The Salesforce Field Level Security Report You Can Generate in Three Clicks
Updated: Aug 3
"Can the Support profile see the routing number field?" It's a simple question with an answer that's genuinely hard to get to. Field-Level Security in Setup shows you access one profile at a time. If your org has thirty profiles and forty permission sets, answering that question honestly means opening dozens of pages and keeping notes.
A Salesforce Field Level Security Report in Three Clicks
Fields Access Explorer, part of Power User Toolkit, flips the direction of the question. Instead of starting from a profile and checking its fields, you start from the field and see everyone who can touch it:
Pick an object. Like the rest of the toolkit, the object list comes from what the System Administrator profile can read — real, accessible objects, not a raw schema dump.
Pick a field.
See the access. A tabbed view breaks the answer into three groups — permission sets, permission set groups, and profiles — each showing read and edit access as a clean yes/no table.
That's a complete Salesforce field-level security report, generated on demand, without opening a single profile.
Where this actually gets used
A few situations where this replaces a much slower manual check:
Security reviews. Instead of "we believe access is limited to X and Y," you get the actual list.
Data classification work. Before you can decide a field needs tighter controls, you need to know who currently has access to loosen.
Access cleanup. Permission sets accumulate over years. Checking a genuinely sensitive field's access list once in a while catches grants nobody remembers making.
Onboarding a new admin. Understanding how access is actually structured in an inherited org is faster from the field's side than the profile's side.
Why start from the field
Most of Salesforce's native access tools are built to answer "what can this profile do," which is the right question when you're setting up a new role. It's the wrong question when you're auditing one specific piece of data and need to know everyone who can reach it — because you'd have to check every profile and permission set individually to be sure you didn't miss one. Starting from the field instead means the tool does that cross-referencing for you, once, correctly.
Once you know who can see a field, the natural next question is what else that permission set grants — see What Does This Permission Set Actually Grant? A Faster Salesforce Audit and The Permission Set Assignment About to Expire That No One Noticed. Or start at the Power User Toolkit overview.
Comments