Ensure Einstein Activity Capture and Lightning Sync Guest Users Don't Have Access to Event Data in Salesforce Digital Experience Sites

Before making any data changes, you must find the Salesforce record IDs of all Guest Users configured in your Experience Cloud sites. You will use these IDs in the queries that follow.

1. In Setup, search for All Sites and click Builder for each configured Site.
2. Click Settings and find the Guest User Profile section, then click the profile name.
3. Click View Users to see the users assigned to that guest profile.
4. Select each guest user. If there is more than one, repeat this process for all guest users.
5. Note each user's record ID from the browser URL. To find the user ID from a URL, see How to Find a User Record ID in Salesforce (Article 000312782).

Step 2: Disable the Access Activities Permission for Guest Users

To prevent unauthenticated guest users from accessing events, disable the Access Activities permission on the Guest User profile.

1. Navigate to the Guest User profile as described in Step 1.
2. Edit the profile and locate the Access Activities permission.
3. Uncheck Access Activities and save.

For detailed instructions, see the Access Activities Permission documentation and Securing Guest User Access in Experience Cloud Sites.

Step 3: Remove Guest-Owned Standalone Events

If a guest user owns a standalone (non-recurring, non-child) calendar event, you must delete or reassign that event.
Use Data Loader or Workbench to query the Event object and filter by the OwnerId field. The OwnerId should match the Guest User record ID obtained in Step 1.
Run the following query for each guest user (replace [GuestUserRecordId] with the actual ID):
SOQL Query: SELECT Id FROM Event WHERE OwnerId = '[GuestUserRecordId]' AND IsChild = false
If the query returns records, those events are owned by the guest user. You can delete the returned records or update the OwnerId field to a non-guest user. If you have more than one guest user, run this query for each guest user ID.

Step 4: Remove Guest Users as Invitees on Non-Recurring Events

If a guest user appears as an invitee on a non-recurring calendar event or a past recurring calendar event, remove them from the event.
Use Data Loader or Workbench to query the EventRelation object, which stores event invitee relationships. Filter by the RelationId field using the Guest User record ID.
Run the following query for each guest user (replace [GuestUserRecordId] with the actual ID):
SOQL Query: SELECT Id FROM EventRelation WHERE RelationId = '[GuestUserRecordId]' AND (Event.IsRecurrence2 = false OR Event.StartDateTime < TOMORROW) AND Event.IsRecurrence2Exception = false
To remove single event invitations for guest users, either remove them directly from the organizer's event record in the Salesforce UI, or delete the EventRelation records returned by this query using the EventRelation API reference.

Step 5: Remove Guest Users from Recurring Event Series

For recurring event series and recurring exceptions in Lightning Experience, use the Salesforce UI to remove the guest user from each series, or use the API to update the invitee fields on the Event object.
The invitee fields on the Event object (in Lightning Experience) are:

• UndecidedEventInviteeIds
• AcceptedEventInviteeIds
• DeclinedEventInviteeIds

Option A — Find and edit via the UI:
Run the following query to identify recurring events that reference the guest user (replace [GuestUserRecordId] with the actual ID):
SOQL Query: SELECT Event.Id, Event.Subject, Event.AcceptedEventInviteeIds, Event.DeclinedEventInviteeIds, Event.UndecidedEventInviteeIds FROM EventRelation WHERE RelationId = '[GuestUserRecordId]' AND Event.IsRecurrence2 = true AND (Event.StartDateTime >= TODAY OR Event.IsRecurrence2Exception = true)
Use the returned Event.Id values to navigate to each event record in Salesforce and manually remove the Guest User from the Invitees list.
Option B — Remove via the API (JunctionIdList):
Use the JunctionIdList fields (AcceptedEventInviteeIds, DeclinedEventInviteeIds, or UndecidedEventInviteeIds) on the Event object to remove the Guest User. For example, if Event.AcceptedEventInviteeIds originally contains ['StandardUserRecordId', 'GuestUserRecordId'], update it to ['StandardUserRecordId'] to remove the guest user.

Step 6: Review Guest User Profile Best Practices

After completing the steps above, review the Guest User Profile Best Practices and Considerations to prevent guest users from gaining access to event data in the future.
If you encounter problems with any of the steps above, log a Salesforce Support Case with #GuestRem21 in the subject line.