How to Export Salesforce Metadata for an Org Audit (Step-by-Step)

Before you can audit your Salesforce org, you need its metadata. Every field, flow, profile, permission set, automation rule, and custom object exists as metadata — and you need a copy of it to find the problems hiding in your configuration.

This guide walks you through three ways to export your Salesforce metadata, from simplest to most full-featured. Choose the method that matches your comfort level and access.

Need the audit done for you? Upload your metadata to OrgPilot and get a complete health assessment in 60 seconds.

---

What is Salesforce Metadata?

Metadata is everything in your Salesforce org that isn't the actual data in your records. Think of it as the "configuration layer" — the structure, rules, and permissions that govern how your org behaves.

When auditors talk about "running a Salesforce org audit," they mean analyzing your metadata to find configuration risks, technical debt, and compliance gaps. You can't do that without a metadata export.

Related: See the complete 18-point audit checklist for what to check once you have your export.

---

Method 1: Salesforce Setup UI (Easiest)

If you have System Administrator access and just need a quick look at one or two things, Salesforce's Setup UI can export certain metadata types directly.

When to use Method 1:

✓ Quick spot-check on a single object or profile
✓ When you can't install any tools or extensions
✓ Exporting a few specific items to share with a consultant

---

Method 2: Salesforce Workbench (No Setup Required)

Salesforce Workbench is a web-based tool that lets you query and retrieve your metadata using Salesforce's API — without installing anything.

Sample package.xml for full org export:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>*</members>
        <name>ApexClass</name>
    </types>
    <types>
        <members>*</members>
        <name>CustomField</name>
    </types>
    <types>
        <members>*</members>
        <name>Flow</name>
    </types>
    <types>
        <members>*</members>
        <name>PermissionSet</name>
    </types>
    <types>
        <members>*</members>
        <name>Profile</name>
    </types>
    <types>
        <members>*</members>
        <name>ValidationRule</name>
    </types>
    <types>
        <members>*</members>
        <name>WorkflowRule</name>
    </types>
    <version>60.0</version>
</Package>

Replace the types with whatever you need. The * wildcard retrieves all items of that type. For a full audit, include CustomObject, CustomField, Flow, Profile, PermissionSet, ApexClass, ValidationRule, WorkflowRule, and SharingRules.

When to use Method 2:

✓ You want a manual export without installing tools
✓ You're comfortable with the API and XML
✓ Need metadata from a specific subset of components

---

Method 3: VS Code + Salesforce CLI (Recommended)

The most powerful and reproducible method uses Visual Studio Code with the Salesforce Extensions and Salesforce CLI. This is how professional admins and developers export metadata for audits.

Step-by-step:

1. Authenticate to your org:
   sf force:auth:web:login -d -a MyOrg
   This opens a browser window. Log in and approve.
2. Create a project:
   sf project create -n my-audit-project
3. Retrieve metadata:
   Create a package.xml in your project's root (use the sample from Method 2 above), then run:
   sf force:source:retrieve -x package.xml
4. Or retrieve everything:
   If you want the full org without specifying types:
   sf force:source:retrieve -m BundleName -o MyOrg
   Where BundleName is CustomObject, CustomField, Flow, Profile, PermissionSet, etc.
5. Your metadata is now local:
   The retrieved files live in the force-app/main/default/ folder. Each component type gets its own subfolder. You can open, search, and analyze these files with any text editor or IDE.

When to use Method 3:

✓ Full org audit with complete metadata coverage
✓ You want to use VS Code's search and navigation tools
✓ Need reproducible, scriptable exports for regular audits
✓ You'll connect to OrgPilot for automated analysis

---

What to Do After Exporting

Congratulations — you now have a complete picture of your Salesforce org's configuration. Here's what comes next:

---

Summary: Which Method Should You Use?

Method	Best For	Complexity
Setup UI	Single-component spot checks	⭐ Low
Workbench	Quick exports without installing tools	⭐⭐ Medium
VS Code + CLI	Full org audits, automation, OrgPilot integration	⭐⭐⭐ Higher

If you're serious about understanding your org's health — and especially if you're preparing for a compliance audit, migration, or cleanup project — Method 3 with VS Code gives you the most complete export. Then upload it to OrgPilot and get your audit results in under a minute.

Already have your export? Run your free audit now →