Solo Admins, especially in larger organizations, have bandwidth issues. Being pulled in multiple directions, engaged in meeting after meeting and no time to manage users and the basic configuration of Salesforce. It becomes frustrating and difficult to manage all of this.

Depending on your org and the structure of the team, assigning Delegated Administrators may be a great way to off-load some of that lower-level work. However, caution should be used when assigning Delegated Administrator permissions in Salesforce.

Defining a Delegated Administrator

Delegated Administrator’s are users who are given admin-level permissions. The idea to give trusted individuals access to Salesforce to help with the following:

• Create and edit users including password resets, teams and groups.
• Assign users to roles and permission sets
• Unlock/Freeze Users
• Login as a user who has granted login access (now on by default for Summer ’15)
• Manage custom objects (i.e.: field labels, values etc.)

The use case that Salesforce uses is as follows:

Let’s say you want the Customer Support team manager to manage users in the Support Manager role and all subordinate roles. Creating a delegated administrator for this purpose allows the System Administrator to focus on other administration.

Basically, providing Delegated Admin rights allows you, the System Administrator, to focus your time and efforts on other administrative tasks, freeing up bandwidth.

This sounds glorious! And the permissions required to become a Delegated Admin are pretty minimal: Customize Application and View Setup and Configuration.

But those permissions are more powerful than they appear.

Caution: Excessive Permissions Ahead

On the surface, the Customize Application permission seems harmless, but it opens up a whole lot of permissions that you may want to keep restricted to only System Administrators. The Customize Application permission, when activated, will automatically enable the following permissions:

1. Customize the organization using App Setup menu options.
2. Edit messages and custom links.
3. Modify standard picklist values.
4. Create, edit and delete custom fields.
5. Create, edit and delete custom fields.
6. Create, edit and delete page layouts (also requires the “Edit” permission for the record).
7. Set field-level security.
8. Create, edit and delete custom links.
9. Edit the Lead settings.
10. Activate big deal alerts.
11. Create record types.
12. Set up Web to Case and email response rules.
13. Set up Web to Lead and email response rules.
14. Set up assignment and escalation rules.
15. Set up business hours.
16. Set up Email to Case or On-Demand Email-to-Case.
17. Edit Self-Service page layouts and portal color theme.
18. Set up and enable multilingual solutions.
19. Setup team selling.
20. Set up account teams.
21. Map custom lead fields.
22. Manage queues.
23. Create, edit and delete workflow rules, tasks, field updates, outbound messages and alerts.
24. Create, edit and delete custom s-controls, custom objects, and custom tabs.
25. Rename tabs.
26. Manage custom apps and Service Cloud console apps.
27. Create and edit public calendars and resources.
28. Set up the console.
29. Enable, setup and modify the Salesforce Customer Portal.
30. Set up and schedule analytic snapshots to run.
31. Create communities for Ideas and Answers.
32. Create Visualforce email templates.

WOWZERS!

That is a whole host of permissions that a standard user is awarded. This is about the time that some one says “with great power comes great responsibility” but I don’t fully agree. These powers, when given to a non-educated user, can be detrimental to the organization.

So, what is an Admin to do? All hope is not lost.

What Permissions Do You Really Need?

Before activating these two “simple” permissions, it’s important to fully understand what the Delegated Admins in your system will need to accomplish. What will their role be and how do you want them to interact with Salesforce and your companies data?

The best way to get started is to make a list of the tasks that you, the System Administrator, wish to off-load to someone (or a group of people).

Given those tasks, review what individual permissions are needed to perform those tasks. Once those permissions are documented, you’ll need to make a decision, based on the level of access granted, if you are willing to entrust those individuals with that level of access.

Let me be clear on this point. You shouldn’t NOT entrust someone with this level of access to Salesforce. If the impact to your job is significant, and the individual is someone you and the business trusts, this is a good thing. The key is to understand exactly what they will have access to. This is what we call doing your due-diligence.

With this work completed, you may be able to evaluate the required permissions and determine that a Permission Set is much more palatable and appropriate for your companies organization. This is what I’ve done in the past and it has worked well; meeting the needs of the organization while maintaining a level of access needed to complete the tasks required and no more.

Finding Users You Trust

Finding the right user is an important part of this process. You’ll be entrusting this user with a heavy amount of admin-level permissions. Care should be taken when selecting the individuals for this role.

Create a job description, which will outline the duties and characteristics of a Delegated Administrator. Not only will this written document help in keeping focus on the appropriate individual during the selection process, but it can be provided to the Delegated Administrator to help them understand their role and duties as a Delegated Administrator.

Here are some characteristics to think about when selecting a person for this role:

Trustworthy – the individuals should have a positive reputation in the organization. They should be someone that you would share private information with and no afraid that it will pass through their lips until told it’s okay to speak.

Customer Service Minded – they should have the heart of a teacher. Patience is something they have an abundance of. They will be working directly with other end-users and should have the ability to politely troubleshoot and respond to user inquires. They are an extension and representation of you. Choose wisely.

Excellent Communicator – interpersonal and general communication skills should be evaluated. The Delegated Administrators should be clear and concise in their speech, both written and verbal.

Accessible – because the Delegated Administrator will be a representation and extension of you, the System Administrator, they need to be accessible to users. While this role may be an “add-on” to their every-day position, they should still be available via telephone, instant message or phone during business hours.

 Once one or multiple users have been selected, be sure to communicate the new role with them, and ensure they are willing to help.

Note that you’ll also want to think about how this fits into your overall support model. Several years ago I wrote about how to structure your support model. You can read the post here.

Are you using Delegated Administrators in your org? What best practices can you share? How has it helped you focus on more strategic tasks versus the day-to-day? Leave a comment below!