Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
Spun up a new Spring 21 sandbox from our Shield Platform-encrypted PROD org. PROD has Account.Name deterministic, case-insensitive encryption.
Created a new Account with name = foo
Went to Developer Console and entered
SELECT Id, Name FROM Account WHERE Name = 'foo'
RESULT: 0 records found!?!
N.B. Issue discovered when running unit tests
Same query works fine on existing orgs, PROD included, that were upgraded to Spring 21 as part of the SFDC release.
What is going on?
I would surmise this is a bug -- the workaround is to generate new Tenant Secrets in the sandbox
Setup | Platform Encryption | Key Management
I got the workaround idea from: How does Shield Platform Encryption Work in Sandboxes
As a best practice, rotate tenant secrets on sandboxes after a refresh. Rotation ensures that production and sandbox use different tenant secrets. Destroying tenant secrets on a sandbox renders encrypted data unusable in cases of partial or full copies.
