How to govern External Access in Salesforce
A step-by-step guide to governing External Access in Salesforce with Rencore: detect, review by owner and severity, and remediate with an audit trail.
Governing External Access in Salesforce means finding where it goes wrong, reviewing the findings by owner and severity, and remediating with an audit trail. Rencore covers this concern for Salesforce with the pre-built controls below, so it becomes a repeatable check rather than a one-off cleanup. The steps that follow apply the same detect, review, remediate loop to External Access.
Steps
-
Inventory Salesforce
Connect Salesforce and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover External Access in Salesforce to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Salesforce reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Salesforce controls for External Access
Grounded in the Rencore catalog. See the full Salesforce catalog on the Salesforce connector page.
-
Salesforce external user is active and reachable
Active external users are externally-reachable identities and a more likely entry point for compromise
Severity: High -
Salesforce connected app is open to all users
Connected apps any user can authorize are externally-reachable integration points, raising the likelihood of exploitation
Severity: High -
Active Salesforce external users
Detects active external community, partner, portal or guest users for periodic access review
Severity: Medium -
Salesforce external users with permission set assignments
Detects active external users that hold one or more permission set assignments beyond their profile
Severity: High -
Salesforce connected apps not restricted to admin-approved users
Detects connected apps where the permitted-users policy is not 'admin pre-approved users only'
Severity: High -
Stale Salesforce OAuth tokens (180+ days unused)
Detects third-party OAuth tokens that have not been used in over 180 days
Severity: Medium -
Salesforce users by type
Shows the split of internal versus external user types
-
Salesforce connected apps by access policy
Shows connected apps split by whether they are restricted to admin-approved users
-
External Salesforce Users
Shows community, partner, portal and guest users
-
Open Salesforce Connected Apps
Shows connected apps not restricted to admin-approved users
