FAQs: Prepare for the Enforcement of the 'Restrict User Access to Run Flow' Salesforce Release Update

To help admins understand the impact of and prepare for Salesforce enforcing the Restrict User Access to Run Flows release update, here’s a list of FAQs. We plan to use this knowledge article to communicate additional information in the future, so bookmark and check it periodically.

• What's the change?

Previously, Salesforce communicated the enforcement of Restrict User Access to Run Flows release update in Winter '25. However, the enforcement was rescheduled to Winter '26 to allow customers additional time to prepare.

• What’s the impact of this enforcement?

The FlowSites org perm is deprecated. A user’s ability to run a flow is restricted unless the correct profile or permission set to run the flow is granted.

• What’s the impact if I don’t take any action?

 The impacted users won’t have access to run Flows. 

• How do I know if I am impacted?

Starting in February 2024, Salesforce sent Product + Services emails to impacted customers listing the impacted Flow Definition IDs. If you didn't receive any of those emails, you're most likely not impacted.

• Why did the Product + Services emails have duplicate Flow Definition IDs listed?

The email incorrectly omitted the Flow Version ID. 

As Flow Definition is the parent of Flow Version, a single Flow Definition ID could have multiple impacted Flow Version IDs. In these cases, the email listed the Flow Definition ID multiple times.

• Will Salesforce provide the impacted Flow Version ID?

Yes. Salesforce is scheduled to send a correction email and include the Flow Version IDs and Process Types of impacted Flows by July 1, 2024.

• What logic was used to determine the list of impacted Flow Definition IDs listed in the emails?

We identified flows that had at least 1 user running a flow AND the user didn't have at least:

‘Run Flow’ or 'Manage Flow' user perm in profile/perm set

Explicit Sharing through granular control

‘Flow User’ in user pref. 

• How do I identify my impacted Flows by using the provided Flow Definition ID or Version ID? 

From your browser, enter:

Salesforce Classic: https://<domainname>/<Flow Def Id> 

Salesforce Lightning: https://<domainname>/builder_platform_interaction/flowBuilder.app?flowId=<Flow Version Id> 

Other options: How to find a Flow or Process Builder based on its ID?

• What action should I take?

After you enable the Restrict User Access to Run Flows release update, all users must be granted access to run a flow.

Add the Manage Flow or the Run Flows permission to a profile or permission set. For more granular control, restrict specific flow access to an available profile.

If a flow isn’t available to a user or a flow fails, identify the missing permissions and add them to your user’s profile.

• Is the Automated Process User impacted?

No. The Automated Process User should have access to run flows after the enforcement of this change.

• Does Salesforce recommend testing the subflows?

No.  As subflow access is based on the parent flow, the parent flow overrides access rules for subflows.

• What about Guest Users? 

If Guest users should continue to have access to the Flow, admins must enable the Flow to use granular control and grant access to the Guest User profile associated with the community.

•  What about other Users?

Guest, Customer Community, and Portal profiles will no longer be able to run a flow via the FlowSite permission.

• What Flow Types are impacted by the enforcement of the Restrict User Access to Run Flows release update?

• What if I didn't receive the Product and Service Notification emails?

If you didn't get an email from Salesforce listing your impacted flow definition IDs, then this release update doesn’t impact your flows. 

• What are Release Updates?

Salesforce provides Release Updates that improve the security, performance, and usability of our products. From Setup, in the Quick Find box, enter Release Updates to view release updates, which impact your org.

• Can Release Updates affect existing customizations?

Yes.

• Who is the audience for Product + Services Notifications?

We define an admin as any user with a profile, permission set, or permission set group that has the following permissions enabled below:

Manage Users

Modify All Data

• When is Salesforce scheduled to enforce the Restrict User Access release update?

Winter '26

• Where can I ask questions?

Our product teams continue to address questions in the Release Readiness Trailblazer group. 

• Where can I get more information?

Salesforce Help:  Limit User Access to Execute Flows 

Your Guide to Determining the Flow Running User and Its Execution Context

Restrict User Access to Run Flows release note.