If you sat a Salesforce admin interview two years ago and walked into one today, the questions have clearly shifted. Hiring managers still care whether you know your way around profiles and reports, but that’s the price of entry now, not what gets you hired. What they’re really testing in 2026 is whether you can run an org built for AI, keep it secure through a year of forced migrations, and automate at scale without breaking things.
The refreshed Platform Administrator exam added an Agentforce AI section and pushed Data & Analytics Management up to 17%, making it the largest single topic on the test. When the certification changes, interview questions follow.
This guide covers 50 Salesforce admin interview questions across eight categories. Each one includes an answer, the follow-up question, and a note on how deep to go for junior, mid, or senior roles.
Table of Contents
How to use this guide
Treat the categories as a study map, not a script. Reading answers back word-for-word is the fastest way to sound rehearsed, and interviewers can tell.
What lands well is thinking out loud. In a scenario question, ask clarifying things first. How many records? What’s the latency requirement? Who needs access and who doesn’t? Then walk through your reasoning and name the trade-offs. A candidate who says, “I’d use a screen flow here, but if volume climbs, I’d reconsider because of X,” sounds far more credible than one who just names the right feature.
Category 1: Security and Access (8 questions)
This is the most heavily tested area, so expect more than one scenario here.
Q1. Profiles, permission sets, and permission set groups. What’s the 2026 best practice?
Start with the model: give users a minimum-access baseline profile, then grant everything else through permission sets bundled into permission set groups. Show you’re current by mentioning that Salesforce paused enforcement of the planned “permissions on profiles” retirement, but the direction hasn’t changed. Profiles aren’t getting new enhancements, and the permission-set-led model is still what Salesforce recommends. Profiles still own login hours, IP ranges, default record types and apps, and page layout assignment.
Follow-up you’ll likely get: “How would you migrate a profile-heavy org?” Answer with an audit first, then User Access Policies to map users into the right permission sets and groups.
Q2. Explain OWD, the role hierarchy, and sharing rules.
Walk the layers from the bottom up. Org-wide defaults set the floor, the role hierarchy opens vertical access, and sharing rules handle the lateral cases that the hierarchy can’t.
Q3. A user can see records they shouldn’t. Walk me through debugging it.
This is a favorite because it tests method over memory. Go systematically: check object and field-level access first, then OWD, then the role hierarchy, then sharing rules, then any apex sharing or manual shares. Name the order, and you’ve already half-answered it.
Q4. What’s changing with MFA in 2026, and who’s affected?
There are two separate changes, and mixing them up is a giveaway. Standard MFA becomes enforced for all employee users in production starting around July 20, 2026, rolling out over roughly a month, per Salesforce Help. Separately, privileged users (anyone with System Administrator, Modify All Data, View All Data, Customize Application, or Author Apex) face a phishing-resistant MFA requirement, which means push notifications, authenticator apps, and SMS no longer qualify for them. Only built-in authenticators, hardware keys, and passkeys count.
Follow-up: “How would you roll that out without locking people out?” Talk about communication, a registration grace window, and testing in the sandbox first.
Q5 to Q8.
These include field-level security, profile settings retained after permission set changes, the transition from Connected Apps to External Client Apps (creating new Connected Apps is now disabled by default), and Salesforce Shield, a unified app covering Data Detect, Field Audit Trail, Platform Encryption, and Event Monitoring.
Category 2: Data management (6 questions)
Q9. Data Import Wizard versus Data Loader. When do you use each?
Import Wizard for simpler loads under 50,000 records with built-in duplicate prevention. Data Loader for larger volumes, scheduled jobs, or objects that the wizard doesn’t support.
Q10. How do you ensure data quality?
Don’t just say “keep it clean.” Name the mechanisms (duplicate and matching rules, validation rules) and then name how you’d measure success: field completeness on something like Account Industry or Opportunity Stage, your duplicate rate, your stale-record rate. Measurable beats vague every time.
Q11. How would you handle a “right to be forgotten” request across the org and Data 360?
This is a newer question worth knowing. Spring ’26 introduced Privacy Requests that can find and selectively delete a person’s records across both the Salesforce org and Data 360 in one flow, instead of you hunting through each system manually.
Q12 to Q14.
Record types versus page layouts versus Dynamic Forms; backup and restore strategy; and large data volume considerations like skinny tables and indexing. For the LDV question, seniors always put numbers on things.
Category 3: Automation and Flow (8 questions)
Now that the legacy tools are retired, this is the biggest single topic in most interviews.
Q15. Why is Flow the primary automation tool, and what are the trigger types?
Cover the trigger types: record-triggered (before and after save), schedule-triggered, screen, autolaunched, and platform-event-triggered. Add the practical detail that before-save updates on the same record are faster and use less processing, which signals you’ve actually built these.
Q16. How do you build a Flow that’s safe in bulk?
No DML or SOQL inside loops, use collection variables, tighten entry conditions so the flow only runs when it needs to, add fault paths, and respect governor limits. If you can explain why governor limits exist (resource fairness on a multi-tenant platform), even better.
Q17. What new Flow features in the 2026 releases can you name?
Showing you read release notes is a strong signal. From Spring ’26: collapsible Decision and Loop elements, AI-generated draft flows reaching general availability so you can describe a process in plain language and get a starting point, and record-triggered flows that can now fire on file changes. From Summer ’26: new date operators like Is Today and Is Tomorrow, collapsible fault paths, and batch-size controls on scheduled flows. Check the current release notes before your interview, since the rollout happens in waves.
Q18. Flow or Apex. When do you escalate to code?
KORE1 flags this exact question as a seniority test. The instinct they’re looking for is restraint. As Parker Harris has put it, just because you can write code doesn’t mean you should. Reach for Apex when you hit something declarative tools genuinely can’t do, like complex transaction control or callouts that need fine-grained handling.
Q19 to Q22.
Subflows and reusability; error handling patterns; choosing between scheduled and record-triggered; and how you’d replace a legacy Process Builder with a record-triggered flow.
Category 4: Agentforce and AI (7 questions)
This is the newest area and the clearest place where seniors separate from everyone else. Juniors can describe Agentforce. Seniors govern it.
Q23. What is Agentforce, and how does an admin set up an agent?
Agentforce is Salesforce’s platform for building AI agents that take actions, not just answer questions. You build in Agent Builder, which is low-code: define topics that scope what the agent handles, attach actions (a Flow, Apex, a prompt template, or an API call), write instructions and guardrails, set the channels it runs on, test it, and decide where it hands off to a human.
Q24. Explain topics, actions, and guardrails.
Topics are the jobs an agent handles, scoped by a classification description (which tells the agent when to use the topic), a scope statement, and instructions. Actions are what the agent can actually do within a topic, each one referencing a Flow, Apex, a prompt template, or a MuleSoft API. Guardrails aren’t a single setting but the combined effect of the topic’s scope, its instructions, and the Einstein Trust Layer, which adds protections like toxicity detection and PII masking. A useful detail to drop: Agentforce enforces hard limits of 15 topics per agent, 15 actions per topic, and 20 active agents per org, so part of good design is keeping topics focused and reaching for multi-agent setups when you outgrow those caps.
Q25. What permissions does an admin need for Agentforce, and how do users get access?
To manage agents, you need permissions like Manage Agentforce or Customize Application in your enabled permission sets. End users get access through a permission set group plus the relevant prompt template permissions. An important point is that each agent’s access is limited to a specific ‘permission set’. Without this, even the system administrator cannot use the agent.
Q26. How do you test an agent before go-live?
Agents are non-deterministic, so clicking through once doesn’t cut it. The Testing Center runs batch tests from a CSV (an utterance, the expected topic, the expected action) so you can check behavior at scale, and the conversation preview in Builder handles quick troubleshooting.
Q27. What is “Setup with Agentforce”?
An AI assistant inside Setup that helps with admin tasks like creating objects or troubleshooting why a user can’t see something. Two governance points matter: it respects the running user’s permissions rather than acting as a superuser, asks for confirmation before it changes anything, and logs every change to the Setup Audit Trail. It went generally available on May 26, 2026, so if you’re asked, you can note it requires Agentforce and Data 360 enabled in the org.
Q28 to Q29.
How Agentforce differs from earlier Einstein and Copilot features, and how guardrails reduce hallucinations and prompt injection. For both, seniors should stress least privilege, grounding answers in trusted data, and keeping a human in the loop for escalation.
Category 5: Data 360 (5 questions)
Data 360 is the rebrand of Data Cloud announced at Dreamforce 2025. It’s the data foundation that makes Agentforce accurate.
Q30. What is Data 360, and how does it differ from the CRM?
Data 360 is a real-time platform that ingests and unifies data from many sources into a single profile. The CRM holds your known, structured relationships. Data 360 pulls in everything else (web, mobile, external systems) and consolidates it into a single view, which grounds your agents so they work from an accurate context rather than guessing.
Q31. Explain data streams, DLOs, DMOs, and identity resolution.
Data streams bring data in. Data Lake Objects hold it in its raw shape. You map those into Data Model Objects that fit the standard model. Identity resolution rules then match and reconcile records into a unified profile. The detail that shows real understanding: every customer data stream needs a field mapped to an individual identifier, or identity resolution has nothing to work with.
Q32. What is zero-copy?
Querying data in Snowflake, Databricks, BigQuery, or Redshift directly, without copying it into Salesforce. Useful when duplication isn’t worth the cost or governance overhead.
Q33 to Q34.
How Data 360 grounds Agentforce, and how you’d surface Data 360 data on a CRM record. Nobody expects an admin to be a Data 360 architect, but you should understand the concepts and how they feed AI. Salesforce’s documentation is a good place to confirm current terminology, since this product has been renamed more than once.
Category 6: Reports and dashboards (5 questions)
Q35. Report types, dashboard components, and dynamic dashboards.
