Creating or refreshing a Full Sandbox is a planned event because of the time and resource cost. The steps below cover the safe approach for a first-time setup and an ongoing refresh cadence.
- Confirm available Full Sandbox units
Setup > Sandboxes. Check the Available counter for Full Sandboxes. If at zero, the org needs to purchase additional units before proceeding.
- Plan the Sandbox Template
Decide whether to copy all data or use a template to subset specific objects. Templates are valuable when full data is overwhelming or compliance-sensitive.
- Schedule the refresh window
Pick a window when the sandbox is not actively in use. Full refresh can take hours to days; plan for the worst case.
- Initiate the refresh
From Setup > Sandboxes, click Refresh next to the existing Full Sandbox or click Create for a new one. Select the template if applicable. Confirm.
- Monitor progress
The Sandbox list shows refresh status. Email notification fires on completion. Do not assume the sandbox is ready until the notification arrives.
- Run post-refresh setup
Execute the runbook: enable email deliverability, update integration endpoints, reset Connected App secrets, run data anonymization scripts. Each step is documented in advance, not invented during the rush.
- Hand off to project team
Notify the project team the sandbox is ready. Provide access credentials, test data references, and any caveats specific to this refresh.
Complete metadata and data copy. Largest, slowest refresh, most realistic.
Configuration subset for selective data copy. Useful for compliance or performance.
Once every 29 days for Full. Plan release timing around this cap.
Resets to System Email Only. Must be re-enabled to All Email for most testing.
Shield product that anonymizes sensitive fields. Run after refresh for compliance-sensitive orgs.
- Refresh cadence is 29 days minimum. Plan release schedule around this; you cannot refresh more often.
- Post-refresh setup is required. Email defaults to System Only, integrations point to wrong endpoints, secrets reset. Sandbox is broken until runbook executes.
- Production data is regulated data. Sandbox is not exempt from GDPR, HIPAA, or PCI; plan anonymization before users access.
- Full refresh can take days for large orgs. Schedule with substantial buffer; rush jobs produce broken sandboxes.
- Full Sandbox units are licensed separately at most editions. Confirm availability before committing the sandbox to a project.