Who Opens the Folder, and Whose Access Fills the Dashboard

Module 4 of 8 in the chapter Files, Folders, Reports and Other Data, chapter 12 of Securing Salesforce: Sharing and Visibility. Each module stands on its own.

The question this module answers: Who can open a report or a dashboard, and whose data do they see when they do?

In class I keep this one short, because most people already know it: you share a report through its folder. You share the folder that it’s in, you can share the folder with a public group, and you say whether they’re a viewer, an editor or a manager. That’s report folder security.

But it’s only half the answer. The folder decides who can open the report. Something else decides what’s inside when they do. For a report, that’s the viewer’s own access. For a dashboard, it may be somebody else’s. That second half is where the data gets out.

The folder: who can open it

Salesforce puts it in one line: “Use enhanced folder sharing to share a report or dashboard folder with users, groups, roles, or territories.” And it’s the normal case today: “Enhanced folder sharing is the default option for all orgs created after 2013” (Share a Lightning Report or Dashboard Folder (opens in a new tab), Salesforce Help, checked 2026-11-07).

Each entry gets one of three levels. “Viewers can see the data. Editors can determine what data is shown. Managers can control access” (Access Levels for Report and Dashboard Folders (opens in a new tab), Salesforce Help, checked 2026-11-07).

Click to enlarge

Three things to know about the folder.

The highest level wins. “If a user is identified in more than one entity, the greatest permission is granted.” Share a folder with a group as viewers, add one of its members as a manager, and that person is a manager (Share a Lightning Report or Dashboard Folder). That’s the same rule as the share table: access adds up, it never takes away.

There’s a limit, and it pushes you to buckets. “You can share a report or dashboard folder with up to 25 users, groups, roles, or territories from the UI. To share a folder with up to 500 users, groups, roles, or territories, use the folder sharing REST API” (same page). Twenty-five is plenty if you share with groups and roles. It runs out fast if you share with people one at a time. It’s the lesson from chapter 11: share with a bucket, not a person.

Sharing the folder is a permission of its own. To share report folders you need “Manage Reports in Public Folders,” and for dashboard folders, “Manage Dashboards in Public Folders” (same page). A new folder starts closed: “When you create a folder, it is accessible only to you and to users with administrative permissions, until you share it” (Access Levels for Report and Dashboard Folders). So who holds those two permissions decides who can open your reports to the rest of the company. Keep that list short.

The report: whose records fill it

Opening the folder doesn’t open the records. A report shows the viewer only the records they can see, through the same sharing this whole course is about. Put two sales reps on the same report in the same folder, and each sees their own territory.

And a folder level doesn’t hand out report powers, either. Folder access “doesn’t determine access to folder contents. Permissions set for the reports and dashboards themselves determine your access to the contents.” Salesforce’s example: with editor access to a folder but only the Run Reports permission, “you can run the report but not make changes” (Access Levels for Report and Dashboard Folders).

So a report is fairly safe. The folder is one lock, the records are a second, and the report never shows more than the viewer could see anyway.

The dashboard: whose eyes it uses

A dashboard is different. It runs as a user. Salesforce: “A dashboard viewer sees data based on the assigned privileges and access of the dashboard’s running user” (Dashboard Data Visibility Considerations (opens in a new tab), Salesforce Help, checked 2026-11-07).

When you build one, you choose whose access fills it (Configure Dashboard Data Visibility in Lightning Experience (opens in a new tab), Salesforce Help, checked 2026-11-07):

• Me. “Any viewer sees data in the dashboard according to your access to data.”
• Another person. “The dashboard viewer sees data in the dashboard according to the data access level of the person that you specify.”
• The dashboard viewer. “The dashboard viewer sees data based on their own access to data. This type of dashboard is called a dynamic dashboard.”

Click to enlarge

The first two are static dashboards, and here’s the catch, in Salesforce’s own words: “Because the privileges of the running user determine the data displayed in the dashboard, it’s possible to give dashboard viewers access to more data than they normally have.” If the running user is an admin or an internal user, for example, viewers could see personally identifiable information (Dashboard Data Visibility Considerations).

That’s the one to remember. A rep who can’t see another region’s opportunities in a report can see that region’s totals on a dashboard that runs as the sales VP. Sometimes that’s exactly what you want: the whole team sees the company number. Sometimes it’s a leak. Either way, it’s a decision, and someone should make it on purpose.

