Let’s start with an example where Tecnovators has 5,000 Salesforce Enterprise Edition licenses, and they have only one system administrator. The system administrator receives ample requests to reset the password, change login hours, unlock users, or change their sharing settings daily. To reduce this, the system administrator can go ahead and set up a delegated administrator, so that any other user who is a delegated administrator can help with the workload.
The delegated administrator is a concept that extends certain admin privileges to non-admin users in order to allow them to perform admin functions. The actions that delegated administrators can perform include the following:
User administration: For the named roles and their entire subordinate roles, delegated administrators can create and edit users and reset passwords, as well as unlock users in named roles. Delegated users can also log in as users who have granted login access to their administrator. They can also do quota settings, create default teams, and create personal groups.
Assignable profiles: The delegated administrators can assign only the profiles granted to the delegated administrator.
Custom object administration: Access can be granted to delegated administrators to serve as administrators for certain custom objects and their associated tabs only.
Setting up a delegated administration
To set up a delegated administration for your organization, follow these steps:
- Navigate to Setup | Administer | Security Controls | Delegated Administration.
- Click on New as shown in the following screenshot:
- It will redirect you to a New Delegated Group window, where you have to enter data in the Delegated Group Name field as well as optionally select the Enable Group for Login Access checkbox. The details of each field are as follows:
Delegated Group Name: This specifies the group name.
Enable Group for Login Access: This option is selected if you want to allow the delegated administrator to log in as a user belonging to the role hierarchy that they manage.
- Click on Save; this will redirect you to the Delegated Group Detail page. This will look like the following screenshot:
- After creating the delegated user group, you have to do a few tasks, defined as follows:
Delegated administrators: You can add users to this group who are a part of the delegated administrator group. To do this, click on the Add button available on the list related to Delegated Administrator; it will redirect you to a new page and add users (click on the magnifying glass icon) as per your business requirement. Once done, click on Save:
User Administration: Now, you have to specify the roles and subordinates that the delegated administrators can create and edit. To do this, click on the Add button available in the list related to Role Administrator; this will redirect you to a new page and add a role (click on the magnifying glass icon) as per your business requirement. Once done, click on Save:
Assignable Profiles: Here, you can specify the profiles of the delegated administrators of this group and these can be assigned to the users they create or update. To do this, click on the Add button available on the list related to Assignable Profiles; this will redirect you to a new page and add assignable profiles as per your business requirement. Once done, click on Save:
Delegated administrators cannot assign profiles with the permission Modify All Data, such as system administrator profiles.
Custom Object Administration: In this section, you can specify the custom objects that the delegated administrators of a group can administer. To do this, click on the Add button found on the list related to Custom Object Administration; it will redirect you to a new page, and here, you can add custom objects (click on the magnifying glass icon) as per your business requirement. Once done, click on Save:
Now, you are done with the delegated administrator settings. You can change these settings any time by navigating to Setup | Administer | Security Controls |Delegated Administration.
These changes are captured under View Setup Audit Trail. If you need to check the Audit Trail for these changes, navigate to Setup | Administer | Security Controls |View Setup Audit Trail. Finally, our delegated administrator page will look like the following screenshot:
Share with us in the comments section below. And to upgrade your Salesforce Org with latest features and updates, Talk to our team at Tecnovators, a one-of-a-kind Salesforce consulting partner delivering pay-as-you-use On demand services for Salesforce.
Also, you can give us a call at 313-209-7137 or email us at info@tecnovators.com