How to govern Salesforce
A step-by-step guide to governing Salesforce with Rencore: detect with 22 policies, review with 7 reports, and remediate with 5 automations.
Governing Salesforce means keeping its access, configuration, and lifecycle under continuous control rather than reacting after something breaks. Rencore governs Salesforce with 22 pre-built policies, 7 reports, and 5 automations, so teams can detect risk, review posture, and remediate with an audit trail. The steps below turn that coverage into a repeatable routine.
Steps
-
Inventory Salesforce
Connect Salesforce and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Salesforce to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Salesforce reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Recommended Salesforce policies
Grounded in the Rencore catalog. See the full Salesforce catalog on the Salesforce connector page.
-
Salesforce external user is active and reachable
Active external users are externally-reachable identities and a more likely entry point for compromise
Severity: High -
Salesforce agent is active and callable
Active Agentforce agents are callable and exercised against real user input, raising the likelihood of exploitation
Severity: Medium -
Salesforce System Administrator is active
Active System Administrators are full-access, high-value targets, raising the likelihood that weaknesses are exploited
Severity: High -
Salesforce connected app is open to all users
Connected apps any user can authorize are externally-reachable integration points, raising the likelihood of exploitation
Severity: High -
Salesforce permission set grants Modify All Data
Permission sets that grant Modify All Data have org-wide blast radius, raising the likelihood of exploitation
Severity: High -
Salesforce user license pools below 60% utilization
Detects user license pools with more than 10 licenses that are less than 60% used
Severity: Medium -
Salesforce permission set license pools below 50% utilization
Detects permission set license pools with more than 10 licenses that are less than 50% used
Severity: Medium -
Salesforce users not logged in for 180+ days
Detects active users who have not logged in for over 180 days and may be reclaimable licenses
Severity: Medium -
Active Salesforce external users
Detects active external community, partner, portal or guest users for periodic access review
Severity: Medium -
Salesforce external users with permission set assignments
Detects active external users that hold one or more permission set assignments beyond their profile
Severity: High -
Salesforce connected apps not restricted to admin-approved users
Detects connected apps where the permitted-users policy is not 'admin pre-approved users only'
Severity: High -
Stale Salesforce OAuth tokens (180+ days unused)
Detects third-party OAuth tokens that have not been used in over 180 days
Severity: Medium
