---
schema_version: "1"
id: fdcef1a2a12e73e2768aea0961763fa935a91a2a7a3ec44caf103ca7ec845ce9
title: Set Up Record Access for Your Users
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/users_manage_sharing.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.users_manage_sharing.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: cdcc65962a6934c5bcaf6c2c82f6121f5c72cd8c0f9dfa1d1f814b095ffdde20
description: As part of your data management setup, configure the access that your users have to records that they don’t own through organization-wide defaults, the role hierarchy, sharing rules, manual sharing, and other features. Sharing settings respect the object permissions that you configure for your users using permission sets.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Set Up Record Access for Your Users

As part of your data management setup, configure the access that your users have to records that they don’t own through organization-wide defaults, the role hierarchy, sharing rules, manual sharing, and other features. Sharing settings respect the object permissions that you configure for your users using permission sets.

![Text with the text Manage Record Access](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/access/images/banner_manage_record_access.png)

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/images/icon_tip.png)

Tip Setup with Agentforce can help you manage record access more efficiently. For more information, see [Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_overview.htm&language=en_US) and [User Access Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_user_access.htm&language=en_US).

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:33.33333333333333%">
        <col style="width:33.33333333333333%">
        <col style="width:33.33333333333333%">
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_start.png" alt="Icon representing the start of a journey"></span>
            </p>
            <p>
              <strong>Learn About Data Security</strong>
            </p>
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="height:35px;margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_minimap/trailhead_minimap.png" alt="Icon representing Trailhead"></span>
              <a href="https://trailhead.salesforce.com/content/learn/modules/data_security" target="_blank">Data Security</a>
            </p>
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/video.png" alt="Icon representing video"></span>
              <a href="https://salesforce.vidyard.com/watch/B1bQnMFg2VyZq7V6zXQjPg" target="_blank">Who Sees What Series: Lightning Experience</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.sharing_across_objects.htm&amp;release=264.0.0&amp;type=5" title="Implicit sharing is a built-in mechanism in the Salesforce platform that automatically grants users access to parent records if they can access related child records and vice versa. There’s also built-in sharing behavior for external site and portal users.">Implicit Sharing</a>
            </p>
            <p>
              <a href="https://architect.salesforce.com/well-architected/trusted/secure" target="_blank">Salesforce Well-Architected: Secure</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://architect.salesforce.com/fundamentals/platform-sharing-architecture" target="_blank">Salesforce Architects: Platform Sharing
                Architecture</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_analyze_2.png" alt="Icon representing a magnifying glass"></span>
            </p>
            <p>
              <strong>Plan Your Access Control
                Setup</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_sharing_performance.htm&amp;release=264.0.0&amp;type=5" title="Review these recommendations for designing and maintaining your sharing configuration to optimize access control performance.">Best Practices for Optimizing Sharing Performance</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://developer.salesforce.com/docs/atlas.en-us.draes.meta/draes/draes_interface.htm" target="_blank">Designing Record
                Access for Enterprise Scale</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_develop_1.png" alt="Icon representing gears"></span>
            </p>
            <p>
              <strong>Set Baseline Record Access with
                Organization-Wide Defaults</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&amp;release=264.0.0&amp;type=5" title="Define the default access that users have to records they don't own with organization-wide sharing settings. Organization-wide sharing settings can be set separately for custom objects and many standard objects. You can set different levels of access for internal and external users.">Organization-Wide Sharing Defaults</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.admin_sharing.htm&amp;release=264.0.0&amp;type=5" title="Internal organization-wide sharing defaults set the baseline access for your internal users for your records. You can set the defaults separately for different objects.">Set Your Internal Organization-Wide Sharing Defaults</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&amp;release=264.0.0&amp;type=5" title="External organization-wide defaults provide separate organization-wide defaults for internal and external authenticated users to help you better secure your data.">External Organization-Wide Defaults Overview</a>
            </p>
          </td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_package_2.png" alt="Icon representing a Salesforce Setup page"></span>
            </p>
            <p>
              <strong>Extend Record Access
                Vertically with the Role Hierarchy</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_controlling_access_using_hierarchies.htm&amp;release=264.0.0&amp;type=5" title="Determine whether users have access to records they don’t own, including records to which they don’t have sharing access, but someone below them in the hierarchy does.">Controlling Access Using the Role Hierarchy</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.admin_roles.htm&amp;release=264.0.0&amp;type=5" title="In the role hierarchy, users have access to records owned by or shared with users in roles below them. Roles within the hierarchy affect access on components such as records and reports.">Create a User Role</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.setup_roles_guidelines.htm&amp;release=264.0.0&amp;type=5" title="Understand key rule behaviors, and apply best practices for success with roles.">Guidelines for Success with Roles</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_audience_2.png" alt="Icon representing multiple users"></span>
            </p>
            <p>
              <strong>Configure Public Groups and Queues for Record Access</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.user_groups.htm&amp;release=264.0.0&amp;type=5" title="A group consists of a set of users. A group can contain individual users, other groups, or the users in a particular role or territory. It can also contain the users in a particular role or territory plus all the users below that role or territory in the hierarchy.">Public and Personal Groups</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.creating_and_editing_groups.htm&amp;release=264.0.0&amp;type=5" title="Create public groups to help configure your users’ access to records and other features. Only administrators and delegated administrators can create and edit public groups.">Create and Edit Public Groups</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=service.setting_up_queues.htm&amp;type=5&amp;language=en_US" target="_blank">Create Queues</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_extend_2.png" alt="Icon representing expanding access"></span>
            </p>
            <p>
              <strong>Grant Additional Record
                Access with Sharing Rules</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_about_sharing_rules.htm&amp;release=264.0.0&amp;type=5" title="Use sharing rules to extend sharing access to users in public groups, roles, or territories. Sharing rules give particular users greater access by making automatic exceptions to your org-wide sharing settings.">Sharing Rules</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_sharing_rules_create.htm&amp;release=264.0.0&amp;type=5" title="You can create sharing rules based on the record owner or other criteria, and sharing rules that grant record access to unauthenticated guest users. You can also create sharing rules based on group membership for the User object.">Create Sharing Rules</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_sharing_rule_considerations.htm&amp;release=264.0.0&amp;type=5" title="Review these considerations before using sharing rules.">Sharing Rule Considerations</a>
            </p>
          </td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_build_2.png" alt="Icon representing a wrench"></span>
            </p>
            <p>
              <strong>Share Individual Records with Manual
                Sharing</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.granting_access_to_records.htm&amp;release=264.0.0&amp;type=5" title="Manual sharing allows users to share individual records with other users, public groups, and roles.">Manual Sharing</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.manual_sharing_considerations_lex.htm&amp;release=264.0.0&amp;type=5" title="When you grant access to records with manual sharing, there are some considerations to keep in mind.">Manual Sharing Considerations</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_audience_2.png" alt="Icon representing multiple users"></span>
            </p>
            <p>
              <strong>Give Site Users Access with
                Sharing Sets and Share Groups</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.networks_setting_light_users.htm&amp;release=264.0.0&amp;type=5" title="Give Experience Cloud site users access to records using sharing sets. A sharing set grants site users access to any record associated with an account or contact that matches the user’s account or contact. You can grant access to records via access mapping, which defines access for each object in the sharing set. Access mappings support indirect lookups from the user and target record to the account or contact. For example, grant site users access to all cases related to an account that’s identified on the user’s contact records. A sharing set applies across all sites that a user is a member of. Record access granted to users via a sharing set isn’t extended to their superiors in the role hierarchy.">Create a Sharing Set for Experience Cloud Site Users</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.networks_sharing_light_users.htm&amp;release=264.0.0&amp;type=5" title="Share groups allow you to share records owned by high-volume Experience Cloud site users with authenticated internal and external users.">Use Share Groups to Share Records Owned by High-Volume Experience Cloud Site Users</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_user_2.png" alt="Icon representing a user"></span>
            </p>
            <p>
              <strong>Manage Users’ Record
                Access</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.viewing_which_users_have_access_lex.htm&amp;release=264.0.0&amp;type=5" title="When viewing a record, you can view a list of users who have been granted access to the record through sharing. The list includes their access level and an explanation and shows every user who has access that’s greater than the org-wide default settings.">Viewing Which Users Have Access to Your Records in Lightning Experience</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_sharing_update_considerations.htm&amp;release=264.0.0&amp;type=5" title="Review these considerations before making sharing changes, such as updates to organization-wide defaults, sharing rules, account ownerships, or group memberships.">Considerations for Making Sharing Updates</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_sharing_defer_sharing_calculations.htm&amp;release=264.0.0&amp;type=5" title="Performing a large number of configuration changes can lead to very long sharing rule evaluations or timeouts. To avoid these issues, a Salesforce admin can suspend sharing calculations, specifically for sharing rules and group membership, then resume calculations during an organization's maintenance period.">Defer Sharing Calculations</a>
            </p>
          </td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_develop_2.png" alt="Icon representing gears"></span>
            </p>
            <p>
              <strong>Filter Record Access Using Restriction
                Rules</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule.htm&amp;release=264.0.0&amp;type=5" title="Restriction rules let you enhance your security by allowing certain users to access only specified records. They prevent users from accessing records that can contain sensitive data or information that isn’t essential to their work. Restriction rules filter the records that a user has access to so that they can access only the records that match the criteria you specify.">Restriction Rules</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_create.htm&amp;release=264.0.0&amp;type=5" title="Control the records that a specific user group is permitted to see. When a restriction rule is applied to a user, the data that the user has access to via org-wide defaults, sharing rules, and other sharing mechanisms is filtered by the record criteria that you specify.">Create a Restriction Rule</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_restriction_rule_examples.htm&amp;release=264.0.0&amp;type=5" title="Refer to these sample restriction rules, which fulfill different access requirements.">Restriction Rule Example Scenarios</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_audience_end_2.png" alt="Icon representing multiple users"></span>
            </p>
            <p>
              <strong>Use Scoping Rules So Users Can
                Focus on Specified Records</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_scoping_rule.htm&amp;release=264.0.0&amp;type=5" title="Scoping rules let you control the records that your users see in list views, reports, and SOQL queries based on criteria that you select. You can set up scoping rules for different users in your Salesforce org so that they can focus on the records that matter to them. Users can switch the set of records they’re seeing as needed.">Scoping Rules</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_scoping_rule_create.htm&amp;release=264.0.0&amp;type=5" title="Determine which records your users see by default. When a scoping rule is applied to a user, the data that the user sees in list views and reports is filtered by the criteria you set.">Create a Scoping Rule</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.security_scoping_rule_examples.htm&amp;release=264.0.0&amp;type=5" title="Refer to these sample scoping rules, which fulfill different access requirements.">Scoping Rule Example Scenarios</a>
            </p>
          </td>

          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/learning_maps/lm_analyze_end_1.png" alt="Icon representing multiple users"></span>
            </p>
            <p>
              <strong>Troubleshoot Access Control Issues</strong>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.admin_insufficient_privileges_map.htm&amp;release=264.0.0&amp;type=5" title="Your users can experience access issues or insufficient privileges errors if object permissions or record-access features aren’t configured correctly.">Troubleshoot Object and Record Access Issues</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.admin_insufficient_privileges_object.htm&amp;release=264.0.0&amp;type=5" title="If your users have issues completing a task or accessing a feature, review their assigned permissions.">Troubleshoot Feature Access Issues</a>
            </p>
            <p>
              <a href="https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_considerations.htm&amp;release=264.0.0&amp;type=5" title="Review these object-specific considerations and additional features that can affect what your users can see or access.">Additional Considerations for Troubleshooting Access Issues</a>
            </p>
            <p style="margin-bottom:0;">
              <a href="https://help.salesforce.com/s/articleView?id=platform.admin_troubleshoot_queries.htm&amp;release=264.0.0&amp;type=5" title="Review these sample queries on returning information about users’ permissions or access.">Example Queries for Troubleshooting Access Issues</a>
            </p>
          </td>

        </tr>
      </tbody>
    </table>