Share Group
A Share Group is a set of users that gains access to records owned by high-volume Experience Cloud users (formerly called High-Volume Portal Users).
Definition
A Share Group is a set of users that gains access to records owned by high-volume Experience Cloud users (formerly called High-Volume Portal Users). It is configured as a child of a Sharing Set in Setup, Digital Experiences, Settings. The Share Group extends the same record access the Sharing Set grants to external community users out to internal Salesforce users, partner users, or other community user groups.
Share Groups exist because high-volume external users do not participate in the role hierarchy. Records they own cannot be shared upward through hierarchy roll-up, and they cannot be added to normal sharing rules. The Share Group is the bridge: it lets the internal customer-service team or the partner administrators reach those records by membership in the group, without forcing the external users into a role-based sharing model that does not scale to community sizes.
How Share Groups extend access for high-volume Experience Cloud records
Why high-volume external users need a Share Group at all
High-volume Experience Cloud user licenses (Customer Community, Customer Community Login) do not assign a role in the org's role hierarchy. The design choice exists because customer-community deployments routinely hold millions of users; placing each one in a role would generate sharing recalculations that the platform could not finish. The trade-off is that records owned by these users are isolated by default. Internal users cannot see them through role-hierarchy access, and standard sharing rules do not target them. The Share Group is the platform's purpose-built escape hatch for this restriction.
Share Group lives under a Sharing Set
Share Groups are not configured standalone. They are configured underneath a Sharing Set in Setup, Digital Experiences, Settings. The Sharing Set defines the rule that grants the external user access to records, usually a match between the external user's Account or Contact lookup and the same lookup on the target record. The Share Group then extends that same access to a list of internal users, partner users, or other external user groups. The two features are paired by design; you cannot create a Share Group without first having a Sharing Set to attach it to.
What a Share Group can contain
A Share Group can include Roles, Roles and Subordinates, Portal Roles, Public Groups, and Partner Roles. It cannot directly include individual users; membership is always by container. The standard pattern is to put the internal team into a Public Group called Customer Service Team or Partner Admin Team, then add that Public Group to the Share Group on the Sharing Set. This indirection makes membership maintenance straightforward: adding or removing a user from the Public Group changes their access through every Share Group that references the group, without editing the Share Group itself.
Access level comes from the parent Sharing Set
A Share Group grants the access level configured on the parent Sharing Set, not an independent level. If the Sharing Set grants Read access to records based on the Account lookup, the Share Group members get Read access to the same records. The Sharing Set is the source of truth for what is shared and at what level. The Share Group only controls who else, beyond the original external user, receives that access. Changing the Sharing Set's access level affects every Share Group member automatically without any extra step on the Share Group.
When to use a Share Group vs a normal sharing rule
Use a Share Group when the records you need to share are owned by high-volume Experience Cloud users. Use a normal sharing rule when the records are owned by internal users or by non-high-volume Experience Cloud users. The choice is forced by the license type of the record owner, not by preference. High-volume users do not appear in sharing rule targets at all; the Share Group is the only mechanism available. Trying to configure a sharing rule against a high-volume user role returns no matching records in the Setup UI, which is the platform's hint that the wrong tool was picked.
Performance and recalculation behaviour
Adding or removing membership in a Share Group triggers a sharing recalculation for every record covered by the parent Sharing Set. On large communities with millions of records, this recalculation runs asynchronously and can take hours. The Defer Sharing Calculations tool can pause the recalc during bulk membership changes; resume it after the changes are complete to let the platform run the recalc once instead of per change. The same caution applies to changing the Sharing Set's matching criteria, which forces a recalc on every record the criteria affect.
Sharing Sets and Share Groups in the Experience Cloud security stack
Experience Cloud security has four layers for external users: the user license, the profile, the Sharing Set, and the Share Group. The license decides whether the user is high-volume (Customer Community) or low-volume (Partner Community, Customer Community Plus with role assignment). The profile sets baseline object and field permissions. The Sharing Set grants record access to the external user. The Share Group extends that record access to internal users. Misconfiguring any one of the four breaks the model; the Share Group is the last bridge in a chain that starts with picking the right license at user creation.
Configure a Share Group on a Sharing Set
A Share Group is configured as a child of an existing Sharing Set. The steps below assume the Sharing Set is already in place; if not, create the Sharing Set first by defining the user-to-record matching rule and the access level.
- Open the Sharing Set in Setup
Go to Setup, Digital Experiences, Settings. Scroll to Sharing Sets and click the Sharing Set you want to extend. If the Sharing Set does not exist yet, create it first.
- Find the Share Group section
On the Sharing Set detail page, scroll to the Share Group related section. By default, only the external user owning the record has access via the Sharing Set; the Share Group section is where you add internal users.
- Add the right containers to the Share Group
Click Edit on the Share Group. Move Roles, Public Groups, Partner Roles, or Portal Roles from the Available list into the Selected list. Use Public Groups as the standard pattern rather than individual roles for long-term maintainability.
- Save and wait for sharing recalculation
Save the Share Group. The platform queues a sharing recalculation to apply the new access to existing records. On large datasets this runs asynchronously; check the Background Jobs page for status if the access does not appear immediately.
- Verify with a test user from the Share Group
Log in as a member of one of the Share Group containers and confirm that records owned by external users in the matched accounts now appear in the test user's record access. If access is missing, check the Sharing Set criteria and the Share Group membership.
Adds the selected role plus everyone below it in the role hierarchy to the Share Group. The shortest path to give a manager and their team access.
The recommended container for Share Group membership. Lets you change the team without editing the Share Group itself.
Lets one portal's users access records owned by another portal's high-volume users. Used in multi-portal Experience Cloud deployments.
- Share Groups cannot include individual users. Membership is always by container (role, group, portal role). To give a specific user access, put them into a Public Group and add the group to the Share Group.
- Changes to a Share Group trigger asynchronous sharing recalculation. On large datasets the recalc can take hours. Use Defer Sharing Calculations before bulk membership changes.
- Share Groups only work with high-volume Experience Cloud user records. For normal sharing scenarios, use sharing rules instead. The Setup UI does not always make this distinction obvious.
Trust & references
Cross-checked against the following references.
- Sharing Sets in Experience CloudSalesforce Help
- Share Records with High-Volume Community Users via Share GroupsSalesforce Help
- User Licenses for Experience CloudSalesforce Help
- Defer Sharing CalculationsSalesforce Help
Straight from the source - Salesforce's reference material on Share Group.
- Sharing SetsSalesforce Help
- Share GroupSalesforce Help
About the Author
Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He runs salesforcedictionary.com to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.
Test your knowledge
Q1. What is a Share Group?
Q2. Do admins manage them directly?
Q3. When are they relevant?
Discussion
Loading discussion…