--- schema_version: "1" id: 5d5a1cec707924c3a53fdeb07fc1d12899a325dc77c3df1d66e0f0f2a62abcb0 title: Advanced Security Checks for Omnistudio for Managed Packages collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/os_advanced_security_updates_overview.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.os_advanced_security_updates_overview.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 251e0171e59f34d82c9f31239f8215ea8facb7e8bc703c4906a4c385154ed75d description: Advanced security checks for Omnistudio for Managed Packages enhance data protection by enforcing stricter validation of access and permissions. When enabled, these checks validate object-level access, field-level security, and Apex class permissions for all users, including guest, authenticated, and non-authenticated users, across Omnistudio components. products: - Omnistudio release: "264" --- # Advanced Security Checks for Omnistudio for Managed Packages Advanced security checks for Omnistudio for Managed Packages enhance data protection by enforcing stricter validation of access and permissions. When enabled, these checks validate object-level access, field-level security, and Apex class permissions for all users, including guest, authenticated, and non-authenticated users, across Omnistudio components. These security enhancements are available starting with the Winter '26, Spring '26, Winter '27 releases. These feature flags control the advanced security checks: | Flag Name | Description | | --- | --- | | `EnforceCardDatasourceSecurity` | Limits Flexcard datasource SOQL and SOSL queries from guest users and authenticated community or portal users to the objects listed in OmniStudioGuestAllowedObjects. This check is on by default. Don't turn it off, because doing so lets external users query setup objects. | | `OmniStudioGuestAllowedObjects` | Specifies the objects that guest users and authenticated community or portal users can query through Flexcard datasources, as a comma-separated list of API names, for example, Account,Contact,Case. If the list is empty, these users can't query any object. Security and metadata objects, such as Apex classes and profiles, are always blocked. | | `AdvancedOmnistudioAccessCheck` | Applies stricter checks for object access, field-level security, and Apex class permissions across Omnistudio. The checks apply to all user types, including guest, authenticated, and unauthenticated users. | | `ApexClassCheckForIP` | Checks that the user has permission to run the custom Apex classes that an Integration Procedure references. | For more information about `ApexClassCheckForIP`, see [Advanced Apex Class Check for Integration Procedures in Omnistudio for Managed Packages](https://help.salesforce.com/s/articleView?id=xcloud.os_ip_advanced_apex_class_check.htm&release=264.0.0&type=5 "The advanced Apex class check is performed through the ApexClassCheckForIP security flag. The ApexClassCheckForIP flag strengthens Omnistudio security by enforcing Apex class access checks during Integration Procedure execution. This enhancement makes sure that users have the required permissions to run custom Apex classes referenced within Integration Procedures."). The advanced security checks apply only when the flags are enabled. In addition to the `AdvancedOmnistudioAccessCheck` and `ApexClassCheckForIP` flags, Omnistudio supports these previously announced security flags: | Flag Name | Description | | --- | --- | | `ApexClassCheck` | Requires users to have explicit profile access to the VlocityOpenInterface Apex class behind remote actions called from Omniscripts, Flexcards, or REST APIs. Turn on this check if your org doesn't have an Omnistudio license, for example, if your org uses an installed Communications, Media, and Energy or Insurance package. | | EnforceDMFLSAndDataEncryption | Makes Data Mappers enforce object-level and field-level security and run in the context of the current user. Encrypted fields appear as plain text only to users with the View Encrypted Data permission. | | EnableQueryWithFLS | Enforces field-level security on SOSL queries and encrypts the queries on the client side. | Salesforce continues to recommend enabling them to support consistent enforcement of data access and security controls across Omnistudio components. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio_for_managed_packages-264-0-0-production-enus/aa2554ec-624a-4ee6-8da4-6435670e6e62/images/icon_important.png) Important During the week of February 2, 2026, Salesforce enables the AdvancedOmnistudioAccessCheck, ApexClassCheckForIP, ApexClassCheck, EnforceDMFLSAndDataEncryption, and EnableQueryWithFLS settings by default to enhance org security. Review and prepare your configuration for a seamless transition and to prevent potential service interruptions. When the advanced security checks are enabled, users must have the appropriate object permissions, field-level security, and Apex class access for the data and logic used within Omnistudio components. If the required permissions aren’t assigned, users may experience issues accessing or interacting with Omnistudio data. For information about the permissions required when the `AdvancedOmnistudioAccessCheck` feature flag is enabled, see [Omnistudio Component Access Issues and Potential Causes](https://help.salesforce.com/s/articleView?id=xcloud.os_comp_access_issues_causes.htm&release=264.0.0&type=5 "This table outlines the permissions required when the AdvancedOmnistudioAccessCheck feature flag is enabled."). ## How to Enable Security Flags in Omnistudio The steps to enable security flags and the location of the settings depend on whether the org has an Omnistudio license and whether it uses a custom data model or standard data model. Depending on your org's Omnistudio license status and data model, locate and configure the flags. For information about data models, see [Omnistudio Data Models](https://help.salesforce.com/s/articleView?id=xcloud.os_migrate_omnistudio_custom_objects_to_standard_objects.htm&type=5&language=en_US), [Does Your Org Use Custom or Standard Objects?](https://help.salesforce.com/s/articleView?id=xcloud.os_does_your_org_use_custom_or_standard_objects.htm&language=en_US&type=5). - In orgs without an Omnistudio license or orgs still using custom data model: 1. From Setup, in the Quick Find box, enter Custom Settings, and then select **Custom Settings**. 2. Click **G** and go to **General Settings**. 3. Click **Manage**. 4. Click **New**. 5. In the Label field, enter the flag name. For example, AdvancedOmnistudioAccessCheck. 6. In the Value field, enter true. - In orgs with an Omnistudio license using the standard data model: 1. From Setup, in the Quick Find box, enter Omni Interaction Configuration, and then select **Omni Interaction Configuration**. 2. Click **New Omni Interaction Configuration**. 3. In the Label field, enter the flag name. For example, AdvancedOmnistudioAccessCheck. 4. In the Value field, enter true. - **[Set Up the Object Allowlist for External User Queries in Omnistudio](https://help.salesforce.com/s/articleView?id=xcloud.os_setup_datasource_allowlist.htm&release=264.0.0&type=5)** Specify which objects Experience Cloud guest users and authenticated community or portal users can query through Omnistudio, so that external users reach only the data that your site needs. - **[Omnistudio Component Access Issues and Potential Causes](https://help.salesforce.com/s/articleView?id=xcloud.os_comp_access_issues_causes.htm&release=264.0.0&type=5)** This table outlines the permissions required when the AdvancedOmnistudioAccessCheck feature flag is enabled. - **[Troubleshoot Component Access in Omnistudio for Managed Packages](https://help.salesforce.com/s/articleView?id=xcloud.os_security_troubleshoot_comp_access.htm&release=264.0.0&type=5)** Identify and resolve access-related issues in your orgs: