Things to know about Delegated Administration in Salesforce.

 

What is Delegated Administration?

Imagine a company where different teams need different levels of access to data and tools. You wouldn’t want a Marketing manager to have full access to sensitive HR data, right? At the same time, you want to make sure that the right people can manage the right parts of the system without needing to be Salesforce experts or have full administrative privileges. This is where Delegated Administration comes in.

In Salesforce, Delegated Administration allows an organization to grant specific users limited administrative capabilities without giving them full access to all of Salesforce's settings. This is perfect for organizations that need certain users to manage specific functions like user permissions, profiles, or certain objects, but don't want them to have the power to make wide-ranging system changes.

Real-Life Example:

Let’s say your company has different departments like Sales, Customer Support, and HR. You might need someone in the Sales team to manage user permissions for their team members—such as adding new Sales reps or changing their roles—but you don’t want them to have access to all of Salesforce, especially sensitive information in HR or Finance.

By using Delegated Administration, you can empower that Sales manager to perform necessary admin tasks for their team, without risking exposure to sensitive data or having too much control over the entire system.

Key Uses of Delegated Administration

1. User Management:

   • A delegated admin can be allowed to create, modify, and deactivate users within a specific set of profiles or roles. For example, a Sales Manager might be given the ability to create new Sales users and assign them to the Sales team.

2. Profile and Permission Set Management:

   • A delegated admin can assign permission sets and update profiles for users within a specific group or department. For example, a delegated admin in the Support department could assign the necessary permission set to Support agents to allow them to access case records.

3. Managing Public Groups:

   • A delegated admin can be given access to create and manage public groups within the organization. Public groups help with sharing data, creating reports, and ensuring the right people have access to the right information.

4. Customizing Some Objects:

   • For certain objects (like custom objects), you can delegate limited administrative tasks such as managing the object's field-level security or visibility settings. This could be useful in a department with custom data or processes that should remain private but still need management oversight.

Best Practices for Using Delegated Administration

1. Limit Permissions to the Minimum Required:

   • Always follow the Principle of Least Privilege, which means giving users only the permissions they need to perform their job functions, and no more.

   • Example: Only allow the Sales Manager to manage Sales users, not HR or Finance users.

2. Review Delegated Admins Regularly:

   • Periodically audit and review who has delegated admin rights to ensure that only the right people have them. If an employee leaves the company or changes roles, be sure to revoke those permissions immediately.

3. Use Profiles and Permission Sets Efficiently:

   • Combine delegated admin rights with profiles and permission sets. Profiles define the baseline permissions, while permission sets add on top of those permissions. For example, you can create a profile for Sales Reps and then give a delegated admin permission to assign a "Sales Rep" permission set.

4. Provide Proper Training:

   • Even though delegated admins have limited permissions, it’s crucial they understand the impact of their actions. Train them on best practices and the areas they can modify without risking errors.

5. Monitor Delegated Admin Actions:

   • While delegated admins have limited rights, it’s still important to monitor their actions to prevent any potential errors or misuse. Salesforce offers tracking and auditing tools to help you keep an eye on user activities.

What Permissions are Needed for Delegated Administration?

To set up and use Delegated Administration, the user needs the Delegated Administrator profile or permission set. Specific permissions that are typically included:

1. Manage Users – The ability to create, edit, and deactivate users.

2. Assign Profiles and Permission Sets – The ability to assign specific profiles and permission sets to users.

3. Manage Public Groups – The ability to create and modify public groups.

4. Manage Custom Objects – The ability to assign permissions for custom objects, but not necessarily to modify the data itself.

5. View Setup and Configuration – Allows access to a limited set of Salesforce setup options.

When Should You Use Delegated Administration?

Delegated Administration is useful in specific scenarios where you want to decentralize administrative tasks without exposing sensitive data or giving too much control to users. Here are some examples of when you should use it:

1. Large Teams with Different Needs:

   • If you have a large organization with many different departments (e.g., Sales, Support, Marketing), and each team needs some administrative control, Delegated Administration allows managers or team leads to handle day-to-day administrative tasks without giving them full access.

2. Organizations with Multiple Locations:

   • For organizations that have different branches or locations, a local admin could be responsible for user management within their region or department.

3. Organizations with Compliance Requirements:

   • For organizations that need to ensure certain users can only modify specific parts of the system, Delegated Administration helps in complying with internal security policies. For instance, only HR admins should manage user data related to employees.

4. Avoid Overloading IT/Technical Admins:

   • By delegating certain administrative tasks to non-technical team members, you free up your IT or Salesforce administrator team to focus on more complex tasks, allowing for better resource management and efficiency.

Do’s and Don’ts of Delegated Administration

Do’s:

• Do define clear roles: Make sure you know what responsibilities you want to delegate and who can take on those tasks.

• Do grant only necessary permissions: Avoid giving too many permissions to delegated admins. Only grant them the permissions they need to perform their job.

• Do regularly review user access: Even with delegated admins, periodic reviews of permissions and user roles help maintain security.

Don’ts:

• Don’t grant too many users delegated admin rights: Giving too many people administrative rights can create chaos and increase the chances of mistakes.

• Don’t leave sensitive data exposed: Delegated admins should only have access to the areas they need. Sensitive areas should be restricted, even from delegated admins.

• Don’t forget to monitor actions: Just because someone is a delegated admin doesn’t mean they’re not at risk of making mistakes. Monitoring their activities will help mitigate risks.

Conclusion

Delegated Administration is a powerful feature in Salesforce that allows organizations to delegate specific administrative tasks to certain users while maintaining control over sensitive data and configurations. By using it, you can enhance efficiency, security, and flexibility in your Salesforce environment.

By following best practices, understanding who needs access to what, and keeping the scope of permissions narrow, you ensure that your Salesforce system remains secure and well-managed.