# Big objects, custom settings and external object access

*Platform Sharing and Visibility Architect Study Guide · Access to Other Data · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/access-to-other-data/big-objects-custom-settings-and-external-object-access*

Secure data that the sharing model doesn't reach: big objects (object and field permissions only), custom settings and custom metadata types (Schema Settings restrictions, protected visibility, where secrets belong), external objects (Salesforce Connect identity types) and Apex controllers that can expose data unless they set an explicit access mode.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Access to Other Data
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a scenario, determine the appropriate access control needed to grant access to data that is not standard or custom objects.

## What the exam expects

- Secure a custom big object with object and field permissions, knowing which sharing and automation features it lacks.
- Grant read access to one custom setting or one custom metadata type without Customize Application, and know what Restrict access does.
- Decide where secrets belong: protected settings or metadata in a managed package, otherwise named credentials or encrypted fields.
- Choose the Salesforce Connect identity type that makes the external system enforce each user's own entitlements.
- Recognise Apex controllers that can expose data, and the explicit access modes that close the gap.

Key terms: **big object** (horizontally scalable store for billions of rows); **Restrict access to custom settings** (Schema Settings preference requiring explicit Read grants); **protected visibility** (readable only by its managed package's code); **identity type** (whose credentials reach the external system); **access mode** (user or system enforcement of permissions on a database operation).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Big object security | Object and field permissions only; no sharing rules | [Big Objects](https://developer.salesforce.com/docs/platform/big-object-impl-guide/guide/big-object.html) |
| New big object access | Restricted until permission set or profile grants it | [Define and Deploy](https://developer.salesforce.com/docs/atlas.en-us.bigobjects.meta/bigobjects/big_object_define.htm) |
| Big object UI | Custom Lightning and Visualforce components only | [Big Objects Best Practices](https://developer.salesforce.com/docs/platform/big-object-impl-guide/guide/big-object-considerations.html) |
| Big object APIs | SOQL, Bulk, Chatter, SOAP; not REST | [Big Objects](https://developer.salesforce.com/docs/platform/big-object-impl-guide/guide/big-object.html) |
| Restrict access to custom settings | On by default; grant Read explicitly | [Custom Settings Protection](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.cs_schema_settings.htm) |
| One custom setting | Custom Setting Definitions permission | [Custom Settings Protection](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.cs_schema_settings.htm) |
| All custom settings | View All Custom Settings | [Read Access to All Custom Settings](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.cs_grant_all_permissions.htm) |
| Protected in unmanaged package | Behaves like public | [Custom Settings Protection](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.cs_schema_settings.htm) |
| One custom metadata type | Enabled Custom Metadata Types list | [Read Access to Custom Metadata Types](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.custommetadatatypes_permissions.htm) |
| Per-user identity | Queries use the current user's credentials | [IdentityType Enum](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_enum_DataSource_IdentityType.htm) |
| Apex default mode | User mode from API 67.0; system mode in 66.0 and earlier | [Release Note: User Mode by Default](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&release=262&type=5) |

## Check yourself

- Why can't an admin hide individual big object rows with sharing?
- When does a user without access to a custom setting see blank values?
- Why does a protected custom setting fail to hide a token in an unmanaged package?
- Which credentials does a per-user external data source use for schema sync?

## Sources

- [Big Objects](https://developer.salesforce.com/docs/platform/big-object-impl-guide/guide/big-object.html)
- [Big Objects Best Practices](https://developer.salesforce.com/docs/platform/big-object-impl-guide/guide/big-object-considerations.html)
- [Define and Deploy Custom Big Objects](https://developer.salesforce.com/docs/atlas.en-us.bigobjects.meta/bigobjects/big_object_define.htm)
- [Protection and Privacy Options for Custom Settings](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.cs_schema_settings.htm)
- [Grant Read Access to All Custom Settings](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.cs_grant_all_permissions.htm)
- [Control Read Access to Custom Metadata Types](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.custommetadatatypes_permissions.htm)
- [IdentityType Enum](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_enum_DataSource_IdentityType.htm)
- [Work with External Data Sources](https://help.salesforce.com/s/articleView?language=en_US&type=5&id=sf.external_data_sources.htm)
- [Grant Access to Authentication Settings for External Data Sources](https://help.salesforce.com/s/articleView?id=sf.external_permsets_profiles.htm&language=en_US&type=5)
- [Database Operations Run in User Mode by Default, Not System Mode](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_default_user_mode.htm&release=262&type=5)
- [Secure Apex Classes](https://developer.salesforce.com/docs/platform/lwc/guide/apex-security.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams