access settings can be specified in profiles and permission sets. To use them effectively, understand the differences between profiles and permission sets.") in Salesforce Help and [SetupEntityAccess](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_setupentityaccess.htm) in the Object Reference for the Salesforce Platform Developer Guide.
Return the permission sets that have the specified access setting enabled.
```sql
SELECT Id,ParentId,SetupEntityId,SetupEntityType,
SystemModstamp
FROM SetupEntityAccess
WHERE SetupEntityId = '0H4XXXXXXXXXXXX' //ID of Apex class, Visualforce page, etc.
```
Return the permission sets assigned to a user that have the specified access setting enabled.
```sql
SELECT AssigneeId,ExpirationDate,Id,IsActive,
PermissionSetGroupId,PermissionSetId,
PermissionSet.Name
FROM PermissionSetAssignment
WHERE PermissionSetId IN
(SELECT ParentId
FROM SetupEntityAccess
WHERE SetupEntityId = '0H4XXXXXXXXXXXX' )
AND AssigneeId = '005XXXXXXXXXXXXQAT'
```
#### See Also
- [Troubleshooting User Access Issues and Insufficient Privileges Errors](https://help.salesforce.com/s/articleView?id=platform.admin_insufficient_privileges_flowchart.htm&release=264.0.0&type=5 "Review this guidance if you or one of your users is experiencing insufficient or unexpected access for an object, record, field, or feature in Salesforce.")
- [Create a SOQL Query](https://help.salesforce.com/s/articleView?id=xcloud.admin_locales_soql.htm&type=5&language=en_US)