---
schema_version: "1"
id: 616c594c87244da95cf489c1b7685c88ae989741ae96776b83120f34cd0cb029
title: Determine Who Has Sandbox Access
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/data_sandbox_selective_access.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.data_sandbox_selective_access.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e58e0a55b62a2c33034c27f493c152a6dfb79b67fee042d231d1d58e2001091d
description: Selective Sandbox Access helps you limit access to only required users who are included in a public group. It also removes the additional step for a Salesforce admin to change user email addresses back to their original format.
products:
  - Salesforce Platform
release: "264"
---
# Determine Who Has Sandbox Access

Selective Sandbox Access helps you limit access to only required users who are included in a public group. It also removes the additional step for a Salesforce admin to change user email addresses back to their original format.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d9622e36">User Permissions
            Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d9622e36 ">To create or edit a public group:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d9622e36 ">Manage Users</td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d9622e36 ">To create, refresh, activate, and delete a sandbox:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d9622e36 ">Manage Dev Sandboxes (Developer or Developer Pro only) or Manage Sandboxes (all
            sandbox types)</td>

        </tr>
      </tbody>
    </table>

## Do I Have to Use a Public Group to Provide Access to a Sandbox?

When you create or refresh a Developer and Developer Pro sandbox, you must grant access to the sandbox using a public group. For Partial Copy and Full sandboxes, we recommend that you provide access through a public group; however, you still have the option to provide access to all active users.

## How Do I Provide Access Through a Public Group?

When creating or refreshing a sandbox, you select a public group for **Sandbox Access**. To create a public group, see [Create and Edit Groups](https://help.salesforce.com/s/articleView?id=platform.creating_and_editing_groups.htm&type=5&language=en_US).

- Make sure all members of the group are of type `Users`.
- To improve security and reduce sandbox creation times, we recommend that the public group contains fewer than 150 members.

How you select the public group depends on how many public groups are defined in your org.

- If the production org has fewer than 60 public groups, select the group from the Public Groups dropdown.
- If the production org has 60 or more public groups, enter the public group name in the Public Groups field.

If the public group is empty, only the sandbox creator has access.

## Sandbox Access User Group Options

The Sandbox Access User Group determines the email address formats when creating a sandbox. When you clone a sandbox, Selective Sandbox Access is unavailable. Cloned sandbox access is determined based on access to the source sandbox.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:25%">
          <col style="width:25%">
          <col style="width:25%">
          <col style="width:25%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d9622e141">Sandbox Operation</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d9622e144">Sandbox Access User Group</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d9622e147">Users With Access</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d9622e150">Email Address Format</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Sandbox Operation" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e141 ">Create (applies to only Partial Copy and Full sandboxes)</td>

            <td data-label="Sandbox Access User Group" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e144 ">All Active Users (Match Source Org Access)</td>

            <td data-label="Users With Access" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e147 ">Matches users who have access in the production org.</td>

            <td data-label="Email Address Format" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e150 ">
              <p>The email address of the sandbox creator is copied unmodified from the
                production org. </p>
              <p style="margin-bottom:0;">Email addresses of the remaining users are appended with
                <samp class="filepath">.invalid</samp>.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Sandbox Operation" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e141 ">Create (applies to all sandbox types)</td>

            <td data-label="Sandbox Access User Group" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e144 ">Public User Group</td>

            <td data-label="Users With Access" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e147 ">
              <p>The sandbox creator and users belonging to the public user group have access to
                the sandbox.</p>
              <p style="margin-bottom:0;" dir="ltr">We freeze remaining users to remove sandbox
                access.</p>
            </td>

            <td data-label="Email Address Format" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e150 ">
              <p>The email addresses of all users with sandbox access are copied unmodified from
                the production org.</p>
              <p style="margin-bottom:0;">Email addresses of the remaining users are appended with
                <samp class="filepath">.invalid</samp>.
              </p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Sandbox Operation" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e141 ">Clone (applies to all sandbox types)</td>

            <td data-label="Sandbox Access User Group" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e144 ">Not selectable. Source sandbox matches production access.</td>

            <td data-label="Users With Access" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e147 ">All users with access to the source sandbox.</td>

            <td data-label="Email Address Format" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d9622e150 ">
              <p>The email address of the sandbox creator is copied unmodified from the source
                org.</p>
              <p style="margin-bottom:0;">Email addresses of the remaining users are appended with
                <samp class="filepath">.invalid</samp>.
              </p>
            </td>

          </tr>
        </tbody>
      </table>

## Provide Access to Additional Users in Existing Sandboxes

You can provide access to additional users by unfreezing their user accounts. See Salesforce Help: [Freeze or Unfreeze User Accounts](https://help.salesforce.com/s/articleView?id=platform.users_freeze.htm&type=5&language=en_US) for instructions.