--- schema_version: "1" id: 1d9b1022b8ec4e75a6e2867cafec31c51d8bd7b53e443dbc26fbde874986160d title: External User Access Best Practices collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/networks_access_best_practices.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: acbdec812630c2d8a77bd6d3b53888452444c4fd62e798e7f27065957425753a description: External user access allows individuals outside your organization, such as customers, partners, or contractors, to access specific information and features by logging into your Salesforce environment or a site. To ensure your data is secure, make sure that external users have only the access and abilities required to complete their work. products: - Security - Salesforce Platform release: "264" --- # External User Access Best Practices External user access allows individuals outside your organization, such as customers, partners, or contractors, to access specific information and features by logging into your Salesforce environment or a site. To ensure your data is secure, make sure that external users have only the access and abilities required to complete their work. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
The available user and data management options vary according to which Salesforce edition you have.
For best practices related to setting up access for guest users, see [Securely Share Your Experience Cloud Sites with Guest Users](https://help.salesforce.com/s/articleView?id=platform.networks_secure_community.htm&release=264.0.0&type=5 "Experience Cloud sites help you connect with customers and partners. When building your site, you can use various settings and permissions to protect your data and your customers’ data, and publicly share the site with guest users. Keeping your data secure is a joint effort between you and Salesforce."). ## Licenses - Use internal and external licenses as required to prevent unauthorized or unintended access. For more information, see [When to Use an Internal or External License](https://help.salesforce.com/s/articleView?id=platform.users_internal_external_license_types.htm&release=264.0.0&type=5 "The Salesforce platform supports multiple use cases and stakeholders, such as employees, partners, brokers, and end customers. Salesforce has built purpose-driven applications and licenses to account for the differences in features, user experiences, sharing requirements, data security, and the needs of various roles. Learn about the various use cases and available licenses to make informed license purchasing decisions.") in Salesforce Help. - Verify what object access and capabilities are available in the different [Experience Cloud user licenses](https://help.salesforce.com/s/articleView?id=platform.users_license_types_communities.htm&release=264.0.0&type=5 "The following licenses are used for external users: Customer Community, Customer Community Plus, Partner Community, External Apps, External Identity, and Channel Account.") so that you can set up your users’ access correctly. ## Profiles and Permission Sets - Following the principle of least privilege, keep external users’ permissions to a minimum. - Create custom profiles for your external users instead of using the standard profiles associated with community licenses. In doing so, you can customize ‌the profiles to meet your business needs and avoid granting unneeded access. - To make managing permissions easier, use permission sets and permission set groups instead of profiles. You can reuse smaller, scoped permission sets and avoid creating and maintaining so many profiles for different access requirements. - Create [user access policies](https://help.salesforce.com/s/articleView?id=platform.perm_user_access_policies.htm&release=264.0.0&type=5 "With user access policies, you define aggregated access for your users in a single operation. Automate your users’ assignments to permission set licenses, permission sets, permission set groups, package licenses, queues, and public groups. You can create policies that grant or remove access whenever users are created or updated, or in a one-time manual migration.") to set access for external users automatically based on criteria, such as the user’s profile. You can also leverage user access policies to migrate users from profiles to permission sets and permission set groups more efficiently. ## User and Personal Information Visibility - Configure user sharing so that external users have the correct visibility to each other. For example, you can configure settings so that external users are visible only to themselves or only to other users in the same site and account. For more information, see [Control Which Users Experience Cloud Site Users Can See](https://help.salesforce.com/s/articleView?id=platform.networks_user_sharing.htm&release=264.0.0&type=5 "With user sharing, you decide whether all users in an Experience Cloud site are visible to each other."). - Protect privacy by hiding user fields if they contain personally identifiable information (PII). For more information, see [Manage Personal User Information Visibility for External Users](https://help.salesforce.com/s/articleView?id=platform.users_manage_personal_info_visibility.htm&release=264.0.0&type=5 "Protect your external users' data by concealing personal information fields from other external users. To meet your business's security needs, modify which user fields are classified as personal information and hidden from view on Experience Cloud sites."). ## Record Access and Sharing - Whenever possible, keep the external organization-wide default for objects set to Private, meaning external users have no access to records that they don’t own for these objects. - You can have up to three account roles, which can help you set up access for different types of external users in an account. However, for better performance, we recommend that you keep the default one account role, and use other sharing mechanisms to increase visibility of records as needed. [Optimize account roles](https://help.salesforce.com/s/articleView?id=platform.networks_partners_optimize_roles.htm&release=264.0.0&type=5 "If you expect a large volume of business accounts with a single Experience Cloud user, we recommend enabling Account Role Optimization (ARO) to ensure the best performance possible. ARO minimizes the number of roles created for users with licenses that require external user records to be associated with roles. The fewer the roles, the better the performance of your Experience Cloud site.") to improve performance. - Data visibility in the external account role hierarchy functions the same as the regular role hierarchy. Internal users can see records owned by or accessible to external users below them in the hierarchy when one of their subordinates is the account owner. - Grant [super user access](https://help.salesforce.com/s/articleView?id=platform.networks_customer_super_user_access.htm&release=264.0.0&type=5 "Enable super user access so that users with Partner Community or Customer Community Plus licenses in your sites can access more records and data.") sparingly to partner and customer users, because of the widespread data access it allows. - Keep track of which public groups and roles include external users, and take caution when granting them access in sharing rules. Remember that public groups can be nested, meaning a public group can include another public group that has external users. - When possible, use sharing sets and share groups to give access to records related to an external user’s account or contact, rather than sharing rules or other record access features. Sharing sets and share groups are tailored for external user access scenarios, making them more performant, secure, and scalable in these cases. ## Access Reviews and Audits - Periodically review access using the different access summary features: - Pick a user that’s representative of a specific account, persona, or role. Then, view that [user’s access summary](https://help.salesforce.com/s/articleView?id=platform.users_access_summary.htm&release=264.0.0&type=5 "To make managing permissions and troubleshooting access easier, in the User Access Summary, you can see a consolidated view of a user’s key details and assigned permissions and tabs. You can also manage the user’s assigned permission sets, permission set groups, public groups, and queues.") to see the user’s assigned permissions, public groups, and queues. You can click a permission's row-level action, and then click Access Granted By to see which feature is granting it. Remove any permissions or group and queue assignments that aren’t necessary. - Review [permissions in permission sets and permission set groups](https://help.salesforce.com/s/articleView?id=platform.perm_sets_summary_page.htm&release=264.0.0&type=5 "To help you manage your users’ permissions, you can see and update all object, user, field, and custom permissions that are enabled for a permission set or permission set group in its summary page. You can also manage which permission set groups the permission set is included in and vice versa.") assigned to external users to make sure the access level is correct. - Review public group membership and usage using its [access summary](https://help.salesforce.com/s/articleView?id=platform.public_group_access_summary.htm&release=264.0.0&type=5 "With the Public Group Access Summary, see the sharing rules, report and dashboard folders, and list views where this public group is used to grant access. You can also see the other public groups that it’s added to. The public group can be referenced in other features not listed in this summary."). For example, see which users are assigned to a public group. And for public groups that contain external users, see through which sharing rules they’re gaining access to records. - Review permissions included in profiles assigned to external users in Setup or using API queries.