Setup Wizard

The setup wizard launches automatically when you first open OrgGuard. It guides you through initial configuration in 7 steps (~5 minutes).

Tip

If you exit the wizard mid-flow, your progress is saved. Reopen the OrgGuard app to resume where you left off.

Where to find it after install

You don’t have to wait for the auto-launch — and you can re-open the wizard any time after the initial run.

1. Open the OrgGuard app from the App Launcher.
2. Click the Setup tab (it’s the last tab in the navigation bar, after Notifications).
3. The wizard renders inline on the Setup tab page; pick up at whichever step you left off, or re-run from the start.

Admin-only

The Setup tab is visible only to users assigned the OrgGuard_Admin permission set. The OrgGuard_User and OrgGuard_Auditor permsets do not see it — by design, since the wizard configures org-wide policies, schedules, and notification routing.

Tier behavior at a glance

OrgGuard’s setup wizard adapts to the tier the running org resolves to. Three of the seven steps configure Pro-only features — on Free tier they render an Upgrade to OrgGuard Pro panel with a Skip for now button instead of the configuration form, so a Free admin can still complete onboarding in seven steps.

Step	Free	Pro / Pro+ / Max
1 — Welcome	Runs normally	Runs normally
2 — Permissions	Runs normally	Runs normally
3 — Configure Default Policies	Upgrade panel + Skip for now	Runs normally
4 — Schedule Discovery	Upgrade panel + Skip for now	Runs normally
5 — Email Notifications	Upgrade panel + Skip for now	Runs normally
6 — Initial Scan	Runs (throttled — one scan per 7 days)	Runs (no throttle)
7 — Setup Complete	Runs normally	Runs normally

Free tier provides asset inventory, basic discovery, coverage summary, and CSV export — all served from the Dashboard after the initial scan. Upgrade to Pro to unlock policy alerts, email notifications, and a daily scan cadence.

Step 1: Welcome

Overview of what OrgGuard does and what the wizard will configure. Click Next to begin.

Switch to Pro (beta testers only)

If your org is a sandbox, Developer Edition, or scratch org, you’re running OrgGuard before the beta program’s GA cutoff, AND your org is currently on Free tier, the Welcome step shows a Switch to Pro button at the top:

1. Click Switch to Pro.
2. The wizard re-renders with Pro features unlocked — Steps 3/4/5 now show the configuration forms.
3. Continue to Step 2.

Sandbox-only by design

The Switch to Pro control is invisible in production orgs. It writes the OrgGuard_DevMode__c.Override_Tier__c custom setting, which OrgGuard’s tier resolver honors only in sandbox/DE/scratch orgs and only before the beta cutoff. A production OrgGuard Free customer who somehow reaches the same button-click code path is refused server-side with a clear message — production tier changes are granted only via your OrgGuard license in the Salesforce LMA.

Already on Pro/Pro+/Max?

If your org is already on a paid tier (LMA-granted or DevMode override), the Welcome step shows a green confirmation strip — for example, “Pro features active for this org (beta)” — instead of the Switch to Pro button. No action needed.

Step 2: Permissions Check

OrgGuard validates that your user has the required system permissions:

• API Enabled — Your user profile must have the “API Enabled” permission. Required for OrgGuard discovery scans to query your org’s configuration. If this check fails, ask your Salesforce administrator to enable “API Enabled” on your profile.
• OrgGuard Admin Permission Set — Required for full admin functionality and object-level access to OrgGuard records.

If any critical permission is missing, the wizard blocks until resolved. Optional permissions show a warning but allow you to continue.

Step 3: Default Policies

OrgGuard creates four default governance policies:

Policy	What It Detects	Default Windows
Certificate Expiry Warning	Certificates expiring soon	90 days (Informational), 60 (Low), 30 (Medium), 15 (High), 7 (Critical), 1 (Critical)
Missing Asset Owner — Certificates	Certificates with no assigned owner	Immediate
Governance Accountability — Auth Assets	Connected Apps, Auth Providers, and Named/External Credentials with no assigned owner	Immediate
Unknown Expiry Date	Certificates where the expiration date cannot be determined	Immediate

The seeded Certificate Expiry Warning policy raises a finding at each window above, with severity escalating as expiry approaches. You can customize the expiry windows and admin notification email on this step. Policies can be modified later from the Policy Management page.

Note

When you create a brand-new blank policy from the Policy Management page, the form pre-fills a different starter set of windows (90, 60, 30, 14). The values shown above are the windows of the seeded Certificate Expiry Warning policy.

Two more policies are seeded at install — not in this wizard step

Before the wizard runs, the OrgGuardPostInstall install handler also seeds two Scheduled Job Health policies — Inactive Job Owner and Job Failure Threshold. They appear in your Policies list alongside the four above, but they are not configurable from this wizard step. Edit them from the Policy Management page.

Step 4: Discovery Schedule

Configure when OrgGuard scans your org for auth assets:

• Daily (recommended) — Runs at 2:00 AM by default
• Weekly — Runs on a specific day of the week
• Custom — Enter a custom cron expression

The schedule can be changed later. Scans typically complete in 1-5 minutes for orgs with fewer than 500 assets.

Step 5: Email Notifications

Configure notification settings:

• Admin Group Email — Email address(es) that receive admin-level alerts (e.g., critical expiry warnings)
• Org-Wide Email Address (recommended) — The verified “from” address for OrgGuard notifications. When set, every alert is sent on behalf of this address instead of whichever user happens to own the scheduled job.
• Test Email — Send a test notification to your own login address to verify delivery. The test uses the same sender path as real notifications, so if the test message arrives in your inbox, real alerts will too.

Choosing a sender address

We strongly recommend selecting an Org-Wide Email Address (OWEA) for two reasons:

1. Deliverability — Gmail, Microsoft 365, and most modern mail systems flag messages where the sending host (Salesforce) and the From-domain don’t align under DKIM. A verified OWEA on a domain you control lets you DKIM-sign outbound mail and stop your alerts from landing in spam or carrying a “couldn’t verify this message” warning.
2. Continuity — Without an OWEA, alerts are sent on behalf of whichever user scheduled the notification job. If that user leaves the org or has their license deactivated, alerts stop. An OWEA decouples notifications from any individual.

If the picker is empty or doesn’t list the address you want, create one in Salesforce Setup first, then return to this step.

Pair the OWEA with DKIM for full deliverability

Selecting an OWEA gets you a stable, branded From address — but Gmail and Workspace will still flag the message as unverified unless your domain is DKIM-signed by Salesforce.

After picking the OWEA, set up DKIM on the OWEA’s domain:

1. Setup → Email → DKIM Keys → Create New Key
2. Use the OWEA’s domain (e.g. notifications.example.com or the parent domain example.com)
3. Add the two CNAME records Salesforce gives you to your DNS
4. Wait ~1 hour for DNS propagation, then activate the key in Salesforce

Once activated, OrgGuard alerts arrive with d=yourdomain DKIM signatures and Gmail’s “couldn’t verify” warning disappears.

Caution

Email deliverability must be set to “All Email” in Setup → Email → Deliverability for notifications to work, regardless of OWEA selection. New sandboxes and scratch orgs default to a more restrictive setting.

Step 6: Initial Scan

Run your first discovery scan to populate the asset inventory:

• Click Start Scan to begin
• A spinner with a status message and progress bar indicates the scan is running (“This may take a few minutes depending on the size of your org”)
• When complete, you’ll see counts of: assets discovered, findings created, notifications sent
• You can skip this step and run a scan later from the Scan Run History page

Step 7: Setup Complete

Review your configuration summary and explore next steps:

• Go to Dashboard — View your asset inventory metrics
• View Findings — See any governance issues detected
• Manage Policies — Customize policy rules

See OrgGuard’s core value in 30 seconds

After your first scan completes, open any certificate from the dashboard and click the Blast Radius tab. This shows which Named Credentials, the Identity Provider, SAML SSO configs, Outbound Messages, and Connected-App JWT bearer flows depend on that certificate. Knowing what breaks before a cert expires is OrgGuard’s most powerful capability. See the full guide: Certificate Dependencies.

Troubleshooting

Symptom	Likely cause	Fix
Step 3 shows the Upgrade to OrgGuard Pro panel, not the policy form	Your org is on Free tier (LMA Feature Parameters not set to a paid tier, no DevMode override).	Either upgrade to Pro via your OrgGuard license, or — if this is a sandbox/DE/scratch org — go back to Step 1 and click Switch to Pro.
Step 3 toast: “Failed to create default policies: Script-thrown exception”	Outdated package version. OrgGuard 0.1.0-10 and earlier surfaced this cryptic error on Free tier instead of the upgrade panel.	Reinstall the latest OrgGuard beta package; the upgrade panel + Skip flow replaces the error. If you must stay on the older version, set the DevMode override before running the wizard — open Setup → Developer Console → Debug → Open Execute Anonymous and run: orgguard__OrgGuard_DevMode__c s = orgguard__OrgGuard_DevMode__c.getOrgDefaults(); if (s.Id == null) { s = new orgguard__OrgGuard_DevMode__c(SetupOwnerId = UserInfo.getOrganizationId()); } s.orgguard__Override_Tier__c = 'Pro'; upsert s; Then re-run the wizard.
Switch to Pro button is missing from the Welcome step	Either you’re in a production org (sandbox-only by design) or after the beta cutoff date.	Production upgrades go through the LMA (license-managed). Contact OrgGuard support for a Pro license.
Switch to Pro click toast: “…only available in sandbox orgs…”	The server-side guard refused the write because the org doesn’t pass both gates (sandbox AND pre-cutoff).	Same as above — this is the protection layer working as designed. Production upgrades come through the LMA.
Tier didn’t change after Switch to Pro	The page cached the previous tier descriptor.	Refresh the page or reopen the OrgGuard app. The wizard re-pulls the descriptor on next render.

FAQ

Why does the wizard let me skip Steps 3/4/5? Those steps configure Pro-tier features (policy engine, daily schedule, email notifications). On Free tier they’re not available, but you can still complete onboarding and use the Dashboard, inventory, coverage, and CSV export. Upgrade to Pro to enable the skipped features later from their dedicated pages.

If I skip Steps 3 and 5, do I still get any alerts on Free? No. Free tier is inventory-only — it discovers assets and shows them in the Dashboard, but doesn’t evaluate policies or send notifications. Upgrade to Pro to enable governance alerts.

Can a production customer use the Switch to Pro button to upgrade? No, by design. The button is invisible in production, and even if reached through code, the server-side guard refuses the write. Production upgrades are granted via your OrgGuard license through Aetrum’s LMA — contact OrgGuard support.

I upgraded via LMA but the wizard still shows Free. Tier resolution caches per transaction. Sign out, sign back in (or reload the page) and the wizard’s descriptor will reflect the new tier on next render.

Re-running the Setup Wizard

The wizard only appears automatically on first launch or if setup is incomplete. To re-run it:

1. Go to Setup > Custom Settings > OrgGuard Setup > Manage
2. Set Is_Complete__c to false
3. Reopen the OrgGuard app