What permissions on a profile/permission set should be considered "privileged user" or "system admin" access?

Question

I am performing analysis into the security of our org. Previously we had very relaxed rules around privileged user access in our org. Basically we give out too many System Admin profiles, but because we do have some regulation around this, other teams have basically found a loophole where they could do what they want as long as they create a new profile and don't call it any sort of "Admin".

Yes, our practices are long overdue for overhaul. My question is what specific permissions should be flagged and removed from users who are not technically System Admins?

Some obvious ones to me:

Modify All Data

Author Apex

Assign Permission Sets

Manage Internal Users

etc...

Is there a list or article somewhere that can help me with this? Or any recommendations that have implemented for any of you?

Thanks

Answer 1

If you're using the Enhanced Profile Editor, almost all of the admin settings you'll be concerned about are under System Permissions:

You'll want to turn off all the permissions in the Users section of the System Permissions area, as well as turn off most of the "Access X", "Connect X", "Create X", "Delete X", "Import Custom Objects", "Manage X", "Moderate X", "Modify X", "Subscribe X", "Transfer Records", "Tag Manager", "View X", and "Weekly Data Export". There's a handy description of what each permission does in this mode, so feel free to read any you're not sure of.

Aside from that, you also need to go to every single Object and see if they have View All Data or Modify all Data. This would be easier in the classic profile editor, though.

---

Or, as an alternative to just guessing which things to turn off, create a Permission Set that specifically has all the permissions you want them to have, assign this Permission Set to the users, then change their user profile to the Minimum Access profile. This way, you'll know exactly what they have. In the future, use the Minimum Access profile for all your normal users, and assign them Permission Sets depending on what they need to do.