DE Try For Free
Content Hub

Salesforce

Rencore monitors Salesforce across 22 governance policies, 7 reports, and 13 inventories, detecting over-privileged permission sets, unrestricted connected apps, stale OAuth tokens, and underused licenses automatically.

Published For IT Admin, Head of IT, CISO
Digital Workplace
Book a demo Start free trial
Definition

Rencore Salesforce governance is a set of 22 policies, 7 reports, and 13 inventories that continuously audit Salesforce for over-privileged access, unrestricted connected apps, stale OAuth tokens, and unused licenses. It detects permission sets that grant Modify All Data, connected apps open to all users, users inactive for 180 days who still hold assignments, and license pools below their utilization thresholds.

See Salesforce in Rencore

Step 1 of 3

57 governance capabilities: 13 inventories · 22 policies · 7 reports · 8 segments · 5 automations

Why govern Salesforce with Rencore

Control privileged access

Detect permission sets and profiles that grant Modify All Data, orgs with too many System Administrators, and inactive users who still hold permission set assignments. Flag permission sets without a description so privilege stays documented.

Govern connected apps and OAuth

Find connected apps open to all users, apps not restricted to admin-approved users, OAuth tokens unused for 180 days, and connected apps not modified in over a year. Prioritize by reach and access scope.

Manage user and external lifecycle

Identify users not logged in for 180 days, active external users, and external users with permission set assignments. Track failed login attempts to spot accounts under pressure.

Recover unused licenses

Flag user license pools below 60% utilization, permission set license pools below 50%, and unused permission sets so license spend matches real usage.

What Rencore discovers

Rencore automatically inventories these Salesforce object types.

Salesforce Org
Salesforce orgs that are configured to be scanned
Salesforce User
Users with access to the Salesforce org
Salesforce Profile
Profiles defining baseline permissions in the Salesforce org
Salesforce Permission Set
Permission sets that layer additional permissions onto users
Salesforce Permission Set Group
Permission set groups bundling multiple permission sets
Salesforce Connected App
Connected apps integrated with the Salesforce org
Salesforce inventory card in Rencore

How Salesforce governance works in Rencore

Rencore connects to Salesforce and inventories orgs, users, profiles, permission sets, permission set groups, connected apps, OAuth tokens, login history, roles, and license assignments. Policies evaluate each object on every scan cycle and flag violations with severity and a recommended action.

The multi-platform access governance challenge

Salesforce holds customer data and runs outside Microsoft 365, so its privileged access and connected-app risks are invisible to Microsoft Purview and Entra ID reviews. Rencore brings Salesforce access governance into the same dashboard as your Microsoft 365 governance, applying consistent privilege and lifecycle checks across both platforms.

Who uses Salesforce governance

IT administrators use it to keep permission sets and connected apps clean. CISOs rely on the privileged-access and OAuth policies to limit data exposure. Heads of IT use the license reports to right-size Salesforce spend against actual usage.

Getting started

Provide Rencore with Salesforce API access. All 22 policies activate on the first scan, covering users, profiles, permission sets, connected apps, and OAuth tokens. Reports and segments populate as soon as the first inventory completes.

Policies

22 governance rules that detect violations and risks.

Salesforce policies card in Rencore
Salesforce external user is active and reachable
Active external users are externally-reachable identities and a more likely entry point for compromise
High External Access
Salesforce System Administrator is active
Active System Administrators are full-access, high-value targets, raising the likelihood that weaknesses are exploited
High Security
Salesforce connected app is open to all users
Connected apps any user can authorize are externally-reachable integration points, raising the likelihood of exploitation
High External Access
Salesforce permission set grants Modify All Data
Permission sets that grant Modify All Data have org-wide blast radius, raising the likelihood of exploitation
High Security
Salesforce external users with permission set assignments
Detects active external users that hold one or more permission set assignments beyond their profile
High External Access
Salesforce connected apps not restricted to admin-approved users
Detects connected apps where the permitted-users policy is not 'admin pre-approved users only'
High External Access

Need a rule that isn't listed? Rencore's Policy Builder lets you create custom policies tailored to your organization.

Reports

7 analytics views and dashboards.

Salesforce users by license
Shows how many users consume each user license type
Bar Chart · Costs
Salesforce users by type
Shows the split of internal versus external user types
Column Chart · External Access
Salesforce users by profile
Shows the number of users assigned to each profile
Bar Chart · Security
Salesforce connected apps by access policy
Shows connected apps split by whether they are restricted to admin-approved users
Bar Chart · External Access
Salesforce permission sets by Modify All Data
Shows how many permission sets grant Modify All Data
Bar Chart · Security
Salesforce logins by status
Shows the distribution of login outcomes (success vs failure)
Bar Chart · Security
Salesforce reports card in Rencore

Automations

5 automated remediation workflows.

Create Salesforce Case for External User with Permission Set
When an external Salesforce user is found holding a permission set, create a Salesforce case for access review.
Create Salesforce Case for Open Connected App
When a connected app is not restricted to admin-approved users, create a Salesforce case for the security team.
Create Salesforce Case for Profile with Modify All Data
When a profile grants Modify All Data, create a Salesforce case to track a least-privilege review.
Create Salesforce Case for Under-utilized License Pool
When a user license pool is below 60% utilization, create a Salesforce case so the license owner can review and downsize at renewal.
Create Salesforce Case
Starting point for creating a Salesforce case from any automation. Pick the trigger and fill in the case details.

Segments

8 data groupings for targeted filtering.

External Salesforce UsersInactive Salesforce UsersDormant Salesforce Users (180+ days)Open Salesforce Connected AppsUnder-utilized Salesforce LicensesPermission Sets with Modify All DataProfiles with Modify All DataActive Salesforce Agents

Frequently asked questions

What governance areas does Rencore cover?
Rencore covers six governance pillars: visibility and inventory across all Microsoft 365 services, ready-to-go policies with over 100 pre-built governance checks, compliance and audit evidence collection for regulatory requirements, extensibility and customization through custom policies and automations, cross-department collaboration with shared dashboards and role-based access, and AI and Copilot readiness to prepare tenants for secure AI adoption.
What is Rencore governance?
Rencore governance is a SaaS platform that continuously monitors your Microsoft 365 tenant for policy violations, configuration drift, and security risks across SharePoint, Teams, Power Platform, Copilot, and AI Agents. It automates compliance evidence collection, surfaces oversharing and sprawl, and provides actionable remediation workflows, reducing manual audit effort by up to 80%.
How do Rencore policies work?
Rencore ships with hundreds of pre-built policies that detect governance violations across every connector, oversharing, sprawl, cost overruns, security risks, and compliance gaps. Policies run on a continuous schedule, evaluate each discovered object against configurable rules, and flag violations with severity (High, Medium, Low), category, and a recommended action.

Related guides

Trusted by

MAPALBAMVille de LuxembourgWACKERGRUNDFOSAMGENOsramLufthansaThyssenKruppSunrisePattern