We have a community based product in which have many modules(based on different CRM object). We have created a configuration page by which we can enable/disable any module. So after installation of our product, client org can enable/disable any module.

So I like to know that is there any option to hide this configuration page from client org but we can use this page via support user. So according to client commitment/requirement we can enable/disable modules and according to enabled module we can charge to clients.


Added to clear my use case:

  1. Created managed package with minimal module enabled.
  2. Placed this package on SalesForce Market Place.
  3. Any client installed our application.
  4. Client Organization should be able to use our application with default on module
  5. Our sales Team contacted client organization and convene then to use some more module.
  6. Client organization provided us "Support User" access
  7. We come to the our ISV organization and login to the client organization via "Subscriber" flow.
  8. We come to the client org and open the "Our product Configuration" page and enabled the some extra modules which are required to that client

My main concern is that client organization should not be able to open same configuration page if they know the Configuration page URL

  • When you say "hide from the client org but we can use the page via support user", do you mean that you can use the page remotely and only your company's support user can access the page in the community? Its unclear to me as to who would be accessing the page and from where.
    – crmprogdev
    Apr 16, 2015 at 13:54
  • Yes, I like to hide that page from Customer organization but if customer enable remote support for our organization then only we should able to use this page via subscriber flow. I have updated my question to clear my use case. Apr 21, 2015 at 6:09

1 Answer 1


Summarily, no. You can't prevent such access, because Visualforce only "sees" the person you're actually logged in as, not the impersonator.

If you wanted to make sure they couldn't use it, consider a password type system. Require an additional input only your support personnel would know.

This might include a combination of gets to press plus a password, or any other similar protection system. Do not rely on users finding out your URL, because it's trivial to find it.

Perhaps the most secure way would be to have the page authenticate against an intranet server, so it can only be used with an internal network login (e.g. vpn).

  • Thanks sfdcfox, I did a POC as suggested by you for "password type system". it fulfill our current requirement and working for me. In future I would like to use some more secure way suggested by you(vpn) Apr 21, 2015 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .