Access 360 permissions and effective access

Overview

Access 360 reads an org's profiles, permission sets, groups and muting sets. It shows what each one grants, what each user actually ends up with, and which combinations will cause problems. You can investigate any user's access, work through findings, and draft fixes for review.

Open it from the sidebar under Architecture → Access 360.

Before you start

• The org needs a working Salesforce connection. The scan reads it live.
• Viewing needs the View Access 360 permission (access.view). Running scans and changing findings or rules needs Run access scans & triage (access.manage). By default, every built-in role except Viewer can scan and triage, and Viewers can only view.
• Large orgs take several minutes to scan.

Steps

1. Pick the org and click Scan now. The scan runs on the server in four steps: Metadata, Grantors & universe, Users & effective access, then Rules & findings. You can leave the page while it runs.
   • If a scan stopped partway through, the button reads Resume scan.
   • Full rescan ignores the previous scan and re-reads every source.
   • Cancel scan stops the worker at its next step and keeps the previous results.
2. On Dashboard, check the Health score and Users with dangerous permissions. The health score is 100 minus the weighted findings per 100 active users. The target for users with dangerous permissions is 5% or less.
3. On Explorer, choose By user, By grantor or By permission. Pick a user to see their effective object access matrix. Click any cell to see why they have that access, and which grantors gave it to them.
4. On Findings, filter by status, select findings, and use Acknowledge, Snooze (defaults to 30 days from today), Assign or CSV.
5. Open a finding to see its evidence and suggested fix. Where the fix is to add missing permissions, click Draft remediation, then Download .permissionset-meta.xml. The file is additive XML for you to review and deploy through your normal process.
6. On Drift, choose Compare against… to pick another org, then click Compare. Users are matched by username, and their resolved access is compared.
7. On Rules, turn rules on or off and change their severity or parameters. Click Save changes, and the changes apply from the next scan. To add a custom New rule, click Test against this org first, then Save rule.
8. On Schedule, turn on Scan this org daily. Choose alerts for new critical findings, new high findings, or a user gaining a dangerous permission. Add any Extra recipients, then click Save.

Example

A finding in acme-prod shows that Priya, a release manager, has Modify All on Contracts. In Explorer, the cell shows the access comes from a permission set group she was added to for a one-off data fix. The security lead assigns the finding to that team's owner and links ticket ACME-142. A week later, the daily scan confirms the access has been removed.

FAQs

Does a scan change anything in Salesforce?

No. Scans only read data, and remediation is download-only.

Why can't I click Scan now?

Your role may not have Run access scans & triage, or a scan may already be running. See Roles and permissions.

How is Drift different from a metadata comparison?

Drift compares what users actually end up with, not the permission set XML.

Troubleshooting

"No scan yet for acme-uat."

This org hasn't been scanned yet. Click Scan now.

"Scan failed at … The previous results are untouched."

The message names the step where the scan stopped. This usually happens because of an expired token or a timeout. Fix the connection and click Scan now to resume. See Fix expired org credentials.

"Both orgs need a completed scan."

Run a scan in the other org too, then compare again.

Related articles

• Roles and permissions
• Review licenses and capability enablement
• Communication Center emails
• Permission denied errors