Cover what report types control (which objects and fields are available), the main component types, and when a dynamic dashboard beats a fixed running user.
Q36. A dashboard shows the wrong data. How do you troubleshoot?
Check the source report first, then the running user’s permissions, then the underlying data. Most “wrong dashboard” problems are really a running-user access issue.
Q37. What 2026 security change affects report exports?
A good current-events question. Salesforce is adding step-up authentication for large exports, prompting users to complete MFA before exporting more than 10,000 records. It runs separately from login MFA, as part of the wider 2026 security tightening. You can confirm the current thresholds and rollout dates in the Salesforce release notes, since enforcement happens in waves by instance.
Q38 to Q39.
Branding and themes on reports and dashboards, and the AI content summarizer component, which you can drop onto Lightning pages.
Category 7: Deployment and change management (4 questions)
Release management is where seniors really pull away from juniors.
Q40. Sandbox types and when to use each.
Developer and Developer Pro for building, Partial Copy for testing with a data sample, Full for staging and performance testing with production-scale data.
Q41. Change Sets, DevOps Center, or Git-based deployment. What are the trade-offs?
Change Sets are simple but manual and slow. DevOps Center adds version control without much overhead. Git-based pipelines scale best but need more setup and discipline. The senior signal: UAT in a sandbox, regression testing on critical flows, deploys outside business hours, and has a documented rollback plan.
Q42 and Q43.
What Hyperforce is (Salesforce running on public cloud infrastructure, enabling regional data residency and scale), and how you’d communicate a seasonal release to stakeholders and prepare the org for it.
Category 8: Scenario-based questions (7 questions)
This is the most common real-interview format. Think out loud, ask questions, and name your assumptions.
Q44. Design a secure Experience Cloud site for external customers.
Talk through the external sharing model, sharing sets, and guest user hardening, which is a known risk area.
Q45. Large-volume reporting is slow. How do you fix it?
Indexing, skinny tables, reducing the data scanned through filters, and considering whether the reporting should happen in a separate analytics layer.
Q46. Scope an Agentforce lead-qualification workflow.
Name the topics and actions, name the grounding data, and always include a human escalation path. An agent with no fallback is the classic red flag interviewers wait to hear.
Q47 to Q50.
Migrating a profile-heavy org to permission sets; a multi-currency or multi-language rollout; designing sharing for a matrix organization; and untangling a messy legacy automation by rebuilding it in Flow.
Common mistakes candidates make
A few patterns sink otherwise-strong candidates. Reciting definitions without ever naming a trade-off. Diving into a scenario without a single clarifying question. Talking like Process Builder is still around. Over-automating with no escalation path. Treating profiles and permission sets as interchangeable. And describing only tidy demo orgs instead of the broken, real-world messes you’ve actually fixed, which is what interviewers want to hear about.
How to prepare
Spin up a free Developer Edition org and turn on the Agentforce and Data 360 features so you’re not talking about them theoretically. Work through the Agentforce admin content on Trailhead. Read the latest Spring ’26 and Summer ’26 release notes. Build at least one agent end-to-end so you can speak from experience. Then rehearse the scenario questions out loud with someone, because saying it is different from knowing it.
Where is this all heading
A pattern is evident across every category here. The trend is shifting towards humans and agents working together, making AI governance a standard part of an administrator’s role. Permission-set-based security is becoming the default approach rather than just an advanced option. Furthermore, Salesforce is continuously tightening default settings, which is why migration will dominate the workload in 2026. If you bring that context into your answers, you’ll come across as someone who keeps track of where the platform is going.
Final Thoughts
The admin role expanded more than it got harder. If you can show real depth on security, build automation that holds up under load, and reason clearly about where AI belongs and where it doesn’t, you’ll do well in a 2026 interview. Study the categories, build things in a real org, and practice saying your answers out loud. People underestimate that last part, and it’s where a lot of easy points get left behind.
Frequently Asked Questions (FAQ)
They’re broader. The fundamentals are the same, but you’re now also expected to discuss Agentforce, Data 360, and the year’s security migrations.
For most roles, yes, at least conceptually. Knowing how agents are built and governed has become a real differentiator.
It’s the renamed Data Cloud, the platform that unifies data and grounds AI. Expect conceptual questions even if the role isn’t Data 360-specific.
Yes. With Workflow Rules and Process Builder retired, Flow is the declarative automation tool, so interviewers assume you know it well.
Ask clarifying questions first, think out loud, and name your trade-offs. The reasoning matters more than landing on one perfect answer.
The Platform Administrator credential remains the baseline, and now includes a more focus on Agentforce and data.
Priya Rastogi
Priya is a Salesforce Admin who believes in the power of continuous learning and collaboration. She’s passionate about exploring how Salesforce can simplify work, boost productivity, and create better user experiences. When she’s not experimenting with new features or automating processes, Priya enjoys connecting with fellow Trailblazers and sharing insights to help others grow in their Salesforce journey.
- Priya Rastogi
- Priya Rastogi
- Priya Rastogi
- Priya Rastogi
