We have implemented Least Privilege in our production org, and have managed to lock down an administrator account that can do everything BUT modify metadata.

We also need login as any user to be activated so that these users can support our end users and assist in trouble shooting, however there is nothing stopping them from using Login as Any User to login as a System Administrator, temporarily upgrade their profile and then change it back once they have modified whatever they want to modify.

How do I permit them to login as anyone beneath them in the role hierarchy, but not above?


Take away the Modify User permission on their profile, and instead use Delegated Administration. Using this technique, you can specify which users they can log in as. They will also be able to do things like reset passwords and so on. You may also grant them a list of profiles they can assign to other users, such that they can't just create a new user as an administrator. In this manner, they'll be locked out of all the typical ways one would escalate their own privileges.

To get started, go to Setup > Security Controls > Delegated Administration. Create a new group, Enable Login Access, add the user to delegate administration to, add the roles they can administer, and finally specify the profiles, permission sets, and public groups they can use. You can read more about how this feature works in Help & Training.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.