PRO TIPS
Performing a Salesforce Health Check
Max Hampton
PROserve Consultant
Why should I perform a Salesforce Health Check?
If you followed our guide on Performing a Salesforce Security Review, then you’re already aware of how important it is to keep regular tabs on your Salesforce organization. Regular health check ares essential to ensuring that your data in Salesforce is clean and organized, and that both admins and end users' experiences using the platform are as efficient as possible. Performing regular health checks within Salesforce can help you identify and clean up messy data, streamline user and automated processes, and ensure your organization is always in a healthy, usable, and scalable state.
What is a Health Check?
A Salesforce health check can consist of many different steps depending on your usage of the platform. Generally speaking a health check involves using some out of the box Salesforce tools, such as both the standard system and NPSP Health Checks and Salesforce Optimizer, as well as taking the time to manually comb through and update your automations, reports, field usage, and other heavily utilized aspects of Salesforce.
Note that performing a health check review assumes that the user has access to Setup, which usually means that the user is a System Administrator, and has at least a basic understanding of Salesforce, including Object/Record sharing, and the general data model.
This article summarizes the health check that we perform for our PROserve clients. If you want to know more, or want some help assessing your org, reach out–we're happy to help!
Outline of a Salesforce Health Check
We will walk through each of these in a bit more detail, but generally speaking these are the key items we have identified to ensure your Salesforce environment is in as healthy a place it can be. Some or all of these may apply to you depending on your unique usage of Salesforce.
- Running the standard Salesforce System Health Check, which can detect potential vulnerabilities in your org, as well as running the NPSP Health Check if your org is using NPSP or Nonprofit Cloud.
- Running and evaluating Salesforce Optimizer.
- Reviewing existing Automations, such as workflow rules, process builders, and flows. Cleaning up automation naming schemes, converting workflows and process builders to flow, and updating descriptions.
- Reviewing Field Usage using 3rd party appexchange apps such as FieldPro or Zoominfo FieldTrip.
- Checking for and Creating/Updating and SPF or DKIM Keys to ensure Email Deliverability.
- Reviewing and cleaning up unused or incorrectly named Reports.
- Checking Data and File Storage Limits.
- Reviewing API Usage Limits.
System Health Check
*If you've already walked through our guide on Performing a Salesforce Security Review, feel free to skip this step.*
The Health Check assesses your org's configuration against Salesforce's recommended settings for baseline security and produces a single score on a scale of 1-100%. When running the health check, you'll get a report of your org's current settings, presented against Salesforce's recommended values, with the option to adjust any settings that don't match Salesforce's recommendations.
To run a Health Check, do the following:
- From Setup, search for Health Check
- Salesforce will automatically scan your org for common configuration issues and present these broken into risk categories: High, Medium, or Low
- Prolocity recommends you aim to achieve 90% if possible...
- ...but use discretion when reviewing the items that negatively impact this score and make informed decisions. Some items, such as enabling Log in as User may be required in your environment for support purposes. Additionally, enabling some items like Clickjack protection are desirable, but can cause issues with third party integrations or packages, like the UnofficialSF Data Table component.
- Click Edit on any of the items to be taken to the appropriate setup page to adjust your configuration.
- Once your configuration has been updated, you can return to the security review and refresh your page to see an updated score.
- Items listed as Critical will have a higher impact on your score, so prioritize fixing those issues first.
- For example this Org currently allows for 10 invalid login attempts before locking the user out. Salesforce recommends 3.
NPSP Health Check (only for organizations using Non-Profit Success Pack)
The NPSP Health Check assesses nonprofit specific settings and org configuration, such as donation records and correct Household Account model configuration.
To run an NPSP Health Check, do the following:
- In the Salesforce App Launcher, Navigate to NPSP Settings
- Under System Tools, click on Health Check
- Click Run Health Check to start. This will usually take a few minutes.
The NPSP Health check verifies your NPSP settings are configured properly. You can also choose to have the NPSP health check run a record-level check, which will check for data integrity issues such as Opportunities without Payments, or Household accounts without Contacts
After the health check completes, you can check Show passed tests to view all of the NPSP configuration deemed valid for your org. Any settings not correctly configured will be displayed to you as warnings.
If any checks did not pass, the Health Check will tell you the steps to take to resolve the issues. In our example below, we had some opportunities without payments. NPSP tells us which report to run to view and clean up that data
Data should be cleaned up at your discretion. For example you may have certain opportunity types that don’t require payments, or you may have a known empty household account that NPSP flagged, that you may want to keep.
