We are trying to achieve a profile that is a step down from the traditional System Administrator that in a nut shell has the Manage User permission and Modify All Data, but does not have Customize Application.

Reason being we need this user to be the point of support for all our users but not modify or deploy any metadata changes so we can lock down our configuration and customisation.

Issue is that this user can simply modify their own profile and give themselves the "Customize Application" permission temporarily, modify metadata and then remove it again. How can I achieve this without them having the ability to upgrade their profile and bypass our profile limitations?

2 Answers 2


Don't give them Manage Users. Instead, give your users a Modify All Data profile that has no administrative privileges, then set up them up as Delegated Administrators. You can choose which users they can modify/reset password/login as as well as which profiles/permission sets they are allowed to assign to users. This will give them all of the necessary permission you're looking for without allowing them to bypass the permissions.

  • Legend! that's exactly what I am looking for. Much appreciated. Commented Aug 22, 2017 at 0:21

I am working towards a similar goal and am hindered by the limitation of a Delegated Administrator not having access to change the Manager field on a user record.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .