FAQs: Prepare for the Enforcement of the 'Restrict User Access to Run Flow' Salesforce Release Update

This article answers frequently asked questions about the Restrict User Access to Run Flows release update - what it changes, who is impacted, how to prepare, and where to get help.

About This Release Update 

What's the change?

Previously, Salesforce communicated the enforcement of the Restrict User Access to Run Flows release update in Winter '25. However, the enforcement was rescheduled to Winter '26 to allow customers additional time to prepare.

What's the impact of this enforcement?

The FlowSites org permission is deprecated. A user's ability to run a flow is restricted unless the correct profile or permission set to run the flow is granted.

What Flow Types are impacted by the enforcement?

The table below lists which flow types are impacted by this release update and which are unaffected.

Am I Impacted? 

What's the impact if I don't take any action?

Impacted users won't have access to run flows.

How do I know if I am impacted?

Starting in February 2024, Salesforce sent Product + Services emails to impacted customers listing the impacted Flow Definition IDs. If you didn't receive any of those emails, you're most likely not impacted.

What if I didn't receive the Product and Service Notification emails?

If you didn't get an email from Salesforce listing your impacted flow definition IDs, then this release update doesn't impact your flows.

Why did the Product + Services emails have duplicate Flow Definition IDs listed?

The email incorrectly omitted the Flow Version ID. As Flow Definition is the parent of Flow Version, a single Flow Definition ID could have multiple impacted Flow Version IDs. In these cases, the email listed the Flow Definition ID multiple times.

Will Salesforce provide the impacted Flow Version ID?

Yes, Salesforce is scheduled to send a correction email that includes the Flow Version IDs and Process Types of impacted flows by July 1, 2024.

What logic was used to determine the list of impacted Flow Definition IDs listed in the emails?

We identified flows that had at least one user running a flow, and that user didn't have at least one of the following:

• 'Run Flow' or 'Manage Flow' user permission in profile/permission set
• Explicit sharing through granular control
• 'Flow User' in user preferences

How do I identify my impacted flows using the provided Flow Definition ID or Version ID?

From your browser, enter:

• Salesforce Classic: `https://<domainname>/<Flow Def Id>`
• Salesforce Lightning: `https://<domainname>/builder_platform_interaction/flowBuilder.app?flowId=<Flow Version Id>`

Other options: How to find a Flow or Process Builder based on its ID?

What Should I Do?

What action should I take?

After you enable the Restrict User Access to Run Flows release update, all users must be granted access to run a flow. Add the Manage Flow or the Run Flows permission to a profile or permission set. For more granular control, restrict specific flow access to an available profile. If a flow isn't available to a user or a flow fails, identify the missing permissions and add them to your user's profile.

Is the Automated Process User impacted?

No, the Automated Process User should have access to run flows after the enforcement of this change.

Does Salesforce recommend testing the subflows?

No. As subflow access is based on the parent flow, the parent flow overrides access rules for subflows.

What about Guest Users?

If Guest users should continue to have access to the flow, admins must enable the flow to use granular control and grant access to the Guest User profile associated with the community.

What about other users?

Guest, Customer Community, and Portal profiles will no longer be able to run a flow via the FlowSite permission.

When is Salesforce scheduled to enforce the Restrict User Access release update?

Salesforce is scheduled to enforce the Restrict User Access to Run Flows release update in Winter '26.

General Release Update Information 

What are Release Updates?

Salesforce provides Release Updates that improve the security, performance, and usability of our products. From Setup, in the Quick Find box, enter Release Updates to view release updates that impact your org.

Can Release Updates affect existing customizations?

Yes, Release Updates can affect existing customizations.

Who is the audience for Product + Services Notifications?

We define an admin as any user with a profile, permission set, or permission set group that has one of the following permissions enabled:

• Manage Users
• Modify All Data

Where can I ask questions?

Our product teams continue to address questions in the Release Readiness Trailblazer group.

Where can I get more information?

See Salesforce Help: Limit User Access to Execute Flows, Your Guide to Determining the Flow Running User and Its Execution Context, and the Restrict User Access to Run Flows release note.