--- schema_version: "1" id: ae911eaea8c0c9e9deeaf0667903367ac2d1293ac177d09d0eb0f4a62bf8a599 title: Set Up Security for an Admissions Connect Portal collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/sfdo/264-0-0/ac_portal_security.md canonical_url: https://help.salesforce.com/s/articleView?id=sfdo.ac_portal_security.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 84673aeeabdf953cf3e3132799b98156ffe3658c9157fd7d0130f1acb86a7a54 description: Define the data that your portal users can access. products: - Education release: "264" --- # Set Up Security for an Admissions Connect Portal Define the data that your portal users can access. - **[Understand the Basics of Portal Security](https://help.salesforce.com/s/articleView?id=sfdo.ac_portal_security.htm&release=264.0.0&type=5)** The first step in setting up your portal is to design and implement a security model that works for your institution. There are a lot of ways to approach security. You’ll probably use a combination of org-wide default sharing settings, permission sets, sharing sets, and more. - **[Set Up Portal Users](https://help.salesforce.com/s/articleView?id=sfdo.ac_portal_security.htm&release=264.0.0&type=5)** Everyone who uses a portal must be identified as a User in your org. - **[Assign Permission Sets to Portal Users](https://help.salesforce.com/s/articleView?id=sfdo.ac_portal_security.htm&release=264.0.0&type=5)** A permission set is one way to assign object and field permissions so that reviewers and applicants can use Admissions Connect components in a portal. Permission sets can also control membership for your portal. - **[Update Org-Wide Default External Sharing Settings](https://help.salesforce.com/s/articleView?id=sfdo.ac_portal_security.htm&release=264.0.0&type=5)** Sharing settings ensure that portal Users can see Application data and documents in the portal. The external sharing settings specified in your org-wide defaults apply to Users with a Customer Community Plus license. - **[Extend Record Access for Portal Users](https://help.salesforce.com/s/articleView?id=sfdo.ac_portal_security.htm&release=264.0.0&type=5)** After you set up your org-wide default sharing settings, extend your sharing model for external Users to give them access to Applications, Application Reviews, and other EDA records as appropriate. You can use sharing sets, Apex managed sharing, or even manually share records. You want to ensure that applicants can only access their own application information and that external reviewers only see application information that they’re assigned to review. ## Understand the Basics of Portal Security The first step in setting up your portal is to design and implement a security model that works for your institution. There are a lot of ways to approach security. You’ll probably use a combination of org-wide default sharing settings, permission sets, sharing sets, and more. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sfdo-admissions_connect-264-0-0-production-enus/00d22f0a-1ca4-4493-a967-a738a2defcb1/images/icon_note.png) Note Portals only support external users who don't work for your institution, like alumni reviewers and applicants. Make sure that your security model accounts for these users. This article will help you get started, but for detailed considerations on portal security, see [Secure Your Experience Cloud Sites](https://help.salesforce.com/articleview?id=networks_secure_community.htm&type=5) in Salesforce Help. ## Set Up Portal Users Everyone who uses a portal must be identified as a User in your org. For instructions on how to create external users, see [Create Users for Admissions Connect](https://help.salesforce.com/s/articleView?id=sfdo.ac_data_import_users.htm&release=264.0.0&type=5 "Every person who uses Admissions Connect must have a User record in Salesforce. How you create your User records depends on who will be using Admissions Connect. Admissions staff or other people who work for your institution are internal users. These users can only use the Admissions Connect app. People who don’t work for your institution, like alumni reviewers or applicants, are external users. These users can only use an Experience Cloud portal."). ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sfdo-admissions_connect-264-0-0-production-enus/00d22f0a-1ca4-4493-a967-a738a2defcb1/images/icon_note.png) Note External Users must have a Customer Community Plus license. Don’t assign internal users a community-based license. Keep in mind that Customer Community Plus licenses require Roles to be associated with an Account. When portals support more than 50,000 Users at a time, consider optimizing Account Roles for external Users, if appropriate for your security model. The **Use person role for first site user in partner and customer accounts** setting controls this optimization and you enable it before creating your portal Users. Once you enable role optimization, portal Users that belong to Accounts owned by the same Salesforce User share the same role. This consideration makes role-based sharing risky because doing so means that portal Users can access each other’s records. If you plan to optimize Account Roles, we recommend that you don’t use role-based sharing. For full details, see [Optimize Account Roles to Improve Performance and Scale Your Org](https://help.salesforce.com/articleview?id=platform.networks_partners_optimize_roles.htm&type=5) in Salesforce Help. Also consider the limits on the number of Roles and community-based Users that you can have in your org. For limitation details, see [Communities User Licenses](https://help.salesforce.com/articleview?id=platform.users_license_types_communities.htm&type=5) in Salesforce Help. ## Assign Permission Sets to Portal Users A permission set is one way to assign object and field permissions so that reviewers and applicants can use Admissions Connect components in a portal. Permission sets can also control membership for your portal. Each portal User must