When a Salesforce administrator, Salesforce Support agent, or Salesforce Partner logs in as another user using the Enable Log In as Another User feature, attempts to download documents, files, or attachments result in an "Insufficient Privileges" error.
This is expected behavior. Salesforce enforces a security restriction that prevents file downloads during user impersonation sessions to protect organization data integrity and prevent unauthorized data exfiltration.
This security restriction is intentional and applies globally to all user impersonation scenarios in Salesforce. It cannot be bypassed or configured away, and this behavior is by design.
Who is affected?
This restriction applies to all of the following user types when logged in as another user:
What happens?
When any of these users attempt to download files or content while logged in as another user, they receive the following message:
Insufficient Privileges You do not have the level of access necessary to perform the operation you requested. Please contact the owner of the record or your administrator if access is necessary. For more information, see Insufficient Privileges Errors.
Why does this restriction exist?
This security measure ensures that sensitive files cannot be downloaded or exfiltrated through impersonation sessions, protecting both the organization's data and user privacy.
000387758

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.