How to Extract Sharing Rules in Salesforce: A Complete Guide

Salesforce sharing rules are an important part of the platform’s security and record-access model. They allow organizations to extend access to records beyond their organization-wide default settings and help users collaborate without giving everyone unrestricted access to business data.

For Salesforce Administrators, Developers, Consultants, and implementation teams, knowing how to review and extract sharing-rule information can be useful during security audits, troubleshooting, documentation, migrations, and deployment activities.

In this guide, we will explain what Salesforce Sharing Rules are, how they work, how to access them, how to extract their configuration, and what best practices professionals should follow when managing them.

What Are Sharing Rules in Salesforce?

Salesforce Sharing Rules are configuration settings that automatically extend record access to specific users, roles, public groups, territories, or other supported groups.

They are generally used when the organization’s Organization-Wide Defaults (OWD) do not provide sufficient access for a particular business requirement.

For example, suppose an organization’s Opportunity records are private. A company may want members of a particular sales group to access opportunities owned by another team. Instead of changing the organization’s entire sharing model, an administrator can create a sharing rule that provides the required additional access.

Salesforce describes sharing rules as exceptions that extend access beyond the organization’s default sharing settings. They can be based on record ownership or criteria such as field values.

Why Is It Important to Extract Sharing Rules?

Extracting or documenting sharing-rule configuration can be useful in several Salesforce administration and development scenarios.

Security Audits

Reviewing sharing rules helps administrators understand where additional record access has been granted. This can be especially important when an organization handles confidential customer, financial, employee, or operational information.

Troubleshooting Record Access

When a Salesforce user reports that they can or cannot access a particular record, administrators need to understand the organization’s sharing model.

Reviewing sharing rules alongside OWD settings, role hierarchy, permission sets, territories, and other access mechanisms can help identify the source of the access.

Salesforce Migration

During Salesforce implementation or migration projects, sharing-rule configuration may need to be documented and deployed to another environment.

Keeping an organized record of sharing rules makes it easier to understand how the source and target environments differ.

Documentation

Large Salesforce organizations can contain numerous objects and sharing rules. Documenting their purpose, criteria, target users, and access levels can make future administration easier.

Compliance and Governance

Organizations with formal security or compliance requirements may need to periodically review how record access is configured.

A sharing-rule inventory can help administrators identify unnecessary or outdated access configurations.

How Do Salesforce Sharing Rules Work?

Before extracting sharing rules, it is important to understand their place within Salesforce’s overall security model.

Salesforce record access can be influenced by several mechanisms, including:

• Organization-Wide Defaults
• Role Hierarchy
• Sharing Rules
• Manual Sharing
• Teams
• Territory-based access
• Permission Sets and Profiles
• Restriction Rules
• Sharing Sets and other Experience Cloud features

Sharing rules generally extend access; they do not replace the organization’s complete security model. Salesforce notes that sharing rules cannot make access more restrictive than the applicable organization-wide defaults.

This means that extracting sharing rules alone may not provide a complete picture of why a user has access to a record.

Types of Salesforce Sharing Rules

Salesforce provides different sharing-rule configurations depending on the object and business requirement.

Owner-Based Sharing Rules

An owner-based sharing rule shares records according to who owns them.

For example, an organization may have an Opportunity object with private access. The company could create a rule that allows users in one role or group to access opportunities owned by members of another group.

This type of rule is useful when access needs to follow an organizational structure or ownership pattern.

Criteria-Based Sharing Rules

Criteria-based sharing rules determine which records should be shared based on field values.

For example, an organization could create a rule that shares records when a field such as Department = IT.

The administrator specifies the field, operator, and value that records must match. Salesforce then extends access to the selected users or groups.

Guest User Sharing Rules

Salesforce also supports specialized sharing rules for guest users in applicable scenarios.

Because guest users can access Salesforce-connected resources without normal authenticated user credentials, these rules require particular attention to security. Salesforce warns that guest-user sharing can provide access to records matching the configured criteria without requiring login credentials.

User Sharing Rules Based on Group Membership

For the User object, Salesforce also supports sharing rules based on group membership. These rules can be used to extend access to user records according to the configured membership criteria.

How to View Sharing Rules in Salesforce

The easiest way to review sharing rules is through Salesforce Setup.

Step 1: Log In to Salesforce

Log in to the Salesforce organization using an account with the appropriate administrative permissions.