Salesforce Optimizer
Salesforce Optimizer is an out-of-the-box tool that scans your org's configuration for common issues. It searches a bit deeper than the Health Check in Setup. Optimizer can be run manually, or scheduled to run on a repeating schedule. To run Optimizer, follow these steps:
- In Setup, search for Optimizer
- If you are prompted to allow access, click the Allow Access button
- Click Open Optimizer.
- You can schedule Optimizer to run at a set interval, much like a scheduled report or data export
- If you've never run the Optimizer before, you may be prompted with some additional steps to allow optimizer to run. If prompted, click Run Optimizer
Optimizer can take up to 24 hours to complete it’s scan depending on the complexity of your org. However we find it usually only takes a few minutes. You will receive an email when Optimizer has competed its scan, or you can simply refresh the page after a few minutes.
Once Optimizer has finished scanning, you will be presented with a list of items Salesforce has identified as may needing action. Items will be given an approximate level of effort, as well as a priority in terms of how immediately action is required. Click on the name of each item to view details and next steps, as well as direct links to where in Salesforce the issue can be resolved.
The level of effort and experience required to fix any outstanding issues varies widely. We recommend you work through and Immediate actions ASAP, and work to prioritize and or delegate the rest of them depending on knowledge and experience of the platform.
Some examples of what Optimizer may flag as needing attention:
- Reaching Data limits
- Having a number of users who have not recently logged in
- Identified release updates for deployment
- Page performance and usage
- Profiles and or Permission set assignments
- Reports and dashboards that have not been used or run.
Optimizer's results can likely serve as a guide for the rest of your health check, as it will report on many of the items we'll cover in more detail below.
Automation Review
It’s a good idea to keep tabs on your automations in Salesforce. During a health check we recommend taking a look through your automations and making updates to them such as:
- Renaming with a consistent naming scheme. This makes it easier to identify Flows at-a-glance. For example, we like naming Record Triggered Flows using the following pattern: “[Type of Flow, after or before save][object] name or brief description”
- Example: [AS][Contact] Set Mailing Preferences on Update
- Migrating Process Builder and or Workflow Rules to Flow
- Salesforce has announced the end of support for both Process Builder and Workflow Rules will be December 31, 2025. While existing rules will continue to execute beyond that date, Salesforce will no longer provide customer support or bug fixes for issues. The writing is on the wall–it's time to plan out your transition to Flow now! This is also a chance to reconsider automations that may no longer be necessary, or that can be redesigned to perform better. This may be an area where working with experienced designers may be helpful to your org's sustainability and scalability.
Making sure every Flow has a good description. Writing good descriptions can greatly reduce the time it takes to troubleshoot automations. It helps other admins (and maybe even future you!) remember what a Flow's primary function is without having to deep dive into each element every time you need to make an update or troubleshoot.
Review Field Usage
Over time, it’s common for Salesforce orgs to develop technical debt through the creation of fields that may no longer fit your business needs. As part of a Health check we recommend using a field analyzer tool to get more insight into the usage rates of your fields.
Two options we like for conducting field reviews include Field Trip, by Zoom Info and FieldPro. Both options provide lightweight packages you can install into your Salesforce org to better help determine different aspects of field health such as a fields population percent on records, or the number of custom fields you have on each object.
After running the analysis, you should look for fields with little to no usage. Those are potentially targets for deprecation and/or deletion.
This is also a chance to look at your fields' data types to make sure they meet your needs. For example, you may notice that text fields could be converted to picklists to enforce better data quality for your users.
SPF and DKIM Keys
If you send emails from Salesforce, you need to make sure you have SPF and DKIM keys set up for your org. Both Gmail and Yahoo increased spam filtering requirements in early 2024 to require both SPF and DKIM to send messages to their users. These are fairly easy to set up, but access to your Domain Name Service (DNS) settings and knowledge of setting up CNAME records is required. If you have an internal IT team it’s advised that they assist you with this process.
First, what are SPF and DKIM keys?
SPF stands for Sender Policy Framework. It allows you to verify that a third-party tool, such as Salesforce, can send emails from your domain on your behalf. Rather than emails sending out to customers from a salesforce.com email address you can set up Salesforce to send out emails from your unique domain. An SPF record verifies that Salesforce is authorized to send emails on your domain's behalf and helps prevent those emails from potentially hitting spam filters in your customers' inboxes.
