Salesforce identity governance: are your controls keeping up?

TL;DR: Salesforce access often expands through profiles, permission sets, sharing rules, and connected apps in ways that IGA tools miss, leaving hidden object-level access and NHI permissions outside periodic reviews, according to Oleria Security research. The real control problem is effective access, not assigned roles, because governance breaks when permissions accumulate faster than certification cycles can see them.

Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity security & governance for Salesforce”.

Key questions

Q: What breaks when Salesforce access is built mainly on profiles?

A: Profiles become overloaded with exceptions, which makes least privilege hard to maintain and even harder to audit.

Q: Why do connected apps and integration users need separate governance from human users?

A: Because they carry their own credentials, scopes, and API rights.

Q: What are the signs that Salesforce access controls are getting out of control?

A: A common warning sign is a mature org where profiles have been cloned and modified repeatedly, leaving old permissions in place and unused profiles behind.

Practitioner guidance

• Audit effective Salesforce permissions, not just profiles Reconstruct read, edit, and delete rights from profiles, permission sets, permission set groups, role hierarchies, and sharing rules before recertifying access.
• Separate NHI governance from employee access review Track connected apps, integration users, and OAuth credentials as discrete identities with their own owners, scopes, and offboarding events.
• Flag dormant integration users and unused privilege Compare granted Salesforce rights with recent audit activity to identify service accounts and humans whose access exceeds current operational use.

Bottom line: Salesforce access can look compliant at the profile level while still exposing sensitive objects through inherited permissions and sharing rules.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →