Who Changed Production? Salesforce Setup Changes in Slack, Teams or Google Chat

Your deployments go through a pipeline. Pull requests, reviews, a green build. And then on a Tuesday afternoon somebody ticks one checkbox on a profile directly in production, because it was urgent and it was only one checkbox. Salesforce wrote that down the moment it happened. The question is whether anyone on your team will read it before it matters.

What Salesforce already records

Every change made in Setup lands in the Setup Audit Trail: profiles and permission sets, users, flows, fields, connected apps, security settings, sharing, login policies. Each entry has who made it, when, which Setup section it belongs to, and a sentence describing the change. If the change was made while logged in as another user, the entry carries that too.

In other words, the answer to "who changed production?" already exists in your org. The page in Setup shows only the 20 most recent entries, and the rest sits in a 180-day download that someone has to open, filter and read.

Why nobody reads it

• You have to go there. Nothing tells you an entry appeared. The trail is read after an incident, to find out what happened, not before it.
• Deployments drown it. A single release run by your CI/CD user can write hundreds of entries. The one manual change from a colleague sits somewhere between them.
• One operation is many lines. Configuring one connected app writes a separate entry for each setting. Reading the raw trail means reassembling operations in your head.

So the information is complete and almost nobody uses it. The cost shows up later, as the morning a team spends asking "what changed?" while something in production is broken.

What finding out late costs

• Incidents take longer than the fix. Deactivating a bad validation rule takes seconds. Finding out that it exists, and who added it, takes hours.
• Access creeps. A permission granted "for an hour" to debug something stays for months, until the yearly access review, if there is one.
• Releases undo hotfixes. A fix made directly in production is not in your repository, so the next deployment quietly brings the old problem back.
• Audits get uncomfortable. "How do you monitor changes to production?" is a standard question in SOC 2, ISO 27001 and internal audits. "We could look it up" is not a strong answer.

Why a quick script is not the answer

Some teams try to close the gap with a home-grown job that posts the trail to a channel. It tends to go the same way: the channel fills with deployment noise and people mute it, operations arrive as dozens of unrelated lines, a token quoted in an audit entry ends up in chat, and one day the job stops and nobody notices, because a quiet channel looks exactly like a quiet org. Then the person who wrote it changes teams.

The value is not in fetching the data. It is in delivering a message people actually read, every day, for years, without anyone maintaining it.

How Org Radar does it

Org Radar is a native Salesforce app built for exactly this. You install it, connect your Slack, Microsoft Teams or Google Chat, pick the admins to track and choose a schedule. From then on your team gets a short, readable digest of what changed in production.

• Only people, not pipelines. Changes from the admins you track, without the deployment noise.
• One operation, one item. Related entries are grouped into a numbered list, so a change reads like a change.
• The risky ones stand out. Users, permissions and security settings are marked by severity, and each channel can have its own.
• Safe to post. Tokens and secrets quoted in audit entries are masked before anything leaves the org.
• Silence means silence. When nothing changed, a heartbeat says so, and changes to who is tracked are announced on every channel.
• Inside your org. No server of ours in the middle. Messages go from your Salesforce straight to your own chat, which tends to make the conversation with your security team much shorter.

It is a deliberately focused tool. It does not replace your DevOps platform. It answers one question, every day, where your team will see it: who changed production, and what did they change?

Try it in your org

Org Radar installs in production or in a sandbox. We set it up with you on a short call, and the channel preview shows what your last 24 hours would have looked like before the first message goes out.