Selective Sandbox Access lets you grant sandbox access only to members of a public group, avoiding the headache of .invalid emails and unintended access after a sandbox refresh.
Big idea: Automate sandbox access so only intentional users get access after a sandbox is created or refreshed.
Business problem
Refreshing or creating sandboxes often grants access to all active users in the source org. That creates two problems: users receive .invalid appended to their email addresses which requires manual correction, and many users get access they don’t need. This wastes admin time and increases risk.
What is Selective Sandbox Access?
Selective Sandbox Access is a Salesforce feature that allows admins to grant sandbox access only to members of a selected public group when creating or refreshing sandboxes. Members of the public group retain their original email addresses (no .invalid), while users outside the group are frozen. This speeds up sandbox creation and reduces post-refresh cleanup.
When to use it
Use Selective Sandbox Access when you want to limit sandbox access to a specific set of users, such as developers, QA, or business collaborators. For Developer and Developer Pro sandboxes, using a public group is mandatory. For Partial Copy and Full sandboxes, Salesforce recommends using a public group but still allows granting access to all active users.
How to set it up
- Create a public group (for example, DevBiz Collaborators) and add relevant users to it.
- When creating or refreshing a sandbox, select the public group under the sandbox access options.
- Complete the sandbox creation/refresh. Users in the public group will have access with valid email addresses; others will remain frozen.
Notes and limitations
As of Spring ’25, Selective Sandbox Access is not available when cloning a sandbox.
Practical tip
Use public groups aligned to typical roles (Developers, QA, Business Users) to make access decisions repeatable and simple.
Why this matters
Selective Sandbox Access reduces manual cleanup, minimizes accidental access, and shortens refresh times. For admins managing frequent sandbox refreshes, it’s a small configuration with immediate benefits.
Category: Salesforce Tips