DKIM stands for Domain Keys Identified Mail. DKIM is a supplemental security standard to SPF, which applies a digital signature to messages sent from a web service (in this case, Salesforce), and allows the receiving server to verify the identity of the sending service. DKIM keys sign an outbound email, and when received by another email domain, ensures that it hasn’t been tampered with during transit. If you want to ensure deliverability of emails to all customers, it’s recommended that you work with your IT team to set up a DKIM key.
Salesforce has excellent help articles on setting up SPF Records that we recommend you and your IT team refer to. They also have published a guide to setting up DKIM keys. We ran a PRO Tips article that puts it all together as well that you can refer to.
Report Clean-Up
Ever spent way too much time trying to figure out where that perfect report you build a year ago was saved in Salesforce or what you named it? We all have. During a Health Check we recommend that you spend some time working through and Cleaning up the reports in your Salesforce org.
- Clean-up Private Reports - Go into your private reports folder, and delete any one-off or junk reports that are no longer needed. Additionally, if you have any great reports that still live exclusively in your private folder, move them to a more appropriate folder.
- Look for unused/reports that have not been run in a long time.
- Go to the “All reports” folder.
- Click on the gear icon in the upper right corner (NOT the setup gear icon).
- Click “Select Fields to Display”.
- Add the “Report Last Run Date” field to Visible fields and click Save.
- Return to the “All Reports” page, and sort by Report Last Run Date. You can now view reports ordered by when they were last run, or if they were ever run.
- Work through your oldest run reports and determine if they are still needed.
- If the report is no longer needed or in use, it's recommended to either delete the report, or move it into a new or existing "Archive" folder.
- Organize your Report folders and folder sharing.
- Click on the “All Folders” Tab.
- Ensure that the reports in each folder make sense for their use and are well organized. If needed you can create sub folders to better segment your reports and provide a more streamlines experience
- Ensure folders are being shared with the correct individuals.
- Click on the down arrow to the right of a folder and click share.
- Assign or revoke access to report folders if necessary.
Verify Data Storage Limits
Salesforce limits both record data storage (records include Accounts, Contacts, Opportunities, and any custom object records) and file storage based on the number of user licenses in your org. Most orgs are provisioned with ten gigabytes of both record and file storage, plus an additional allowance for each licensed user. Ensuring that you do not exceed the storage limits may require development of a data archiving strategy, so it's a good idea to keep tabs on your usage. You can do that by:
- In Setup, search for and click on Company Information
- On the right side of the Organization details panel, look for and confirm your Data and File usage limits.
For data storage, Salesforce will show the objects that are consuming the most space. A good thing to remember about data storage is that the vast majority of object records consume two kilobytes of storage (there are some notable exceptions like email messages, which consume the actual message size, or Campaign Member records that consume only 1 KB).
For file storage, Salesforce will show the user(s) who have consumed the most space.
If you are at or over your storage limits, you will need to develop a plan for either cleaning up the existing data to reduce storage space used (such as offloading files/attachments stored on records and or backing up and deleting old or duplicate records) or purchasing more storage. The latter comes with additional costs, so making a plan is important.
Review API Limits
If you have integrations with third-party systems, you may be using Salesforce's Application Programming Interfaces (APIs), which have daily limits that reset every 24 hours and are based on the number of user licenses in your org. Examples here include REST or SOAP API, which can be used by applications like Okta, or to write custom code that integrates with Salesforce.
While it's somewhat uncommon to exceed these limits, doing so can cause painful issues–exceeding the limit for API calls in a 24 hour period causes all further calls to be rejected until you fall back under the limit. So, it's a good idea the keep an eye on your usage from time to time.
You can view API limits from the Company Information page we were just on. Review your API requests in comparison with your limits. If you are at or approaching your API request limits, further analysis may be necessary to identify the integrations that are consuming API calls, and further action may be required to correct the issue.
Conclusion
Congratulations! If you’re reading this, it means you’ve done your part to ensure that your Salesforce organization is in as healthy a state as possible. We perform similar health checks for clients on a quarterly maintenance basis to ensure that they're always in the know with what’s going on in their org, and recommend all admins adopt some form of these checks.
Stay tuned for our upcoming PRO Tips, where we will be taking a deeper dive into managing duplicate records in Salesforce! If you haven't already, make sure to check out our previous PROtips on Performing a Salesforce Security Review.