1

We are trying to achieve a profile that is a step down from the traditional System Administrator that in a nut shell has the Manage User permission and Modify All Data, but does not have Customize Application.

Reason being we need this user to be the point of support for all our users but not modify or deploy any metadata changes so we can lock down our configuration and customisation.

Issue is that this user can simply modify their own profile and give themselves the "Customize Application" permission temporarily, modify metadata and then remove it again. How can I achieve this without them having the ability to upgrade their profile and bypass our profile limitations?

3

Don't give them Manage Users. Instead, give your users a Modify All Data profile that has no administrative privileges, then set up them up as Delegated Administrators. You can choose which users they can modify/reset password/login as as well as which profiles/permission sets they are allowed to assign to users. This will give them all of the necessary permission you're looking for without allowing them to bypass the permissions.

  • Legend! that's exactly what I am looking for. Much appreciated. – David Dawson Aug 22 '17 at 0:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.