Sharing, Visibility, and Licensing17% of the exam
External org-wide defaults and object access
How external users reach objects, records, fields and files: external org-wide defaults that can't exceed the internal ones, record access that follows the user into every site, object permissions and field-level security, the default access of high-volume users, file Customer Access, and record names in lookups.
Given a scenario, set the correct object visibility in an Experience.
~8 min read · 8 practice questions ·
What the exam expects
- Set an external org-wide default and explain why it can't be more permissive than the internal default.
- Predict where a shared record appears when an external user belongs to several sites.
- Diagnose a missing object, record, field or file by its access layer.
- State what high-volume users can reach with no sharing set, including Controlled by Parent detail records.
- Limit record names in lookup and system fields to users with access, with a permission-based exception.
Key terms:
- External org-wide default: the default record access for external authenticated users, set per object.
- High-volume user: a role-less external user (Customer Community, External Apps, High Volume Customer Portal, Authenticated Website licenses).
- Controlled by Parent: detail records take their access from the master record.
- Customer Access: the switch on a file that lets site users see it on a record.
- View All Lookup Record Name: permission to see names in lookup and system fields regardless of sharing.
Key facts
External vs internal default
- Detail
- External must be more restrictive than or equal to internal
Controlled by Parent
- Detail
- Internal and external must match if either is Controlled by Parent
Records across sites
- Detail
- Owned and shared records are visible in every site the user belongs to
Hidden field on a shared record
- Detail
- Field-level security in profile or permission sets
High-volume default access
- Detail
- Own account (Read) and contact, Controlled by Parent children, Public objects
High-volume exclusions
- Detail
- No groups, owner-based rules, teams or libraries
Sharing set object list
- Detail
- Excludes Public Read/Write objects and custom objects without an account or contact lookup
File on a record
- Detail
- Needs record access plus Customer Access
Lookup names
- Detail
- Require permission to view record names, plus View All Lookup Record Name for exceptions
Guest object permissions
- Detail
- Maximum Read where possible; never View All or Modify All
Sources for this section (8)
- Set external OWDshelp.salesforce.com (opens in a new tab)
- Who Can See Whathelp.salesforce.com (opens in a new tab)
- Control Who Sees Whathelp.salesforce.com (opens in a new tab)
- High-volume usershelp.salesforce.com (opens in a new tab)
- Create a sharing sethelp.salesforce.com (opens in a new tab)
- File visibilityhelp.salesforce.com (opens in a new tab)
- Control user visibilityhelp.salesforce.com (opens in a new tab)
- Guest profile best practiceshelp.salesforce.com (opens in a new tab)
- Why can an object be Public Read Only internally and Private externally, but not the reverse?
- When can a high-volume user see a custom record with no sharing set?
- Which two conditions must hold for a customer to see a file posted to a record?
- How do you limit lookup record names to users with record access, while a few named users still see every name?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Experience Cloud Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 37 lessons of the Experience Cloud Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams