# See who can reach what in Salesforce, and what is too broad. > SyncOnAI 360 Permissions Analysis finds access risks in a Salesforce org from its own metadata and usage: guest user object access, Modify All Data outside admin profiles, broad API access, profile-heavy security, redundant permission sets, inactive and never-used accounts, and missing MFA. Findings carry evidence and map to SOC 2, ISO 27001 and Essential Eight controls. Source: https://synconai360.com/features/permissions ## Key facts - **4**: Permission and security checks - **3**: Control frameworks mapped: SOC 2, ISO 27001, Essential Eight - **90d**: Inactive user detection from login history - **Every**: Proposal flags changes to who can reach what ## Why Salesforce access grows broader every year Access is granted one request at a time and almost never taken away. Profiles accumulate permissions, permission sets overlap, and nobody can say with confidence who can see what. - **Grants without removal.** Every urgent request adds access. Nothing in the process removes it when the need ends. - **Guest exposure.** Experience Cloud guest users can be given object access that nobody intended to make public. - **Powerful permissions spread.** Modify All Data and API access end up on profiles that do not need them. - **Dormant accounts.** Users who left or never logged in keep their access and their attack surface. ## What permission risks does SyncOnAI 360 check for? Permission checks look for guest user object access, Modify All Data granted outside admin profiles, API access enabled too broadly, and security that leans on profiles where permission sets are the better practice. Duplicate detection finds redundant permission sets that grant the same thing. Each finding has its evidence, such as the table of permission grants behind it, a severity and an estimated cost to fix, and the permissions and security section is one of the two most heavily weighted in the org's overall score. - Guest user object access - Modify All Data outside admins - Broad API access - Redundant permission sets ## How are inactive and risky Salesforce users found? Live usage checks read the org's user and login history to find users inactive for 30 or 90 days, users who have never logged in, and elevated login failures. Adoption checks flag MFA that is not enforced, a low Security Health Check score and connected app sprawl. Compliance checks look at setup audit gaps, guest user exposure and the number of admin users, the evidence an access review needs before it starts. - Inactive and never-used accounts - Elevated login failures - MFA enforcement and Health Check score - Admin user count ## How do permission findings map to compliance frameworks? The compliance view maps relevant findings to SOC 2, ISO 27001 and Essential Eight controls, so a compliance team starts from a working list of what to address rather than a blank page. The mapping supports a compliance conversation; it is not a certification of the org. Reports can be shared as read-only links with auditors or stakeholders and withdrawn at any time. - SOC 2, ISO 27001 and Essential Eight mapping - Read-only reports for reviewers - Not a certification ## How are access changes reviewed before they deploy? Every proposal runs a Security and access check. If a change alters permissions, sharing or external access, the check names the components involved and asks the approver to confirm the access is intended. Granting access is a normal thing to deploy, so the check warns rather than fails: its job is to make sure an approver knows they are approving a permission change, without training people to override it. - A Security and access check on every proposal - Components that change access named - Warns so approvers notice, never hidden ## How do you run a Salesforce access review? Start from the permission and usage findings for the org: who has elevated access, who has not logged in for 30 or 90 days, where guest users can reach data and which permission sets duplicate each other. Each finding links to its evidence, so the review works from facts rather than an export. Changes that come out of the review, such as removing a permission or retiring a duplicate set, are proposed like any other change, with the Security and access check, the blast radius and a second admin's approval for production. - Start from evidenced findings - Fixes proposed and approved - Access changes flagged for approvers ## An access review 1. **Scan.** Run the audit's permission, usage and compliance checks. 2. **Review.** Read each finding with its evidence and mapped controls. 3. **Plan.** Turn findings into work items or a statement of work. 4. **Change.** Reduce access through proposals that flag access changes. 5. **Verify.** The next audit confirms each fix. ## Access reviews, with and without SyncOnAI 360 | Without | With SyncOnAI 360 | |---|---| | Exporting profiles to spreadsheets | Permission risks found with evidence | | Dormant accounts found by accident | Inactive and never-used users from login history | | Controls mapped by hand | Findings mapped to SOC 2, ISO 27001 and Essential Eight | | Access changes slipped into releases | Every access change flagged to the approver | | No proof of remediation | Fixes verified by re-audit | ## Who uses permission analysis - **Salesforce admins.** Find guest user exposure, Modify All Data outside admin profiles, over-broad API access, inactive users and redundant permission sets in one place, each with the grants behind it. - **Security and compliance teams.** Start an access review from evidence: findings mapped to SOC 2, ISO 27001 and Essential Eight controls, shared as read-only reports with auditors and withdrawn when the review closes. - **Salesforce architects.** See whether security leans on profiles or permission sets, how many admins the org has and where access is broader than the design intended, before proposing a cleaner model. - **Approvers.** Every change that alters permissions, sharing or external access is named on the proposal with a warning, so nobody approves an access change without knowing it is one. ## Frequently asked questions ### What does a Salesforce permission analysis cover? Who can reach what: profiles, permission sets, guest access, powerful permissions such as Modify All Data, API access, user activity and MFA. ### Does it find guest user exposure? Yes. Guest user object access is checked in both the permissions and compliance sections. ### Can it find unused or inactive users? Yes. Usage checks read login history for users inactive 30 or 90 days, users who never logged in and elevated login failures. ### Does it map findings to SOC 2? The compliance view maps relevant findings to SOC 2, ISO 27001 and Essential Eight controls. It supports compliance work; it does not certify the org. ### Can it detect redundant permission sets? Yes. Duplicate detection finds permission sets that grant the same access. ### Are access changes flagged when we deploy? Yes. Every proposal's Security and access check names changes to permissions, sharing or external access for the approver. ### Does it read our users' records? Usage checks read user and login history to find inactive accounts. CRM records such as accounts and cases are not stored. ### Is permissions analysis on every plan? Yes. Every plan includes every feature.