How to create a salesforce sandbox?

Sandboxes are always created from production — they’re a copy of it. You can’t create a sandbox from another sandbox (except for cloning, a slightly different operation).

Step-by-step

1. Log in to production as a System Administrator (or a user with the Manage Sandboxes permission).
2. Setup → Sandboxes (or Environments → Sandboxes in modern UI).
3. Click New Sandbox.
4. Name the sandbox. 10-character limit. The name becomes part of the URL (e.g. acme--uat.sandbox.my.salesforce.com). Keep it short and meaningful — Dev1, UAT, Train, Staging.
5. Description — free text for whoever inherits it later. Worth filling in.
6. Pick the sandbox type: Developer, Developer Pro, Partial Copy, or Full. Your edition’s licences govern how many of each you can have.
7. (Optional) Pick a sandbox template if it’s a Partial Copy or Full — defines which objects’ data is copied. Without a template, Partial Copy uses a default selection and Full copies everything.
8. (Optional) Apex Class — a class implementing SandboxPostCopy to run automatically after the copy completes. Use this to:
   • Reset email addresses on users (so test data doesn’t email real customers).
   • Re-point integration endpoints to a non-prod target.
   • Activate or deactivate triggers.
   • Seed test data.
9. Click Create. Salesforce queues the request.
10. Wait. Developer/Dev Pro sandboxes typically finish in minutes; Partial Copy in tens of minutes; Full Sandbox in hours (sometimes a day or two for huge orgs).
11. You receive an email when the sandbox is ready. The URL is test.salesforce.com and your username becomes [email protected].

Right after the sandbox is ready

A real-world checklist:

• Set Deliverability to System email only or All email (Setup → Email → Deliverability). The default for new sandboxes is No access — no emails sent. Configure deliberately.
• Update integration endpoints. Named Credentials, Remote Site Settings, custom callout URLs probably point at production by default after a Full refresh.
• Mask production PII if it’s Full / Partial. Salesforce Data Mask, a managed package, scrubs emails, names, phone numbers.
• Reset user passwords if needed — Salesforce sometimes randomises post-refresh.
• Re-authorise OAuth connections.
• Verify that scheduled Apex jobs that should NOT run in this sandbox are deactivated.
• Review the post-copy Apex ran successfully.

A note on cloning

Salesforce also supports sandbox cloning — create a new sandbox from an existing sandbox, not from production. This is useful when:

• You want a copy of your current dev environment to experiment in.
• You don’t want to wait for a full production refresh.
• The source sandbox has a useful state (test data, in-progress work) you want to preserve.

Cloning works only between sandboxes of the same or smaller type (e.g. clone a Full into another Full or a Partial Copy; can’t clone a Developer into a Full).

Permissions required

• Manage Sandboxes permission (system perm).
• Usually granted via the System Administrator profile or a dedicated permission set.

How long it takes

Plan refreshes around release windows. A Full refresh that takes 18 hours and lands the day before go-live is a recipe for a bad weekend.

Verified against: Salesforce Help — Create a Sandbox, Salesforce DX Developer Guide, Metadata API Developer Guide. Last reviewed 2026-05-17 for Spring ‘26 release.