Step 2: Open Setup

Click the Setup icon in Salesforce Lightning Experience.

Step 3: Search for Sharing Settings

Use the Quick Find box and search for:

Sharing Settings

Select Sharing Settings from the results.

Step 4: Find the Relevant Object

On the Sharing Settings page, locate the object for which you want to review access rules.

Depending on the object and Salesforce configuration, you may see a section such as:

Account Sharing Rules

Opportunity Sharing Rules

Case Sharing Rules

or another supported object’s sharing rules.

Step 5: Review the Rules

Review each rule’s configuration, including:

• Rule Label
• Rule Name
• Rule Type
• Record-selection criteria
• Users or groups receiving access
• Access level
• Related object access where applicable

Salesforce’s current documentation confirms that sharing rules are managed from Setup → Sharing Settings, where administrators can create and manage rules for supported objects.

How to Extract Sharing Rules from Salesforce

There are several approaches professionals can use depending on whether they need a quick review, metadata deployment, documentation, or programmatic processing.

Method 1: Review Sharing Rules Through Setup

For a small Salesforce organization, the Setup interface may be sufficient.

Navigate to:

Setup → Sharing Settings → Select Object → Sharing Rules

You can review the configuration and document the rules manually.

This approach is useful when you need to inspect a small number of rules without performing a metadata deployment.

Method 2: Extract Sharing Rules as Metadata

For Salesforce development and deployment projects, sharing rules can be handled as metadata.

Salesforce metadata-based development tools can be used to retrieve configuration from an organization and include the relevant sharing-rule metadata in a project.

This approach is useful when:

• Moving configuration between environments
• Maintaining Salesforce source control
• Auditing configuration changes
• Creating deployment packages
• Comparing sandbox and production configurations

The metadata approach is generally more suitable for developers and DevOps teams than manually copying configuration from Setup.

Method 3: Use Salesforce CLI and Metadata Retrieval

Salesforce developers can use Salesforce CLI-based development workflows to retrieve metadata from an organization.

A typical workflow is:

1. Authenticate to the Salesforce org.
2. Identify the metadata components required.
3. Retrieve the relevant metadata.
4. Review the retrieved configuration.
5. Store it in the Salesforce project.
6. Compare or deploy the configuration as required.

This method is especially useful when sharing-rule configuration needs to become part of a repeatable deployment process.

Method 4: Use Metadata-Based Deployment Tools

Salesforce metadata can also be retrieved and deployed using supported Salesforce development tools and APIs.

This can be useful for organizations that maintain separate development, testing, staging, and production environments.

Instead of manually recreating sharing rules, teams can maintain configuration in a structured deployment workflow.

Can You Query Sharing Rules Using SOQL?

This is an important distinction.

Sharing rules are metadata/configuration, so they should not be treated like ordinary business records that you simply query with standard SOQL.

If your goal is to extract the configuration of sharing rules, a metadata-oriented approach is generally more appropriate.

If your goal is to understand actual record-level access, Salesforce provides different mechanisms and objects for investigating sharing and access information.

Therefore, administrators should first identify whether they need:

Sharing-rule configuration

or

Actual record access information

These are related but different requirements.

Sharing Rules vs Manual Sharing vs Apex Sharing

These concepts are often mixed together, but they serve different purposes.

Sharing Rules

Sharing rules automatically extend access to a defined group of records based on supported ownership or criteria conditions.

Manual Sharing

Manual sharing allows access to be granted to specific records when a user needs access outside the normal automated sharing model.

Salesforce describes manual sharing as a mechanism for record owners to give access when a consistent automated sharing rule isn’t appropriate.

Apex Managed Sharing

Apex-managed sharing allows developers to create programmatic sharing behavior for supported scenarios where declarative sharing mechanisms do not meet the business requirement.

These mechanisms should not be described as interchangeable “types” of standard Salesforce Sharing Rules.

What Information Should You Document?

When extracting sharing rules for an audit or Salesforce project, create a structured inventory.

Useful fields include:

This documentation can make future troubleshooting and security reviews much easier.

Best Practices for Managing Salesforce Sharing Rules

Start With Organization-Wide Defaults

Before creating or changing sharing rules, understand the object’s OWD configuration.

Sharing rules are designed to extend access rather than replace the overall sharing model.

Use the Simplest Access Model That Meets the Requirement

Avoid creating unnecessary rules when the required access can already be achieved through an appropriate role hierarchy, team, group, or other Salesforce security feature.

