Org-wide defaults are set in Sharing Settings under Setup. You pick an internal access level (and optionally an external one) for each object. Plan the change before you make it, because tightening triggers a recalculation across every record and can remove access users rely on.
- Open Sharing Settings
In Setup, go to Quick Find and enter Sharing Settings, then open it. This is the single page that lists the org-wide default for every object in one grid.
- Edit the defaults
Click Edit at the top of the Organization-Wide Defaults section. Each object shows a Default Internal Access picklist, and objects with an external model also show Default External Access.
- Choose the level per object
Set each object to the right level, from Private up to Public Read/Write. Keep external access at or below internal access, and set it to Private wherever you can.
- Handle hierarchy access
For a custom object that must stay with its owner, clear Grant Access Using Hierarchies so managers do not inherit access automatically. This box is locked on for standard objects.
- Save and let recalculation run
Save your changes. If you tightened any default, the new access applies only after sharing recalculation finishes, which runs in the background on large objects.
The baseline access internal users get to records they do not own, set per object from Private through Public Read/Write (and Transfer or Full Access where supported).
The baseline for authenticated Experience Cloud and portal users; must be equal to or more restrictive than internal, and is best left Private.
Controls whether users above the owner in the role hierarchy inherit access automatically; clearable only on custom objects not set to Controlled by Parent.
- Tightening a default reruns sharing on every existing record, so the change is not instant and can briefly disrupt access while recalculation completes.
- You cannot make a record private again with sharing rules once the OWD is open. True privacy must come from a restrictive OWD set on the object.
- Once you enable a separate external sharing model you cannot remove it; you can only realign internal and external levels to match.
- Salesforce blocks changing some defaults from private to public when Apex code references that object's sharing rows.