When to Use an Internal or External License

See the different Salesforce user types in action in the video, Internal, External, and Guest Users in Salesforce.

What Is an Internal User and Internal License?

An internal user logs in to Salesforce via login.salesforce.com or a company-specific My Domain login URL, like acme.my.salesforce.com, using an internal license. Internal users primarily access the Salesforce platform using Lightning Experience or Salesforce Classic. Internal users can also access Experience Cloud sites.

What Is an External User and External License?

Salesforce customers who want to create an experience connected to their CRM data for their end customers, prospects, partners, brokers, dealers, and other external stakeholders use external licenses to provide access. Some typical use cases are partner portals, self-service forums and help centers, customer portals, and broker and dealer portals. A user with an external license can access only the Experience Cloud sites that the user is a member of. An external user can’t access the internal Lightning Experience or Salesforce Classic.

For example, Acme Insurance is a Salesforce customer. Acme employees have internal licenses and log in to Salesforce. Acme created a broker portal for its partners with the URL partners.acme.com. When Acme brokers log in to partners.acme.com with an external license, they’re not aware that they’re using Salesforce. Instead, the Acme portal is a secure space just for Acme brokers, not for Acme employees.

When Do Salesforce Customers Use Internal Licenses?

Anyone who is an employee of a company or needs employee privileges requires an internal license. For example, Acme Insurance uses Salesforce as its CRM. The Acme sales and service teams, who are full-time employees, need an internal license to log in to Salesforce to do their day-to-day work.

Acme uses consultants to take care of the company’s Salesforce setup and administration. The consultants also need internal licenses, even though they aren’t Acme employees. Other users who need an internal license to the Acme org are the company’s accountants and lawyers, who also work for other companies, to access the company’s information. The key point is that you’re treating all these users as employees. Acme is granting the same privileges to employees and consultants and is fine with the broader data and permission access.

If your company is using a custom app to allow internal users to access CRM data, you can use the Salesforce Platform Login license, instead of buying a seat-based license. The Salesforce Platform Login license allows you to pay for internal user access by login.

When Do Customers Use External Licenses?

Use external licenses for anyone outside your company who you want to:

• Limit access to your data
• Restrict privacy or security and sharing considerations
• Provide a more limited set of permissions (for example, can’t manage other users in the org or have access to modify all data)
• Limit access to a subset of information that is contained in your org

For example, a broker could need access only to a subset of information in your org. Acme has an internal sales team, but it also has independent brokers who sell Acme products. The brokers must access leads and opportunities, but they don’t need to see the company’s internal Chatter feeds or cases.

Other examples of Acme users who could need external licenses are:

• End customers (that is, customers of Acme)
• System integrators
• Franchisees
• Resellers
• Distributors
• Wholesalers
• Retailers
• Agents
• Dealers
• Anyone in the Acme sphere who isn’t an employee

These Experience Cloud licenses are only to be used by external users. Don’t assign them to internal employees or contractors.

• External Apps
• External Apps Login
• Channel Account
• Customer Community
• Customer Community Login
• Customer Community Plus
• Customer Community Plus Login
• Partner Community
• Partner Community Login

Why Not Use Internal Licenses for External Use Cases?

Internal licenses provide broader access to your company data and information. The incorrect use of an internal license for an external use case can provide external users unwanted or inappropriate access to your data and records.

Internal license types are built with one use case in mind: a company employee or consultant that needs access to company data in the Salesforce org.

External license types are created for a multitude of use cases and include an added security level not available with internal licenses.

The best practice for any org is to use external licenses for external use cases, and internal licenses for internal use cases.