I'm trying to create a validation rule that prevents users with the "Application Administrator" profile from updating any fields for "System Administrator" users on the User object. While testing as an Application Administrator I was not able to edit any fields on a System Administrator user, however I was still able to change the profile from System Administrator to a lower profile. Why can they still update the profile but no other fields?

Here's the validation rule:

$Profile.Name = "Application Administrator",
Profile.Name = "System Administrator"

1 Answer 1


Because the validation rule checks the current, not previous, value. You need to use PRIORVALUE to check what the old value was before changing the value. This rule actually prevents the opposite; that profile cannot change anyone to a system administrator.

  • Probably a stupid question, but why does this need to be applied to the profile, but not the other fields?
    – Jeff Doe
    Aug 24, 2023 at 22:03
  • @JeffDoe Kinda hard to answer that because I think your question could be read in one of two ways. Taking a guess at your meaning here, I'd say it's because the profile of the User being edited is a key part of your criteria. If the profile of the User being edited is changing, then it's not subject to this validation rule any more (which is not what you want). Compare that to any other field. If some other field is changing, it doesn't matter which field it is, the fact that there is a change (and an app admin is trying to edit a sysadmin's User) is enough for you to know that's no bueno.
    – Derek F
    Aug 24, 2023 at 22:57
  • @JeffDoe because the $Profile will not change in the current transaction, so it is not needed. You could, however, do it if you wanted to, because it will never change.
    – sfdcfox
    Aug 24, 2023 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .