Large enterprise customers often request that we integrate with their internal audit-based access control list processes.

Here is a general requirements summary:

Step 1: Automate the export of all active users from Force.com with entitlements (role or profile, I suppose) on a scheduled basis, e.g., every 180 days. Send/integrate user report to access control tool for processing.

Step 1a - Interim Offline Process: The access control tool then sends managers a request to review and validate a user's access. If the manager approves / validates the access, the user should still remain active in Force.com. If the manager rejects the user's access, the user should be deactivated accordingly in Force.com.

Step 2: Ideally, Force.com can receive a flat-file or API-based data integration that contains the list of Users or User Ids that should no longer be active after processing in that access control toolkit. Once received, the users are automatically deactivated and the system can send an email to the system administrator (this email alert can be done with the user workflow feature)

I appreciate everyone's insights - thank you.

1 Answer 1


From a purely technical stand point... You could have the external system call the Soap API and feed it a list of Salesforce IDs of users to deactivate.

Here is an example of a post that updates users using Java. https://stackoverflow.com/questions/12508026/how-to-disable-deactivate-a-salesforce-user-through-soap-api

Alternatively you could write an apex email service that will receive a file via email and deactivate the users based on the contents of the email or attached spreadsheet.

You will need to consider the implications though for the deactivation of users e.g. removal from account teams, removal from sales teams of closed opportunities, removal from sales teams of open opportunities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .