Use case: access review
Find who has more access than they need, which users are inactive, where guest users can reach data and which permission sets duplicate each other, then fix it safely.
In one paragraph
Running a Salesforce permissions review with SyncOnAI 360 means reading the audit's permission, security and usage findings, each with its evidence, mapping them to SOC 2, ISO 27001 and Essential Eight controls, sharing the result read-only with reviewers, and fixing access through proposals that flag every access change for the approver.
01The problem
An access review means exporting profiles, permission sets and login history into spreadsheets, then arguing about what each grant means.
Access is reviewed from flattened exports.
Guest user access and broad API access are easy to miss.
Inactive accounts keep their access.
Removing a permission might break someone's job.
02find
Guest user object access, Modify All Data outside admin profiles, API access enabled too broadly, security that leans on profiles, redundant permission sets, users inactive for 30 or 90 days or never logged in, elevated login failures, MFA not enforced, a low Security Health Check score, connected app sprawl and the number of admin users.
03evidence
Each finding has its evidence, such as the table of permission grants behind it, a severity and an estimated cost to fix. The permissions and security section is one of the two most heavily weighted in the org's score.
04map
The compliance view maps relevant findings to SOC 2, ISO 27001 and Essential Eight controls, giving reviewers a working list. It supports a compliance conversation; it is not a certification of the org.
05share
Share the audit as a read-only link that opens without an account, expires, and can be withdrawn when the review closes. The record that it was shared is kept.
06fix
Removing a permission or retiring a duplicate set is a proposal like any other. Its Security and access check names what changes and warns the approver, and production needs a second admin's approval. Every change leaves a receipt with rollback.
07cadence
The live checks read user and login history on every audit, so access can be reviewed whenever the audit runs, not only at the annual review. Inactive users and new admin accounts show up as findings as soon as they appear.
Keep each review: review history stores past results, so an auditor can see the state of access at each point and what changed between them.
08How it works
Evidence first, then decisions.
Run the audit and open the security findings.
Work through elevated access and inactive users.
Use the compliance view for reviewers.
Send a read-only link; withdraw it later.
Ship access changes as approved proposals.
09Checklist
10Before and after
Without
With SyncOnAI 360
Spreadsheets of exports
Findings with their grants
Guest exposure missed
Guest access checked
Inactive users keep access
30 and 90 day checks
Cleanup in Setup
Approved, reversible changes
12Questions
Yes. Users inactive for 30 or 90 days, and users who never logged in.
Yes. Guest user object access is a dedicated check.
No. Findings are mapped to controls to support the conversation; it is not a certification.
Yes, through a read-only link that can be withdrawn.
No. Removals are proposals you approve.
Yes. The Security and access check warns on every such proposal.
No. It reads metadata, user and login history and the Setup Audit Trail.
Yes. Every plan includes every feature.
Yes. Connected app sprawl is one of the adoption checks.
Yes. MFA that is not enforced is flagged.
Yes. The number of admin users is one of the compliance checks.
13Keep exploring
Connect your Salesforce org. Run your first health scan. Ask your first question. See what you've been missing.