Data Quality & Management

Hi everyone,

I would appreciate some architectural guidance on a Salesforce security requirement.

We need to restrict Sales users from exporting or extracting company-wide financial/reporting data, while they must continue using Salesforce normally, including the Salesforce Mobile App.

Our initial approach was to remove the API Enabled

permission from their corresponding Permission Set Group to prevent API-based extraction tools such as Data Loader or spreadsheet connectors. 

Howeever, I would like to confirm with you, if API Enabled is also required for the Salesforce Mobile App, which Sales users need to use.

Therefore, my questions are:

1. Is removing API Enabled an appropriate approach for preventing data extraction in this scenario, or would this have unintended consequences beyond the intended restriction?
2. What would be the recommended Salesforce architecture to restrict API-based data extraction for Inside Sales while keeping access to the Salesforce Mobile App?
3. Would API Access Control / Connected App allowlisting be a better approach, for example allowing Salesforce Mobile while restricting other API clients?
4. Are there other Salesforce permissions or security controls that should be considered specifically for preventing report/data export without disabling API access entirely?

The business requirement is specifically to restrict data extraction

, not to prevent Sales users from using Salesforce Mobile or other approved Salesforce functionality. 

The focus is on:

• Reports: No creating, editing, cloning, or exporting.
• Dashboards: No access to restricted Turnover dashboards.
• Subscriptions: Prevent receiving Reports/Dashboards via email.
• List Views: Prevent export/print as an extraction method.
• Folder Sharing: Prevent indirect access to restricted Reports/Dashboards.

Any guidance or documentation from Salesforce would be greatly appreciated. 

Hi everyone,

I’m looking for some architectural input on a record visibility design for a multi-subsidiary arquitecture. 

Context:

• Account and Quote OWDs are set to Private.
• An ERP integration creates Quote records linked directly to QuoteAccountId (field when you activate the feature "Create Quotes without Opportunities"
• All sales users share the same Profile and Role and public groups BUT
• Field Sales users should only see Quotes linked to Accounts they own, provided the Quote and Account regions (e.g. Spain, France, etc.) match.

Current Solution:

To distinguish Field Sales users from back-office users, I created dedicated Public Groups per region (e.g. Group_FieldSales_RegionA, Group_FieldSales_RegionB).

A Record-Triggered Flow checks whether the Account Owner belongs to the corresponding Field Sales group. If so, the Flow creates a QuoteShare record for that user.

Importantly, these Public Groups created for the Field Sales users are not used in Sharing Rules

. They are only used by the Flow as an internal validation mechanism to identify whether the Account Owner is a Field Sales user. This is also important for managers with hybrid responsibilities, who may belong to both Field Sales and back-office groups (they are everywhere in every public group with execption of my newly created Field Sales public groups) 

Architectural Question:

There is a concern of non-developer members about using Public Groups and believes visibility should be based purely on Account Ownership.

1. Would you consider using Public Groups as an internal identity/validation mechanism in Flow a sound architectural approach in this scenario?
2. If Public Groups cannot be used, what would be a robust alternative for a Flow to identify Field Sales users, given that Profiles, Roles and public groups are shared and some users have hybrid responsibilities (Sales Managers are inside and outside at the same time)?

I’d appreciate your thoughts on the best practice for this design.

Thanks in advance! 

Hi everyone,

I need to perform a bulk security update to grant visibility over thousands of existing historical Quote records in our system.

The Setup:

• OWD: Account and Quote objects are both set to Private.
• We use the "Create Quotes Without Opportunity" feature, so thousands of existing integrated Quotes are linked to Accounts via the standard QuoteAccountId field.
• Field agents are assigned to Regional Public Groups (e.g., OutsideSalesSpain, OutsideSalesFrance, etc.) matching their specific company/region field value (Spain, France, etc.).

The Requirement:

I need to run a one-time bulk update to grant

if the Quote's region matches the Account's region. 

I already created a flow to handle this when quotes are being created, but the flow does not handle this visibility when there already exist Quote records in Salesforce. 

If I use Data Loader to solve this for historical Quote records, the solution would take long and would be cumbersome (probably manual efforts). Is this possible to solve with Apex?. We are talking about more than 20000 existing Quote records!.

Thanks for your advice! 

Hi everyone,

I’m looking for some advice on a Salesforce security/architecture scenario. 

We have a group of Sales users whose Account access is granted through criteria-based sharing rules based on the entity/company they work for

. For example, users belonging to different country entities receive access to the corresponding Accounts. 

These users are also assigned to a Permission Set Group that grants Read access to a number of financial fields on the Account object

. 

The business requirement is to restrict these users from creating or modifying Reports, exporting Report data, and accessing restricted company-wide financial Reports and Dashboards.

At the same time, they must retain their existing visibility when working with an individual Account they have access to, including the relevant financial information, Invoices and Orders.

This leads to a question around the same financial fields being available through different Salesforce surfaces.

If a user has FLS Read access to these Account fields so that they can see them on the Account Record Page:

Is there any standard/native Salesforce mechanism to prevent those fields from being available in List Views, while still allowing them to be displayed on the Account Record Page?

And regarding Reports:

If the user is allowed to run a centrally provided Report, is there a standard way to prevent the financial fields from being exposed through that Report while keeping the user's existing Account-level visibility? 

We explored using Custom Report Types to exclude these financial fields from the layout. However, if an Inside Sales user runs a centrally provided Report built on a report type that does

include these fields (because Outside Sales and Management users share the reports and need them), Salesforce will render the data for the Inside Sales user too, as long as their FLS is active. Salesforce does not support dynamic column masking or role-based field filtering within a shared Report Type. 

