I'm trying to find users with the Manage Encryption Keys permission. I want to ensure only specific users have this permission, and I'd like to do this without reviewing every user in my Salesforce environment.

2 Answers 2


Use the following query:

SELECT Id, AssigneeId, Assignee.Name, PermissionSet.IsOwnedByProfile
FROM PermissionSetAssignment
WHERE PermissionSet.PermissionsManageEncryptionKeys = True AND Assignee.IsActive = TRUE
ORDER BY PermissionSet.IsOwnedByProfile DESC, Assignee.Name

You can get a list of all Permissions (they are individual boolean fields) by looking at Workbench for Object PermissionSet

Reference: User, Sharing, and Permissions Objects


If you are using source code management like git and you have your permission sets and profiles in your Repository you can simply check which profiles and permission sets contain the permission and find the corresponding users.

  • this can get tedious/involved if a permission set is part of many permission set groups; that said - for the Manage Encryption Keys permission, one would hope it is not enabled in too many places!
    – cropredy
    Feb 26, 2021 at 21:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .