In a big organization, a single admin can a big problem in terms of bandwidth issues. Normally admins are getting multiple requests like – creating users, updating profiles, resetting the password, running report etc. along with their daily meetings. So it will be really difficult for a single admin to handle all these requests by himself/herself. And that is the place where admins want to delegate some of their work to others (trusted colleagues). But trust me, it is a big decision. You should not give all the admin privilege to your colleagues even though he/she is a very trusted employee. Rather you should delegate few specific task to your colleagues. In Salesforce, we can do the same with DELEGATE ADMINISTRATION.
So basically Delegate Administrator will allow named users to manage other users within selected roles and profiles, as well as managed selected custom objects.
With Delegate Administration, you can configure named users to do the below things –
- Role & Subordinate: Delegate Administrator can create and edit users with specific roles and subordinates. The can’t modify the role hierarchy though.
- Profile: Delegate Administrator can assign users(they create or edit) to assigned profiles. They can’t modify the profile.
- Permission Set: Delegate Administrator can add/remove selected permission sets from users(they create or edit) to assigned profiles. They can’t modify the permission set.
- Public Group: Delegate Administrator can add/remove selected public groups from users(they create or edit) to assigned profiles. They can’t modify the public group.
- Custom Object: Delegate Administrator can manage every aspect of the selected custom objects except object’s permission on profiles. Delegate Admin can’t create or modify relationship on the objects or set org-side sharing defaults.
- Enable Login Access: Delegate Administrator can login in as a user belonging to the role hierarchy that they manage.
- Unlock and Freeze User.
I have two users in my Org – Administrator (Sudipta Deb) and Non-Administrator(Mario Ruiz). I want to mark Mario as Delegate Administrator so that he can take care of creating/editing users with Profile – “Recruiter” or with the role – “VP, North America Sales”. At the same time, I would like to make sure he can take some of the request related to custom objects – Position, Job Application, Employment Website, Job Posting.
- Open Delegate Administration: Click on Setup | Administer | Security Controls | Delegate Administration.
- Click on New
- Put the below details as shown in the picture –
- In the next page, under “User Administration“, select the role – “VP, North America Sales” like shown below –
- In the next page, under “Assignable Profiles“, select the profile- “Recruiter” like shown below
- In the next page, under “Custom Object Administration“, select the objects – “Position, Job Application, Employment Website, Job Posting” like shown below –
- Add the user “Mario Ruiz“ under “Delegated Administrator”
- Finally, it will look like –
- Can’t assign profiles or permission sets with “Modify All Data” permission.
- The -None- option will not be available when selecting roles for new users.
- For formula fields, accessing merge fields from another object requires delegate admin’s permission on that object.
- Can’t modify permission sets.
- Standard Objects are excluded from Delegated Administration. We have a Salesforce Idea open for this – https://success.salesforce.com/ideaView?id=08730000000BptIAAS
- Another Salesforce Idea worth mentioning here is – Allowing Non-Admin users to import custom objects – https://success.salesforce.com/ideaView?id=08730000000Bre6
- For security, profiles with the “Modify All Data” permission cannot be included under “Assignable Profiles“. See the error when attempting to include the System Administrator profile.
- Delegate Admin can change the FLS for existing and newly created fields for those objects which are assigned to him/her. But Delegate Admin can’t change the Object Level Permission on Profile.