I have cloned the sys admin profile and created a profile named IT admin having same privilege.

My Problem: I have a custom setting record which stores a sensitive information(password) in it. I do not want the IT admin users to go access the custom setting but should be able to do other admin related activities( they should have access to setup menu etc)

How can I restrict this IT admin user to not access custom setting data? Is there a way to hide it?

  • 1
    You should consider using Named Credentials if this password is used for a callout to an external system.
    – Mark Pond
    Commented May 5, 2017 at 23:34
  • Named credentials is what I was thinking about too. Thanks
    – SfdcBat
    Commented May 6, 2017 at 0:48

1 Answer 1


One option you can consider in a case like this is delegated administration. This is actually easier than monkeying with a whole new custom profile. Here you take a standard user, and elevate them to the ability to perform very specific administration tasks.

For instance, if you want a user to be able to only manage certain users, or only manage certain custom objects and their permissions, this is where delegated administration comes in.

Unfortunately, if this doesn't give that user enough permissions or the right permissions, it might not suit your needs.

As to being able to hide custom setting data, there really isn't a way. The access permission that allows a user to access custom settings is the same to allow that user access to the whole setup menu: "Customize Application".

  • We have a bunch of users who needs delegated admin access. It can't be done for each user. I guess have to go with named credentials then
    – SfdcBat
    Commented May 6, 2017 at 0:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .