Guest User Access

[kwclick5]

Hi,

We got a recent email from Salesforce about checking our guest users, which prompted me to check again to see if we had any (because I thought we didn’t). Turns out we do have one guest user for the event site that was set up when I was testing the events module (we aren’t currently using it).

I’ve checked the instructions at C&P about Salesforce sites and everything appears to be correct, but I wanted to double-check that there isn’t anything else I needed to do. Like were there any historical records assigned to the guest user that I need to reassign? And Salesforce’s recommend AppExchange package for validating guest user access (https://appexchange.salesforce.com/a...A00000FR6GaUAL) says that the guest user can see around 10000 accounts, 2000 C&P transactions, 13000 contacts, 38000 opportunities, and 222 products (not to mention some of the other C&P objects that they probably do need access to). That’s only a subset of our accounts and contacts, but seems to be all records of the other objects. Is that intentional or is there something I need to change?

[CnP.LiveSupport.AB]

It is intentional.

Your validation app is providing a report based on the Site's Default Profile, but the site guest user needs that access to automatically create records in Salesforce from a blank form, but their actual access to anything but the record they created is informed by the Sharing Rules.

Regarding "native" Salesforce objects:

Access to the 'native' Salesforce objects became necessary when customers wanted to know when transactions and opportunities were automatically created vs. created by internal users- our apps began setting the Site Guest User as the Record Owner for those records. The most obvious reference to this change is in our release notes for the March 2020 release, when we began recording the 'Processed By' field on the transaction, but records were assigned to the Site Guest User prior to that.

• The Site Guest User is assigned as the Record Owner when Leads are created using our Shoutout feature.
• The Site Guest User is assigned as the Record Owner for Opportunities created through Event registration and invoice payments.
• When the Event is assigned to the Campaign, and someone registers for that event, the registration form has to "read" the id for the Campaign needed, and needs to assign the Campaign Member status set.

Now that Salesforce is shifting to assigning records created by the Site Guest User to the Site's "default Record Owner", many of these settings may no longer be relevant, but we have to assign them for backward compatibility.

Regarding custom C&P objects:

In order to build the event page registration form, the app must consult many of the Event app's records to render the page, and that information request is triggered when the Site Guest user goes to the event registration page.

Similarly, many of the PaaS objects are made available so that invoicing can function appropriately.

[kwclick5]

Got it. Thanks for clarifying!