Signs Your Salesforce Org Needs a Health Check

TL;DR: Your Salesforce org needs a health check when people stop trusting its reports, automation fires in ways nobody can explain, permissions have sprawled beyond what anyone can audit, or releases keep breaking things. In 2026 there is a new trigger as well: AI agents can now reach your org through APIs and MCP, so every weak setting your team once tolerated becomes something an agent can act on.

What is a Salesforce org health check?

A health check is a structured review of how your org is built and used: security settings, data model, automation, code, integrations and adoption. It ends in a ranked list of fixes, not a rebuild. It is lighter than a formal audit, which tests the org against a compliance standard. If an audit is what you actually face, start with our guide on how to prepare your Salesforce org for an audit.

What are the signs your Salesforce org needs a health check?

1. Nobody trusts the reports. Teams export to spreadsheets to re-check the numbers, or two dashboards disagree about the same pipeline.
2. Duplicates keep coming back. Clean-up projects fix the symptom and the duplicates return within a quarter, which points at intake rules and integrations, not at users.
3. Automation nobody remembers building. Flows, triggers and legacy workflow rules overlap on the same object and fire in an order nobody can explain.
4. Permissions have sprawled. Users hold powerful permissions granted for a one-off task, profiles have been cloned and patched for years, and no one can say who can export what.
5. Releases break things. Every deployment causes a regression, or the team avoids deploying at all.
6. Integrations fail silently. Data from ERP, billing or field systems arrives late or not at all, and someone finds out from a customer. Our article on Salesforce and SAP integration patterns for manufacturers covers designs that avoid this.
7. The people who built it have left. When the admin or partner who knew the org moves on, the undocumented decisions leave with them.
8. The business changed and the org did not. A merger, a new product line or a new team inheriting the org leaves configuration designed for a company that no longer exists.

One sign is a nuisance. Three or more usually share a root cause, and finding that root cause is where a health check pays for itself.

What is headless MCP, and why does it raise the stakes?

Salesforce is opening its platform to agents. At TDX on April 15, 2026 it launched Headless 360, which exposes data, workflows and governance controls as APIs, MCP tools and CLI commands, and Salesforce Hosted MCP Servers reached general availability the same month. Headless MCP simply means an agent works with your CRM through the Model Context Protocol instead of the browser.

That changes what an unhealthy org costs. A person stumbles over a loose permission set; an agent uses it at machine speed. Duplicate records confuse a rep; they lead an agent to a wrong answer delivered with full confidence. Tekunda was the first to run agent-to-agent (A2A) and SWARM orchestration in production, and is the first and only partner in headless CRM plus MCP, so we treat every health check as an agent-readiness check too. For the access side, read how to keep a Salesforce org secure as your team scales.

Can a health check help calculate the ROI of Agentforce?

Yes, because it supplies the inputs calculators leave out. Salesforce's own Agentforce ROI calculator estimates three-year benefits and the Flex Credits a use case may need, but it states that Salesforce licences, Data 360 credit costs and implementation costs are not included, and that results are illustrative only. A health check measures how much data clean-up, permission work and automation consolidation stand between you and a working agent. That is the implementation figure the calculator expects you to bring yourself.

Data 360, the platform formerly called Data Cloud, was renamed at Dreamforce 2025 as the data foundation for Agentforce, so its readiness belongs in the same review.

What can you check yourself first?

• Salesforce Health Check. In Setup, search Quick Find for Health Check. It scores your security settings from 0 to 100 against the Salesforce baseline, called Standard Values, and regulated teams can import a custom baseline. Salesforce warns that the Fix Risks button changes every flagged setting at once and can break integrations or remove access, so test in a sandbox and change settings one at a time.
• Org Check. Salesforce Optimizer has been retired: access was removed in the Winter '26 upgrade for Hyperforce orgs and in Spring '26 for the rest. The free Org Check app from Salesforce Labs covers metadata quality, security and automation, but it is not an official Salesforce product and has no Salesforce Support.

Both tools tell you what is misconfigured. Neither tells you why the org drifted, which fixes matter most to the business, or what has to change before agents arrive. That judgement is the health check.

What should a health check deliver?

• A ranked findings list tied to business impact, not a raw export.
• An access map showing who can see, edit and export which data.
• An automation inventory per object, with overlaps flagged.
• A data quality baseline you can re-measure next quarter.
• A roadmap that separates quick wins from structural work.

If you sell on AppExchange, add security review readiness to the scope; a Salesforce PDO can run that alongside the org review. Tekunda is a certified Salesforce SI, ISV, PDO and Agentforce partner, and the goal is always to get more from the Salesforce you already run, never to cut it back. See how we engage to scope a health check for your org.

FAQ

How often should a Salesforce org get a health check?

At least once a year is a common rule of thumb. Run one again after a merger, a major platform change or a new team taking over the org.

Is Salesforce Health Check the same as an org health check?

No. Salesforce Health Check scores security settings only. An org health check also covers data, automation, code, integrations and adoption.

Is Salesforce Optimizer still available?

No. It was retired across Winter '26 and Spring '26, and Salesforce Labs' free Org Check app is the usual replacement.

Does a health check mean cutting Salesforce licences?

No. The aim is to get more value from the platform you already pay for and to prepare it for what comes next, including Agentforce.