# Troubleshooting Omnistudio permissions and data access

*Omnistudio Developer Study Guide · Troubleshooting and Debugging · Last updated October 27, 2026 · https://www.certifyforce.com/study-guide/omnistudio-developer/troubleshooting-and-debugging/troubleshooting-omnistudio-permissions-and-data-access*

How to diagnose Omnistudio access failures from the symptom: Omniscript errors that really mean missing object, field or record access, unsecured cached Integration Procedures, Flexcard data source types hidden by Omni Interaction Access Configuration, guest users who get no records, and Data Mapper field-level security.

- Certification: Salesforce Omnistudio Developer
- Exam section: Troubleshooting and Debugging
- Study guide: https://www.certifyforce.com/study-guide/omnistudio-developer

**Official exam objective:**

> Resolve incorrect permissions and access issues.

## What the exam expects

- Read an Omniscript access error (including messages that ask for reactivation) as a permissions problem and check object, field and record access.
- Secure cached Data Mappers and Integration Procedures that rely on Sharing Settings with CheckCachedMetadataRecordSecurity.
- Find why a Flexcard data source type is missing for one profile or user in Omni Interaction Access Configuration.
- Fix guest users who see no records with criteria-based sharing rules, and enforce field-level security on one Data Mapper or on all of them.

Key terms:
- **Required Permission**: Data Mapper and Integration Procedure property that decides who can run it.
- **CheckCachedMetadataRecordSecurity**: setting that adds a record-level check to cached metadata.
- **Omni Interaction Access Configuration**: Setup records (Org_Wide, Profile or User) that turn Flexcard data source types on or off.
- **Check Field Level Security**: Data Mapper Options tab checkbox that enforces field-level security for that Data Mapper.
- **EnforceDMFLSAndDataEncryption**: Omni Interaction Configuration entry that enforces field-level security for all Data Mappers.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Reactivation message cause | Insufficient object, field or record access, or missing Omnistudio object permissions | [Activation and Access FAQ](https://help.salesforce.com/s/articleView?id=005232744&language=en_US&type=1) |
| forceGenerated module not found | Grant access to OmniProcess, OmniProcessElement, OmniProcessCompilation | [Activation and Access FAQ](https://help.salesforce.com/s/articleView?id=005232744&language=en_US&type=1) |
| Blank Required Permission | Any user can run it unless DefaultRequiredPermission is set | [Security for Data Mappers and IPs](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_56519.htm&language=en_US&type=5) |
| CheckCachedMetadataRecordSecurity default | False; true adds a record-level check for cached metadata | [Security Settings](https://help.salesforce.com/s/articleView?id=sf.os_dataraptor_and_integration_procedure_security_settings_56587.htm&language=en_US&type=5) |
| Standard user permission set | Clone Omnistudio User, check both System Permissions checkboxes, then set object access; the create-instances permission can stay off for read-only users | [Standard User Permission Set](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.os_create_an_omnistudio_standard_read_only_user_profile_6725_mp.htm&type=5) |
| Parent Integration Procedure | Can invoke children the user can't access directly | [Security for Data Mappers and IPs](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_56519.htm&language=en_US&type=5) |
| One Data Mapper FLS | Options tab, Check Field Level Security | [Security for Data Mappers and IPs](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_56519.htm&language=en_US&type=5) |
| All Data Mappers FLS | EnforceDMFLSAndDataEncryption set to true | [Security for Data Mappers and IPs](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_56519.htm&language=en_US&type=5) |
| Guest record access | None by default; criteria-based sharing rules grant read-only | [Security for Data Mappers and IPs](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_56519.htm&language=en_US&type=5) |
| Flexcard data source default | All types enabled org-wide | [Data Source Org Access](https://help.salesforce.com/s/articleView?id=xcloud.os_manage_flexcard_data_source_org_access_in_omnistudio_38656.htm&language=en_US&type=5) |
| Per-profile or per-user types | Access configuration record with Location Profile or User | [Data Source User and Profile Access](https://help.salesforce.com/s/articleView?id=xcloud.os_manage_flexcard_data_source_user_and_profile_access_in_omnistudio_38702.htm&language=en_US&type=5) |

## Check yourself

- Why should you check user access when an Omniscript asks to be deactivated and reactivated but admins run it fine?
- When must CheckCachedMetadataRecordSecurity be true?
- Why does a Data Mapper that reads records for you in Preview return none to a guest?
- When would you create an Omni Interaction Access Configuration record with Location Profile or User instead of editing Org_Wide?

## Sources

- [OmniScript Activation and Access Issues - FAQ](https://help.salesforce.com/s/articleView?id=005232744&language=en_US&type=1)
- [Security for Omnistudio Data Mappers and Integration Procedures](https://help.salesforce.com/s/articleView?id=xcloud.os_security_for_dataraptors_and_integration_procedures_56519.htm&language=en_US&type=5)
- [Omnistudio Data Mapper and Integration Procedure Security Settings](https://help.salesforce.com/s/articleView?id=sf.os_dataraptor_and_integration_procedure_security_settings_56587.htm&language=en_US&type=5)
- [Manage Flexcard Data Source User and Profile Access in Omnistudio](https://help.salesforce.com/s/articleView?id=xcloud.os_manage_flexcard_data_source_user_and_profile_access_in_omnistudio_38702.htm&language=en_US&type=5)
- [Manage Flexcard Data Source Org Access in Omnistudio](https://help.salesforce.com/s/articleView?id=xcloud.os_manage_flexcard_data_source_org_access_in_omnistudio_38656.htm&language=en_US&type=5)
- [Omnistudio Permission Sets](https://help.salesforce.com/s/articleView?id=xcloud.os_omnistudio_permission_sets_licenses_std.htm&language=en_US&type=5)
- [Create a Permission Set for an Omnistudio Standard User](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.os_create_an_omnistudio_standard_read_only_user_profile_6725_mp.htm&type=5)
- [Create a Permission Set for an Omnistudio Guest User](https://help.salesforce.com/s/articleView?id=xcloud.os_create_an_omnistudio_permission_set_for_digital_experience_guest_users_7532_std.htm&language=en_US&type=5)
- [Create a Permission Set for the Enhanced Runtime Performance Omnistudio Setting](https://help.salesforce.com/s/articleView?id=xcloud.os_perm_omniintaccessconfig_std.htm&language=en_US&type=5)
- [Omnistudio Settings](https://help.salesforce.com/s/articleView?id=xcloud.os_omnistudio_settings.htm&language=en_US&type=5)
- [Preview and Test an Omniscript](https://help.salesforce.com/s/articleView?id=sf.os_preview_an_omniscript_8849.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the Omnistudio Developer pack (USD $19): https://www.certifyforce.com/practice-exams