Review Criteria Carefully

For criteria-based rules, verify the field, operator, and value.

Salesforce notes that criteria-based rules evaluate record field values, and supported field types and configuration options vary.

Use Clear Rule Names

Create descriptive labels and API names that make the purpose of a rule easy to understand.

For example:

Share_Urgent_Cases_With_Support

is generally easier to understand than:

CaseRule01

Document Business Purpose

A sharing rule should have a clear reason for existing.

Good documentation can help future administrators understand why a rule was created and whether it is still required.

Regularly Audit Access

Business structures change. Employees move between teams, departments are reorganized, and Salesforce implementations evolve.

Review sharing rules periodically to identify rules that are outdated or no longer required.

Consider Performance at Scale

Large Salesforce organizations should pay attention to the number and complexity of sharing rules.

Salesforce currently documents a default limit of 300 total sharing rules per object, including a separate default limit of 50 criteria-based sharing rules per object, with higher limits available through Salesforce Support in eligible circumstances. Salesforce also notes that large numbers of sharing rules can affect sharing calculations and record operations.

Common Problems When Working With Sharing Rules

Users Still Cannot Access Records

A sharing rule may grant access to records, but other parts of Salesforce’s security model can affect the final result.

Check:

• OWD settings
• Role hierarchy
• Profiles
• Permission Sets
• Restriction Rules
• Territories
• Teams
• Sharing rules
• Record ownership

Too Many Sharing Rules

A large number of rules can make the sharing model difficult to understand and maintain.

Consolidating requirements where appropriate can make administration easier.

Incorrect Criteria

A criteria-based sharing rule may fail to provide the expected access if the field value, operator, or filter logic does not match the actual record data.

Changing a Sharing Rule

The fields that can be edited depend on the rule type. Salesforce notes that if certain fundamental fields need to be changed, administrators may need to delete the existing rule and create a new one.

Why Salesforce Professionals Should Learn Sharing Rules

Understanding Salesforce sharing rules is valuable for professionals working in administration, development, consulting, implementation, and Salesforce security.

A strong understanding of record access helps professionals troubleshoot user-access problems and design Salesforce environments that balance collaboration with data protection.

It also provides a foundation for understanding broader Salesforce security concepts such as:

• Organization-Wide Defaults
• Role Hierarchy
• Profiles
• Permission Sets
• Permission Set Groups
• Record-Level Security
• Field-Level Security
• Restriction Rules
• Territory Management
• Apex Managed Sharing

Frequently Asked Questions

What are Salesforce Sharing Rules?

Salesforce Sharing Rules are configuration rules that extend record access to selected users, groups, roles, territories, or other supported audiences beyond the organization’s default sharing settings.

How do I view Sharing Rules in Salesforce?

Go to Setup → Sharing Settings and locate the sharing rules section for the required object.

Can Sharing Rules be exported?

Sharing-rule configuration can be retrieved through Salesforce’s metadata and development tooling, making metadata-based extraction useful for deployment, documentation, and source control workflows.

Are Sharing Rules the same as Manual Sharing?

No. Sharing rules provide automated access based on defined conditions, while manual sharing provides access to individual records when needed.

What is the difference between Owner-Based and Criteria-Based Sharing Rules?

Owner-based rules determine which records are shared based on record ownership. Criteria-based rules determine which records are shared based on field values or other configured criteria.

Can Apex be used for record sharing?

Yes. Apex-managed sharing can be used for programmatic record-sharing requirements where standard declarative sharing mechanisms do not meet the business requirement.

Why should Salesforce administrators audit sharing rules?

Auditing helps administrators understand how additional record access is being granted, identify outdated configurations, troubleshoot access issues, and maintain a manageable security model.

Conclusion

Extracting and reviewing Salesforce Sharing Rules is an important skill for Salesforce administrators, developers, consultants, and security professionals.

The process starts with understanding the organization’s overall sharing model and then reviewing the rules configured under Setup → Sharing Settings. For larger development and deployment projects, metadata-based retrieval and Salesforce development tools provide a more structured way to manage configuration.

Remember that sharing rules are only one component of Salesforce record-level security. For a complete access analysis, professionals should also consider OWD settings, role hierarchy, permissions, teams, territories, restriction rules, and other access mechanisms.

With proper documentation, regular audits, and a clear understanding of how each sharing mechanism works, Salesforce teams can maintain a more organized and manageable data-access architecture.