Loading
Salesforce Enforces New Security Requirements in Summer 2026Read More

Salesforce NPSP: "Insufficient permissions: secure query included inaccessible field" during Gift Entry batch

Publish Date: Jul 15, 2026
Description

When you enter donations or run a batch update in the Nonprofit Success Pack (NPSP), you may encounter the following error: "Insufficient permissions: secure query included inaccessible field."

 

This notification persists even if you are a full System Administrator. Customers often note that they appear to have all necessary permissions, making it difficult to determine which specific permission is causing the issue.

 

The root cause of this error is that a field referenced by the Gift Entry Field Mapping (or a Data Import query) is not readable by the running user's profile or permission set. Instead of indicating a missing system permission, the Salesforce platform blocks the secured query. This affects any user who lacks Read access on one or more mapped source or target fields on the Account, Contact, Opportunity, or DataImport__c objects.

 

This issue commonly occurs when:

  • A field is hidden by field-level security (FLS).

  • A mapped field was deleted or renamed.

Resolution

To resolve this issue, you must grant Read access to every field referenced by your Gift Entry Field Mapping and confirm no mapped fields are missing.

Note: Setting a profile to "fully visible" at the object level does not add Read access on individual fields hidden by FLS. Furthermore, the "Modify All Data" system permission does not override a secured-query FLS block. You must add Read access to the specific inaccessible field.

Cause 1: Missing Read Field-Level Security on a Mapped Field

  1. Go to Setup > Custom Metadata Types > Data Import Field Mapping (Data_Import_Field_Mapping__mdt) > Manage Records.

  2. Open the Gift Entry template you use (Navigate to Setup > NPSP Settings > System Tools > Advanced Mapping, or use the Gift Entry Templates tab).

  3. For each row, note the Source Field API name on DataImport__c and the Target Field API name on Account, Contact, Opportunity, or Payment.

  4. Go to Setup > Object Manager > select the target object > Fields & Relationships > open each mapped field > click Set Field-Level Security.

  5. For the running user's profile, select the Visible checkbox (ensure it is not set to Read-Only-hidden) so the field is readable.

  6. If you use permission sets, go to Setup > Permission Sets > select the assigned set > Object Settings > select the object > click Edit, and set Field Permissions Read to checked for each mapped field.

Cause 2: Mapped Field is Deleted, Renamed, or Hidden

  1. In the Advanced Mapping list, compare each Target Field API name against Setup > Object Manager > [object] > Fields & Relationships.

  2. If a mapped field no longer exists, open the mapping record and either point it to a valid field or set its Is Deleted value and remove the row.

  3. Save the mapping, then reopen the Gift Entry template and confirm every column resolves to an existing, readable field.

Cause 3: Source Field is Not Readable

  1. Go to Setup > Object Manager > NPSP Data Import (DataImport__c) > Fields & Relationships.

  2. For each source field used in your mapping, open it and click Set Field-Level Security.

  3. Set Visible to checked for the running user's profile and permission set.

Knowledge Article Number

005389018

 
Loading
Salesforce Help | Article