You are here:
Controlling External User Access in Data 360
Use data governance policies to control what external users can access in your Data 360-powered apps. By defining clear, policy-based access, you make sure that unidentified external users and authenticated external users see only the data intended for them.
Required Editions
Data 360 supports these user types with different levels of trust and access. Internal users have the highest level of trust, while unidentified external users have the lowest.
- Unidentified External User: An unauthenticated user who accesses a Data 360-powered application without signing in. These users don't require Data 360 user permissions. Policies for unidentified external users govern access.
- Authenticated External User: An authenticated user, such as a customer or partner, who accesses Salesforce through an external-facing application. These users don't require Data 360 user permissions. Policies for authenticated external users govern access.
- Internal User: An authenticated user in your Salesforce organization, such as an employee or contractor. Assigned permissions, data space access, and applicable governance policies govern access to Data 360 data. External-user access policies don't govern internal users.
| User Permissions Needed | |
|---|---|
| To create data access policies for external users: | Permission set:
|
Many apps powered by Data 360 involve external users, such as customers or partners. To prevent accidental exposure of sensitive information, Data 360 includes built-in guardrails that restrict access by default.
Data 360 denies external users access to all data unless you explicitly grant access through classification and policies. Classification determines whether an object is eligible for external access, and policies determine who can access it.
- Unidentified external users: Data 360 denies access to all objects unless you
classify the object as public by applying the standard
ExternalData.Visibility.Publictag. - Authenticated external users: Data 360 denies access to all objects unless you
classify the object as portal or public by applying the standard
ExternalData.Visibility.PortalorExternalData.Visibility.Publictags. - Internal users: Data 360 allows access based on internal policies and classifications, without requiring external visibility tags.
Granting access to external users requires classification, policy creation, and for authenticated external users, data space access through permission sets. For more information, see Data Tagging and Classification in Data 360 and Create an Object or Field-Level Access Policy in Data 360.
Policy Authorization Levels
Policies include an authorization level that defines the user type: Internal, Authenticated External, or Unidentified External. Set this level when you create the policy. This selection adds uneditable default conditions in the policy based on the selected authorization level. You can't change the authorization level after saving the policy.
Policies follow a cascading logic based on the user’s authorization level.
- Allow policies cascade up: If you grant access to an unidentified external user, authenticated external and internal users also receive that access.
- Deny policies cascade down: If you deny access to an internal user, this also applies to authenticated and unidentified external users.
All existing policies automatically apply only to internal users.
Object Classification and Visibility
Classify the target object before you create an Allow policy to grant access to an external
user. Only objects you classify as Data Categorization.Access Level.Portal
or Data Categorization.Access Level.Public are eligible for external
access. This process makes sure that you only expose data explicitly marked for external
use.
| Object Access | Preconfigured Tag | Classification |
|---|---|---|
| Unidentified and Authenticated External Users | ExternalData.Visibility.Public |
Data Categorization.Access Level.Public: The most permissive
level. |
| Authenticated External Users only | ExternalData.Visibility.Portal |
Data Categorization.Access Level.Portal: Restricted to
authenticated external users. |
Safeguards and Governance Considerations for External Access
Review these considerations before you configure external access.
- Automatic guardrails: When you create an object-level Allow policy for external
users, the system automatically adds default conditions.
- In the resource section, a condition requires you to classify the objects as
Data Categorization.Access Level.PortalorData Categorization.Access Level.Public. - In the principal section, a condition requires you to grant access only to the selected authorization level, such as unidentified external users or authenticated external users. This condition prevents a broad Allow policy from accidentally exposing internal data or granting access to unintended user types.
- In the resource section, a condition requires you to classify the objects as
- Security access controls: Create object-level security (OLS), field-level security (FLS), or row-level security (RLS) policies for objects shared with authenticated external users to ensure that users can access only the data intended for them.
- Legacy policy protection: To maintain security, Data 360 automatically restricts all policies created before the introduction of authorization levels to internal users.
- Permission set and data space assignment: Don't assign the Data 360 User permission set or explicit data space assignment to authenticated external users or unidentified external users. The Data 360 User permission set is for internal Salesforce users only. External users gain access to Data 360 data exclusively through DMO/DLO object tagging and explicit data governance Allow policies.
Unidentified External User Access Through AI Agents
Unidentified external user policies don’t apply when the user interacts with an AI agent running with Agent Service Account (ASA) with internal org-wide default access. Because these agents run queries in the context of an internal integration user, internal user policies apply instead.
To provide secure access in this scenario:
- Use an internal user policy restricted by a custom permission.
- Assign it only to the agent’s integration user.
- Limit access to public objects.
Digital Agent External User
Starting in Summer ‘26, you can select Digital Agent External User in the Agent Creator. When selected, this maps to an unauthenticated Unidentified External User in Data 360.
To provide secure access:
- Tag public objects with the preconfigured
ExternalData.Visibility.Publictag. - Use an Unidentified External User policy restricted by a custom permission.
- Troubleshoot External User Access Errors
Resolve common issues with authenticated external user and unidentified external user access to Data 360.