Or is the standard Salesforce security model that FLS applies globally across all these surfaces, with Report/Dashboard folder access and export permissions providing the only standard restrictions?

I’m interested specifically in the standard Salesforce capabilities, or is this only possible per custom and if yes, how? LWCs? 

Thanks! 

Hi everyone,

I need an architectural sanity check on a security requirement. I want to avoid hitting platform limits down the road and would appreciate some feedback on whether this can be safely achieved using Schedule-Triggered Flows or whether Scheduled Batch Apex would be required.

Context

• We are changing the Organization-Wide Defaults (OWD) of the standard Quote object from Controlled by Parent to Private.
• We receive an integration feed from an external system that creates or updates up to approximately 80 Quotes per Account per day. Quotes can also be created manually in Salesforce.
• Quotes contain two custom Account lookups: Sold-To and Bill-To.
• We have both Quotes with and without Opportunities.

Requirement

• The Account Owner of the Sold-To Account and the Account Owner of the Bill-To Account must have Read-Only access to the related Quote.
• When the Account Owner changes, access to the related Quotes must be updated accordingly, including removing the previous owner's access and granting access to the new owner.
• The required access is managed through QuoteShare records with RowCause = Manual.

Architectural Question

Given the expected Quote volume and the need to automate the insertion and cleanup of QuoteShare records following Account ownership changes:

• Is this approach feasible using a standard Schedule-Triggered Flow, or would Scheduled Batch Apex be required to ensure scalability and avoid governor limits?
• What would be the cleanest architectural pattern for handling the cleanup and creation of Manual QuoteShare records when Account ownership changes?

Thanks for your guidance!

Hi everyone,

I need some architectural advice on the best way to handle report and data access for a global team without turning role management into a maintenance nightmare.

• We have report folders separated by countries: Country A Reports, Country B Reports, and Country C Reports.
• In our Role Hierarchy, we have local roles at the bottom (e.g., Sales Rep Country A, Sales Rep Country B) and a high-level corporate role at the top called Global Management.

The Business Requirement:

Product manager users in their Country or Regional Level role complained not being able to access reports with data related to other countries, so we moved them to the

. They require full visibility to access records (Accounts, Opportunities) globally, but they also need to open and view the reports inside the local folders of Country A, Country B, and Country C. 

The challenge:

We noticed that when we move a user from a local country role up to the

role to give them global record visibility, they immediately lose access to some of the regional reports they could see before, or the reports show up completely empty for them. 

My Questions:

1. How can we avoid constantly shifting users from one role to another just so they can see cross-country reports while maintaining access to their respective records? What is the cleanest architecture to decouple record visibility from report folder visibility?
2. What is the Best Practice in Salesforce to solve this? Should we keep these global users in a specific role and grant them report folder access via a Public Group or a specific Permission Set?
3. Why do some reports return empty or give errors to a user right after they are moved to a higher role in the hierarchy? Is it because of dynamic filters in the reports (like "My Team's Records" or "My Role" filters) that break when their branch changes?

Thank you so much for your help! 

Hello Trailblazers,

I am facing a login loop issue with a System Administrator profile when trying to access the Salesforce Mobile App on an iOS device (iPhone), and I would appreciate your insights.

1. I can log in into the desktop version perfectly using Windows Hello PIN as a registered Built-In Authenticator (Passkey).
2. When trying to log into the Salesforce Mobile App on iOS, after entering the Username and Password, the app forces a Passkey verification.
3. The native iOS is still prompting me to use a passkey and there is no chance to choose another verification option. Since the passkey was created locally via Windows Hello, the iPhone cannot resolve it, leading to a dead-end with no option to bypass or cancel.

What I tried so far:

• I disconnected the Built-In Authenticator from the User's Advanced Details via desktop Setup.
• Upon trying to log in again on the mobile app, it bypasses the old key but immediately demands the creation of a new Passkey.
• If I attempt to use a Temporary Verification Code, the login attempt is blocked beforehand by the following error message: 
  "Problem Verifying Your Identity. To log in, you need both a higher access level and an identity verification method. Contact your administrator to gain login access."

Context & Constraints:

• This is a production environment, so I cannot modify global organization settings (such as changing Session Security Levels or altering My Domain mobile browser behaviors) without a formal change control process. I need a solution targeted either at the user level or understanding why the Mobile API triggers this specific high-assurance restriction for this profile.

Has anyone encountered this specific behavior where the Mobile App demands a High Assurance MFA method that blocks the login completely before allowing alternative verification? Any workarounds at the user/permission set level would be highly appreciated.

Thank you in advance! 

Hi everyone,

I have a question regarding the “Create Quotes without Opportunities” feature and a potential future requirement involving Orders.

After enabling the “Create Quotes without Opportunities” feature, Salesforce automatically provides the QuoteAccountId field on the Quote object. For Quotes created without an Opportunity, the Account relationship is stored in QuoteAccountId, while the standard AccountId is not populated.

Would it be technically possible to populate the standard AccountId field with the value from QuoteAccountId

for Quotes created without an Opportunity?. 

The reason for considering this is that Orders will be used in the future, and the standard Account relationship may be required for the Order process.

Would populating AccountId = QuoteAccountId be a supported and recommended approach, or are there any Salesforce limitations or implications we should consider when working with Quotes without Opportunities? or any workaround?.

Thanks for your guidance!