# Salesforce Selective Sync Not Working Without Modify All Data

**URL:** <https://community.hubspot.com/t/salesforce-selective-sync-not-working-without-modify-all-data/135928>\
**Category:** HubSpot-built Apps\
**Tags:** companies\
**Created:** [July 9, 2025, 3:41pm UTC](https://community.hubspot.com/t/salesforce-selective-sync-not-working-without-modify-all-data/135928 "2025-07-09T15:41:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RSummo](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@RSummo](https://community.hubspot.com/u/RSummo)\
**Post date:** [July 9, 2025, 3:41pm UTC](https://community.hubspot.com/t/salesforce-selective-sync-not-working-without-modify-all-data/135928/1 "2025-07-09T15:41:27Z")

</div>

When going throuhg Selective Sync article ([Salesforce Selective Sync](https://www.hubspot.com/salesforce-selective-sync)), it mentions that cloning the System Administrator profile in Salesforce is the best approach. The article HubSpot has available instruct to remove “Modify All” from the object level, create a profile, role, and sharing rules. But when cloning the System Administrator, “Modify All Data” is already enabled under System Permissions. The article does not mention removing that, which makes all the steps listed pointless. “Mofiy All Data” overrides all permissions and sharing rules.

When I sync, all the Accounts and Contacts comes to HubSpot. If I try to create a new profile or remove “Modify All Data”, no records are synced.

Any ideas out there?

Thank you!

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [July 10, 2025, 5:09pm UTC](https://community.hubspot.com/t/salesforce-selective-sync-not-working-without-modify-all-data/135928/2 "2025-07-10T17:09:31Z")

</div>

Hey @RSummo 👋 I moved this over to the Apps section so you’ll hopefully get more eyes on it — Jaycee

---

<div class="post-metadata">

**Author:** ![RubenBurdin](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/rubenburdin/32/75212_2.png) [@RubenBurdin](https://community.hubspot.com/u/RubenBurdin)\
**Post date:** [September 3, 2025, 8:48pm UTC](https://community.hubspot.com/t/salesforce-selective-sync-not-working-without-modify-all-data/135928/3 "2025-09-03T20:48:51Z")

</div>

I see the confusion here, @RSummo . You’ve spotted something real: in Salesforce, “Modify All Data” is a system-level permission that overrides object-level sharing and makes all the careful steps in HubSpot’s selective sync guide useless if it stays on. That’s why you see all Accounts and Contacts flowing into HubSpot whenever that permission is active.

The missing detail is that for selective sync to work, the Salesforce integration user must have **read access only through sharing rules** , not through “Modify All Data.” So the right path is: clone the System Admin profile, **remove the “Modify All Data” permission from the cloned profile** , and then assign that new profile to your integration user.

After that, create sharing rules that expose only the Accounts/Contacts you want HubSpot to see. If you skip removing “Modify All Data,” the sync user sees everything, and HubSpot respects that. HubSpot’s article on selective sync explains the principle but doesn’t highlight this system-level override clearly

([Connect HubSpot and Salesforce](https://knowledge.hubspot.com/salesforce/install-the-hubspot-salesforce-integration) )

If you’ve tried removing “Modify All Data” and then nothing syncs, that usually means your sharing rules aren’t actually granting access to any records for the integration user. Double-check whether those rules are assigned to the correct role or public group, and that the user really sits in the right spot in the role hierarchy

([https://help.salesforce.com/s/articleView?id=platform.security\_sharing\_owd\_about.htm&type=5](https://help.salesforce.com/s/articleView?id=platform.security_sharing_owd_about.htm&type=5) )

A quick test is to log in as that integration user and see if they can view the intended records inside Salesforce itself HubSpot will only sync what that user can see.

If consistency between Salesforce visibility rules and HubSpot is business-critical, Stacksync can help. It keeps Salesforce and HubSpot mirrored in real time, without depending on these permission edge cases, so you can enforce true selective visibility without brittle workarounds.