be assigned the required permission sets and an appropriate role-based permission set. Admissions Connect provides an unmanaged permission set for external reviewers (Admissions Connect - Review Applications for External Users) and applicants (Admissions Connect - Submit Applications). For detailed information about the required permission sets and how to assign them, see [Assign the Admissions Connect Permission Sets](https://help.salesforce.com/s/articleView?id=sfdo.ac_security_permission_sets.htm&release=264.0.0&type=5 "Admissions Connect provides permission sets to help you manage access to objects, fields, and the app. Permission sets are additive—they only grant access, they can’t take it away. You can assign multiple permission sets as needed, and it doesn't matter what profile a user has. Keep in mind that Users can have only one profile, but they can have multiple permission sets."). ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sfdo-admissions_connect-264-0-0-production-enus/00d22f0a-1ca4-4493-a967-a738a2defcb1/images/icon_important.png) Important The provided permission sets include the minimum required access to use Admissions Connect in a portal. These permission sets are unmanaged, which means you must keep them up-to-date, using the information in [Admissions Connect Permission Set Details](https://help.salesforce.com/s/articleView?id=sfdo.ac_permset_ref.htm&release=264.0.0&type=5 "Review the permission sets that are required for each role in your institution."). Don't forget that applicants and reviewers need field-level access for all the fields in Action Plan Items that are Tasks. If you plan to allow applicants to edit fields, make sure you grant Edit access, too. Add this access to the default permission sets, or create an additional permission set just for this access. Without access to these fields, portal Users see an error. Also make sure to review automation for Admissions Connect and your portal carefully, as additional User permissions can sometimes be required that aren't provided in our default permission sets. For example, if you allow applicants to create Application records and automation is triggered that assigns Action Plan Templates (including child Tasks and Document Checklist Items), additional Create and Edit permissions on various objects (such as Action Plan Templates, Action Plans, and Document Checklist Items) can be required. After you've assigned portal Users a permission set, you can use the permission set to control portal membership. For instructions, see [Add Members to Your Experience Cloud Site](https://help.salesforce.com/articleview?id=networks_customize_members.htm) in Salesforce Help. ## Update Org-Wide Default External Sharing Settings Sharing settings ensure that portal Users can see Application data and documents in the portal. The external sharing settings specified in your org-wide defaults apply to Users with a Customer Community Plus license. Review [Configure Sharing Settings for Admissions Connect](https://help.salesforce.com/s/articleView?id=sfdo.ac_security_sharing_settings.htm&release=264.0.0&type=5 "Your organization-wide default sharing settings give you a baseline level of access for each object and enable you to extend that level of access to your Admissions Connect users.") to see our recommendations for external sharing settings. ## Extend Record Access for Portal Users After you set up your org-wide default sharing settings, extend your sharing model for external Users to give them access to Applications, Application Reviews, and other EDA records as appropriate. You can use sharing sets, Apex managed sharing, or even manually share records. You want to ensure that applicants can only access their own application information and that external reviewers only see application information that they’re assigned to review. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sfdo-admissions_connect-264-0-0-production-enus/00d22f0a-1ca4-4493-a967-a738a2defcb1/images/icon_important.png) Important Our security recommendations assume that applicants don't own their Application record. If applicants do own their Application records, there's an increased security risk if you're using role-based sharing. ### For Applicants Here’s a sample sharing set for applicants that provides access based on the external User’s Contact record. | Object | Access Determined By | Access Level | | --- | --- | --- | | Application | User:Contact = Application:hed\_\_Applicant\_\_c | Read/Write | | Contact | User:Contact = Contact:Id | Read/Write | | Education History | User:Contact = Education History:hed\_\_Contact\_\_c | Read Only | | Relationship | User:Contact = Relationship:hed\_\_Contact\_\_c | Read Only | | Test | User:Contact = Test:hed\_\_Contact\_\_c | Read Only | ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sfdo-admissions_connect-264-0-0-production-enus/00d22f0a-1ca4-4493-a967-a738a2defcb1/images/icon_note.png) Note Typically, Application object access is required in all sharing sets for applicants. However, Education History, Relationship, and Test are just examples of Child Objects that could be specified in Application Material Type records. Make sure your sharing set includes object access for each Child Object in your Application Material Types, otherwise applicants see an error when viewing the portal. ### For External Reviewers We don’t have a sample sharing set for external reviewers. Instead, we recommend that you manually share records or use Apex managed sharing to ensure your external reviewers have access to the records they need. See Also: [Set Up Sharing Sets](https://help.salesforce.com/articleview?id=platform.networks_setting_light_users.htm&type=5) in Salesforce Help [Manual Sharing](https://help.salesforce.com/articleview?id=platform.granting_access_to_records.htm&type=5) in Salesforce Help [Understanding Sharing](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_bulk_sharing_understanding.htm) in the Apex Developer Guide