Two permissions change whose eyes a viewer can borrow. “To specify a running user”: View My Team’s Dashboards or View All Data. And if you let viewers choose, “If the viewer has View My Team’s Dashboards permission, they can view the dashboard as themselves or as anyone beneath them in the role hierarchy. If the viewer has View All Data permission, they can view the dashboard as anyone” (Configure Dashboard Data Visibility in Lightning Experience).

Dynamic dashboards have limits

The safe answer is the dynamic dashboard: “A dynamic dashboard shows each user only the data that they have access to.” But you can’t use it everywhere. “You can have up to 5 dynamic dashboards for Enterprise Edition, 10 for Unlimited and Performance Editions, and 3 for Developer Edition.” And they come with rules: “You can’t save a dynamic dashboard in a private folder,” “You can’t schedule refreshes for dynamic dashboards,” and “You can’t subscribe to a dynamic dashboard” (Dynamic Dashboards (opens in a new tab), Salesforce Help, checked 2026-11-07).

So with five, you spend them where they matter: the dashboards with sensitive numbers that many people open. Everything else is static, and you pick its running user with care.

Test knowledge. Know the three folder levels, viewer, editor and manager, and that the greatest one wins. Know that a report shows each viewer only their own records, while a static dashboard shows every viewer what its running user can see. Know that a dynamic dashboard runs as the viewer, and that the editions limit how many you can have. A likely area, not a known question.

Email template folders

The same idea reaches email templates in Lightning Experience. “Use folders and enhanced sharing to let users decide who can use which email templates. Otherwise, all email templates are public and available to all users.” And who can make the folders: “Admins and any users with the Modify All Data permission can create email template folders. To let other users create email template folders, give them the Create Folders for Lightning Email Templates permission” (Folders and Enhanced Sharing in Lightning Experience (opens in a new tab), Salesforce Help, checked 2026-11-07).

A template isn’t usually secret. But a template with merge fields can put data from a record into an email, so it’s worth knowing who can use which ones.

When the report leaves the building

Here’s the story I tell in class. A salesperson knows they’re about to be fired, or they’re about to quit. So they build a report of every customer, export it to a file, and leave with all the private customer data. It’s happened before.

Every lock in this module allowed it. The salesperson could open the folder. They could see the customers, because those customers were theirs to see. The report showed nothing they weren’t allowed to see. Folders and sharing decide what someone can see; they don’t decide what someone does with it.

That’s where transaction security comes in: a policy that watches for something like a report export with more than a set number of rows, and then notifies a manager or blocks it. Chapter 19 covers it (Monitoring: Real-Time Events, Log Files and Transaction Security (coming soon)).

What an architect decides here

• How folders are organized: by department, by persona or by how sensitive the data is, and how each is shared, to groups and roles rather than people.
• Who holds Manage Reports in Public Folders and Manage Dashboards in Public Folders.
• For each dashboard, whose access fills it: a static running user, chosen on purpose, or a dynamic dashboard.
• Which dashboards get the few dynamic dashboards the edition allows.
• Who holds View My Team’s Dashboards and View All Data, since both let a viewer see through someone else’s eyes.
• Whether email template folders are turned on, and who may create them.
• What watches report exports, with chapter 19.

Beyond the exam: what AI changes. An agent that answers “how are we doing this quarter?” may read a dashboard or a report to do it. If it reads a static dashboard, it answers with the running user’s access, not the asker’s, and the answer goes to whoever asked. Check what each agent action reads: a report runs as the user, a static dashboard as its running user. And an agent makes it easy to ask for every customer in one sentence. The export worry from this module doesn’t go away; it moves into a chat window. Chapter 20 covers agents.

Explore

• Share a Lightning Report or Dashboard Folder (opens in a new tab), Salesforce Help (checked 2026-11-07)
• Access Levels for Report and Dashboard Folders (opens in a new tab), Salesforce Help (checked 2026-11-07)
• Configure Dashboard Data Visibility in Lightning Experience (opens in a new tab), Salesforce Help (checked 2026-11-07)
• Dashboard Data Visibility Considerations (opens in a new tab), Salesforce Help (checked 2026-11-07)
• Dynamic Dashboards (opens in a new tab), Salesforce Help (checked 2026-11-07)
• Folders and Enhanced Sharing in Lightning Experience (opens in a new tab), Salesforce Help (checked 2026-11-07)