Spun up a new Spring 21 sandbox from our Shield Platform-encrypted PROD org. PROD has Account.Name deterministic, case-insensitive encryption.

  • Created a new Account with name = foo

  • Went to Developer Console and entered

     SELECT Id, Name FROM Account WHERE Name = 'foo'
  • RESULT: 0 records found!?!

N.B. Issue discovered when running unit tests

Same query works fine on existing orgs, PROD included, that were upgraded to Spring 21 as part of the SFDC release.

What is going on?

1 Answer 1


I would surmise this is a bug -- the workaround is to generate new Tenant Secrets in the sandbox

Setup | Platform Encryption | Key Management

enter image description here

I got the workaround idea from: How does Shield Platform Encryption Work in Sandboxes

As a best practice, rotate tenant secrets on sandboxes after a refresh. Rotation ensures that production and sandbox use different tenant secrets. Destroying tenant secrets on a sandbox renders encrypted data unusable in cases of partial or full copies.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .