4/24/2019 Who Has Access to Account Records?

Who Has Access to Account Records?

A user may have access to an account from:

Record Ownership
Implicit access from an associated child record such as a case, contact, or opportunity
Organization-wide sharing defaults
Role hierarchy
Sharing rules
Manual sharing
Account team or territory

To find out why a user have access to the record, click the Sharing button on the account detail page to
see a list of users who have access and for which reasons. Click Expand List to see all users who have
access.

The following users don’t show up in the list even if they may have access:

All users, if the organization-wide defaults are set to Public Read Only or Public Read/Write
High-volume portal users

NOTE
If the Sharing button does not appear, the organization-wide sharing defaults may have been set to
Controlled by Parent or Public Read. Otherwise, only the record owner, an administrator, or a user
above the owner in the role hierarchy can see the Sharing Detail page.

Troubleshooting guideline for user access to a record

ACCESS TYPE
Record owner

DESCRIPTION
The record owner always gets access to his or her own record.

ACCESS TYPE
Implicit access

DESCRIPTION
Corresponds to the “Associated record owner or sharing” entry in the Reason column of the
Sharing Detail page. The user may have access to a child record of an account (opportunity, case,
or contact), which grants them Read access on that account. You cannot overwrite this access. For
example, if the user has access to a case record, he or she has implicit Read access to the parent
account record.

https://help.salesforce.com/articleView?id=faq_record_access.htm&type=5 1/3
4/24/2019 Who Has Access to Account Records?

ACCESS TYPE
Organization-wide sharing default

DESCRIPTION
Check if the defaults for the account object are set to Private. If it is, the user may have gained
access via other methods listed here. It must be set to Private if at least one of your users should
not see a record.

ACCESS TYPE
Role hierarchy

DESCRIPTION
The user may have inherited Read access from a subordinate in the role hierarchy. You can’t
override this behavior for non-custom objects. If the user who has access is on a different branch
of the hierarchy from the account owner, check the sharing rules, account teams, and account
territory.

ACCESS TYPE
Sharing rules

DESCRIPTION
The user may have gotten access because he or she has been included in a relevant sharing rule. If
the sharing rule uses public groups (or other categories such as roles) to grant access, check your
public groups to see if the user has been included in the group.

ACCESS TYPE
Manual shares

DESCRIPTION
The user may have gotten access through the Sharing button of the record. Only the record owner,
an administrator, or a user above the owner in the role hierarchy can create or remove a manual
share on the record.

ACCESS TYPE
Account Teams and Territory

DESCRIPTION
The user may have been added to an Account Team by the account owner, an administrator, a user
above the owner in the role hierarchy, or an account team member. If your organization uses
territory management, check if the user who has access is higher in the territory hierarchy than the
account owner. Managers gain the same access as their subordinates. Additionally, if the user is a
member of Group A, which is a member of Group B, he or she gets access to all accounts shared to
Group B, at the same level of access as members of Group B.

SEE ALSO

Control Who Sees What (articleView?id=security_data_access.htm&type=5)

Resolving Insufficient Privileges Errors (articleView?
id=admin_insufficient_privileges_map.htm&type=5)

https://help.salesforce.com/articleView?id=faq_record_access.htm&type=5 2/3
4/24/2019 Who Has Access to Account Records?

https://help.salesforce.com/articleView?id=faq_record_access.htm&type=5 3/3