There are times when Salesforce Admins would like power users, team managers, or even external users to take part in administrative duties for one particular team or a certain subset of users within the organization. Assigning full administrative permissions to these users is by no means the best practice or the best idea – that’s where the Delegated Administration functionality comes into play.
In this article, we’ll go over this out-of-the-box functionality, how to set it up, and what advantages it could bring to your organization.
What Are Delegated Admins?
Delegated Admins are a group of users outside the team managing Salesforce, who are granted limited Salesforce administration privileges in order to conduct specific tasks in a particular area or department of an organization.
Seen especially in large companies, it empowers other users to assist with certain activities and offers a certain level of autonomy within the department. It also adds flexibility and increases efficiency especially when it comes to access management in Salesforce.
What Can a Delegated Admin Do?
Before deciding to use delegated administration, it’s imperative to know exactly what the users granted this access will be able to do and help with. While you as a Salesforce Administrator have full access to customize everything in Salesforce, when it comes to this group of people you can pick and choose exactly what tasks they will support with.
Additionally, remember that there are permissions such as modifying the permission sets, customizing standard objects, or editing page layouts that cannot be made available at all to these users through this functionality and should remain reserved for the Salesforce Admin.
Get Started
Now that you know what a delegated admin could do within your organization, let’s go ahead and go through setting up delegated admins. Before proceeding, you should take a look over your org’s role hierarchy, as roles and subordinates play an important part in determining the users that the delegated admins will have access to manage.
The first step is to create a Delegated Group by navigating to Setup > Delegated Administration. You can choose to create one or multiple, depending on how you’d like to split the responsibilities across the users who will have these extra permissions. For example, there could be one group for each department involved.
One key setting you can make use of from the start is allowing the users in this group to login as the users they will be supporting. This is the most helpful mechanism that delegated administrators can make use of, as impersonating a user in Salesforce will allow them to see the errors a certain user might be experiencing or confirm that the users in the roles they are supporting have access to everything they need before reaching out to the Salesforce Admin.
Once the group is created, continue by determining which roles and subordinates should be managed by this group. This is the way that the delegated administrators receive permissions to create and edit only users in certain areas of the organization.
Next, you can choose which Profiles, Permission Sets, or Permission Set Groups can be assigned. Keep in mind that delegated admins cannot assign any of these that contain the ‘Modify All Data’ permission. Also, the delegated administrators can only assign these permissions, but not modify them.
By allowing such granularity in assigning only particular Profiles and/or Permission Sets, you can ensure that only certain access is managed by the delegated administrators, while more significant changes remain to be handled by the Salesforce Administrators.
Not only can the delegated administrators create public groups, but already existing public groups can be assigned to the delegated group so that users being managed by the delegated admin can be added to these groups as well.
Keep in mind that you may not always need to navigate to the Delegated Administration page in the scenario of a new group being created, as it can directly be added to the delegated administration groups on the creation page.
Finally, for each delegated group created, you can choose one or more Custom Objects which will become available for the delegated admins to almost fully manage. They will not be able to control sharing settings though, or create or modify relationships. This option however remains something you should carefully consider when enabling depending on how change requests are managed within your org when it comes to object customization.
Once everything above is set up as needed, delegated administrators can easily be added to the group and start making use of the newly extended administrative privileges!
External Delegated Admins
While Experience Cloud administration is a whole different subject as the main focus is on external user management, it can’t go unmentioned the fact that a delegated admin option exists in this realm as well.
This functionality focuses on site administration and refers to empowering certain external users to help with various tasks such as user creation, password resets and permission management on their Accounts.
Unlike the internal mechanism, this one can be enabled through the Delegated External User Administration permission, which can easily be assigned through a permission set. Additionally, you may make use of this only for certain license types, such as Partner Community or Customer Community Plus. Make sure to check the considerations here.
Summary
In essence, delegating users to conduct certain administrative operations in Salesforce in a controlled fashion is something all Salesforce Admins should consider instead of assigning more permissive access, such as Modify All Data or Manage Users. The Delegated Admin functionality allows you to granularly control the changes these users can make freeing up some of the Salesforce Admins, while also being easy to set up and use long term.
Have you set up delegated admins for your organization yet? Let us know in the comments below!