External User Security

Experience CloudExternal User SecurityHow record access works for customers, partners and anonymous guests: external org-wide defaults, external roles and super users, sharing sets and share groups, account relationship data sharing, the guest user model, secure Apex for sites, CSP/clickjack settings, and testing as external users.Advanced · about 90 minutesWhat you will learn

Explain the layers that decide what an external or guest user can see, and set external org-wide defaults correctly

Design role-based sharing for partner and Customer Community Plus users without role hierarchy explosion

Grant high-volume users access with sharing sets and share groups

Configure account relationship data sharing rules for distributor and reseller hierarchies

Apply the guest user security model and write @AuraEnabled Apex that is safe to expose on public pages

Detect and prevent the misconfigurations behind real-world Experience Cloud data exposures

Write Apex tests that run as partner, customer and guest users

Contents

How access is decided for external users

External org-wide defaults

Roles for external users

High-volume users: sharing sets and share groups

Sharing rules and Apex sharing for external users

Account relationships and data sharing rules (PRM)

The guest user security model

Writing Apex that is safe on a site

Browser-level protections: CSP, LWS and clickjacking

Common breach scenarios and how to prevent them

Auditing tools

Testing as external users

Security checklist for every site

Hands-on exercises

Key takeaways