I need to block the read and edit field access on a custom object to all system admins except for one system admin. I could encrypt these fields but system admins can still enable the permission and creating custom admin profile its not the best option either.

Any thoughts would be appreciated. Thanks

2 Answers 2


There's no way in ordinary org setup to block sObject data from System Administrators. The System Administrator can always elevate their own privileges to access that data.

The only secret store that is safe would be to store data in a Protected entity in a managed package, where it can only be accessed by that package's Apex. However, that solution is unlikely to suit your use case and requires custom development.


An idea is to encrypt the field and give access to the key only to authorized users. I would be curious to know how you have solved your problem. We are working to develop a solution on similar use cases to manage ultra-sensitive data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .