# External org-wide defaults and object access

*Experience Cloud Consultant Study Guide · Sharing, Visibility, and Licensing · Last updated October 24, 2026 · https://www.certifyforce.com/study-guide/experience-cloud-consultant/sharing-visibility-and-licensing/external-org-wide-defaults-and-object-access*

How external users reach objects, records, fields and files: external org-wide defaults that can't exceed the internal ones, record access that follows the user into every site, object permissions and field-level security, the default access of high-volume users, file Customer Access, and record names in lookups.

- Certification: Salesforce Experience Cloud Consultant
- Exam section: Sharing, Visibility, and Licensing
- Study guide: https://www.certifyforce.com/study-guide/experience-cloud-consultant

**Official exam objective:**

> Given a scenario, set the correct object visibility in an Experience.

## What the exam expects

- Set an external org-wide default and explain why it can't be more permissive than the internal default.
- Predict where a shared record appears when an external user belongs to several sites.
- Diagnose a missing object, record, field or file by its access layer.
- State what high-volume users can reach with no sharing set, including Controlled by Parent detail records.
- Limit record names in lookup and system fields to users with access, with a permission-based exception.

Key terms:
- **External org-wide default**: the default record access for external authenticated users, set per object.
- **High-volume user**: a role-less external user (Customer Community, External Apps, High Volume Customer Portal, Authenticated Website licenses).
- **Controlled by Parent**: detail records take their access from the master record.
- **Customer Access**: the switch on a file that lets site users see it on a record.
- **View All Lookup Record Name**: permission to see names in lookup and system fields regardless of sharing.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| External vs internal default | External must be more restrictive than or equal to internal | [Set external OWDs](https://help.salesforce.com/s/articleView?id=platform.security_owd_external_setting.htm&language=en_US&type=5) |
| Controlled by Parent | Internal and external must match if either is Controlled by Parent | [Set external OWDs](https://help.salesforce.com/s/articleView?id=platform.security_owd_external_setting.htm&language=en_US&type=5) |
| Records across sites | Owned and shared records are visible in every site the user belongs to | [Who Can See What](https://help.salesforce.com/s/articleView?id=platform.networks_visibility.htm&language=en_US&type=5) |
| Hidden field on a shared record | Field-level security in profile or permission sets | [Control Who Sees What](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_data_access.htm&type=5) |
| High-volume default access | Own account (Read) and contact, Controlled by Parent children, Public objects | [High-volume users](https://help.salesforce.com/s/articleView?language=en_US&id=platform.networks_about_hvpu.htm&type=5) |
| High-volume exclusions | No groups, owner-based rules, teams or libraries | [High-volume users](https://help.salesforce.com/s/articleView?language=en_US&id=platform.networks_about_hvpu.htm&type=5) |
| Sharing set object list | Excludes Public Read/Write objects and custom objects without an account or contact lookup | [Create a sharing set](https://help.salesforce.com/s/articleView?id=platform.networks_setting_light_users.htm&language=en_US&type=5) |
| File on a record | Needs record access plus Customer Access | [File visibility](https://help.salesforce.com/s/articleView?id=sf.networks_files_visibility_and_sharing.htm&type=5&language=en_US) |
| Lookup names | Require permission to view record names, plus View All Lookup Record Name for exceptions | [Control user visibility](https://help.salesforce.com/s/articleView?language=en_US&id=sf.networks_community_user_visibility.htm&type=5) |
| Guest object permissions | Maximum Read where possible; never View All or Modify All | [Guest profile best practices](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5) |

## Check yourself

- Why can an object be Public Read Only internally and Private externally, but not the reverse?
- When can a high-volume user see a custom record with no sharing set?
- Which two conditions must hold for a customer to see a file posted to a record?
- How do you limit lookup record names to users with record access, while a few named users still see every name?

## Sources

- [External Organization-Wide Defaults Overview](https://help.salesforce.com/s/articleView?id=platform.security_owd_external.htm&language=en_US&type=5)
- [Set Your External Organization-Wide Sharing Defaults](https://help.salesforce.com/s/articleView?id=platform.security_owd_external_setting.htm&language=en_US&type=5)
- [Who Can See What in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=platform.networks_visibility.htm&language=en_US&type=5)
- [About High-Volume Community or Site Users](https://help.salesforce.com/s/articleView?language=en_US&id=platform.networks_about_hvpu.htm&type=5)
- [Control Who Sees What](https://help.salesforce.com/s/articleView?language=en_US&id=platform.security_data_access.htm&type=5)
- [File Visibility and Sharing in Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=sf.networks_files_visibility_and_sharing.htm&type=5&language=en_US)
- [Control User Visibility in Your Experience Cloud Site](https://help.salesforce.com/s/articleView?language=en_US&id=sf.networks_community_user_visibility.htm&type=5)
- [Best Practices and Considerations When Configuring the Guest User Profile](https://help.salesforce.com/s/articleView?id=platform.networks_guest_profile_best_practices.htm&language=en_US&type=5)
- [External User Access Best Practices](https://help.salesforce.com/s/articleView?id=platform.networks_access_best_practices.htm&language=en_US&type=5)
- [Create a Sharing Set for Experience Cloud Site Users](https://help.salesforce.com/s/articleView?id=platform.networks_setting_light_users.htm&language=en_US&type=5)
- [Object Relationships Overview](https://help.salesforce.com/s/articleView?id=platform.overview_of_custom_object_relationships.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Experience Cloud Consultant pack (USD $19): https://www.certifyforce.com/practice-exams