I have cloned the sys admin profile and created a profile named IT admin having same privilege.

My Problem: I have a custom setting record which stores a sensitive information(password) in it. I do not want the IT admin users to go access the custom setting but should be able to do other admin related activities( they should have access to setup menu etc)

How can I restrict this IT admin user to not access custom setting data? Is there a way to hide it?

  • 1
    You should consider using Named Credentials if this password is used for a callout to an external system. – Mark Pond May 5 '17 at 23:34
  • Named credentials is what I was thinking about too. Thanks – SfdcBat May 6 '17 at 0:48

One option you can consider in a case like this is delegated administration. This is actually easier than monkeying with a whole new custom profile. Here you take a standard user, and elevate them to the ability to perform very specific administration tasks.

For instance, if you want a user to be able to only manage certain users, or only manage certain custom objects and their permissions, this is where delegated administration comes in.

Unfortunately, if this doesn't give that user enough permissions or the right permissions, it might not suit your needs.

As to being able to hide custom setting data, there really isn't a way. The access permission that allows a user to access custom settings is the same to allow that user access to the whole setup menu: "Customize Application".

| improve this answer | |
  • We have a bunch of users who needs delegated admin access. It can't be done for each user. I guess have to go with named credentials then – SfdcBat May 6 '17 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.