---
schema_version: "1"
id: 9a52bad456a757ececd2f582cbd27b5207ba21503a140f8b7125a9a6673f6be4
title: Security Checks for Omnistudio
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/os_omnistudio_security_updates_overview.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.os_omnistudio_security_updates_overview.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7567f9ccd945994946cdbf3084be379a0d52f643f78e2c5293ee870855b197ab
description: The security checks for Omnistudio enforce stricter validation of access and permissions. These checks make sure that users, including guest, authenticated, and non-authenticated users, have the appropriate access to objects and fields used within Omnistudio components.
products:
  - Omnistudio
release: "264"
---
# Security Checks for Omnistudio

The security checks for Omnistudio enforce stricter validation of access and permissions. These checks make sure that users, including guest, authenticated, and non-authenticated users, have the appropriate access to objects and fields used within Omnistudio components.

## Field-Level Security Requirements for Standard Runtime

Standard runtime enforces field-level security (FLS) more strictly than the managed package runtime. To prevent LWC compilation errors and component visibility issues, you must explicitly grant field-level permissions on these Omnistudio objects for all user profiles that run Omnistudio components:

 
| Object | Required FLS |
| --- | --- |
| Omni Process Compilation | Read, Edit |
| Omni Data Transformation | Read |
| Omniscript Saved Sessions | Read, Edit |

These requirements apply to the standard runtime and are separate from the security feature flags described below.

These feature flags control the Omnistudio security checks. The security checks only apply when the flag is enabled.

- `ApexClassCheck`: Requires users to have explicit Apex class access for any remote actions called from Omniscripts or Flexcards. See [Add an Apex Class Permissions Checker](https://help.salesforce.com/s/articleView?id=xcloud.os_standard_add_an_apex_class_permissions_checker.htm&type=5&language=en_US).
- `EnforceDMFLSAndDataEncryption`: Automatically enforces Object and field-level security (FLS) for all Data Mappers. Users without the `View Encrypted Data` permission can’t view encrypted fields in plain text. See [Security for Omnistudio Data Mappers and Integration Procedures](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_48147.htm&type=5&language=en_US).
- `EnableQueryWithFLS`: Enforces FLS for all Salesforce Object Search Language (SOSL) and Salesforce Object Query Language (SOQL) queries within Flexcards, ensuring data visibility respects user permissions. See [Set Up a Data Source on a Flexcard](https://help.salesforce.com/s/articleView?id=xcloud.os_configure_a_data_source_on_a_flexcard_35864.htm&type=5&language=en_US).

There are no behavioral changes to these previously announced security flags. Enabling them continues to support consistent enforcement of data access and security controls across Omnistudio components.

To enable these Omnistudio security flags:

1. From Setup, in the Quick Find box, enter Omni Interaction Configuration, and then select **Omni Interaction Configuration**.
2. Click **New Omni Interaction Configuration**.
3. In the Label field, enter the flag name exactly as shown above. For example, `ApexClassCheck`. The Name field is auto-populated from the label.
4. In the Value field, enter true. The value is not case-sensitive.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-omnistudio-264-0-0-production-enus/f526eaa8-ae05-487a-8944-4bb99b0b78ac/images/icon_important.png)

Important During the week of February 2, 2026, Salesforce enables the ApexClassCheck, EnforceDMFLSAndDataEncryption, and EnableQueryWithFLS settings by default to enhance org security. Review and prepare your configuration for a seamless transition and to prevent potential service interruptions.