You are here:
Who Has Access to Account Records?
Different sharing mechanisms can grant a user access to an account.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
| Available in: Professional, Enterprise, Performance, Unlimited, and Developer editions |
A user can have access to an account from:
- Record ownership
- Implicit access from an associated child record such as a case, contact, or opportunity
- Organization-wide sharing defaults
- Role hierarchy
- Sharing rules
- Manual sharing
- Account team or territory
To find out why a user has access to the record, in Lightning Experience, click Sharing Hierarchy from the Action Menu on the account record. Click View next to the user’s name. In Salesforce Classic, click Sharing on the account detail page, then click Expand List to see all users who have access. Click Why? next to the user’s name.
These users don't show up in the list even if they have access.
- All users, if the organization-wide defaults are set to Public Read Only or Public Read/Write
- High-volume Experience Cloud site users
If the Sharing Hierarchy or Sharing buttons don’t appear, the organization-wide sharing defaults are likely set to Controlled by Parent or Public Read. Otherwise, only the record owner, an administrator, or a user above the owner in the role hierarchy can see the Sharing Detail page.
| Access Type | Description |
|---|---|
| Record owner | Record owners always get access to their own records. |
| Implicit access | Corresponds to the “Associated record owner or sharing” entry in the Reason column of the Sharing Detail page. The user has access to a child record of an account (opportunity, case, or contact), which grants them Read access on that account. You can’t overwrite this access. For example, if the user has access to a case record, he or she has implicit Read access to the parent account record. |
| Organization-wide sharing default | Check if the defaults for the account object are set to Private. If it is, the user has gained access via other methods listed here. It must be set to Private if at least one of your users must not see a record. |
| Role hierarchy | The user inherited Read access from a subordinate in the role hierarchy. You can't override this behavior for non-custom objects. If the user who has access is on a different branch of the hierarchy from the account owner, check the sharing rules, account teams, and account territory. |
| Sharing rules | The user received access because he or she has been included in a relevant sharing rule. If the sharing rule uses public groups (or other categories such as roles) to grant access, check your public groups to see if the user has been included in the group. |
| Manual shares | The user received access through the Sharing button of the record. Only the record owner, an administrator, or a user above the owner in the role hierarchy can create or remove a manual share on the record. |
| Account Teams and Territory | The user has been added to an Account Team by the account owner, an administrator, a user above the owner in the role hierarchy, or an account team member. If your organization uses territory management, check if the user who has access is higher in the territory hierarchy than the account owner. Managers gain the same access as their subordinates. Additionally, if the user is a member of Group A, which is a member of Group B, he or she gets access to all accounts shared to Group B, at the same level of access as members of Group B. |
- See Account Access from Manual Shares or Account Teams with Reports
See the account records that are shared manually or through account teams in your Salesforce org and which users or groups have access to them. Before building reports, create a custom report type on the Account Share object, which represents sharing entries on an account.
