¶ Configurations
- Salesforce usernames are stored in the form of an email. Usernames and emails do not have to match, but the username has to be in the format of an email.
- Sandbox usernames typically use the production name + .[name of the sandbox]
- Example:
ryanbj@ryanbj.com.Ryan
- Example:
¶ Example Toggles
- Flow User - enables the use of screen flows, which are used to walk a user through a process.
- Debug Mode - Used for debugging JavaScript in Lighting Web Components.
- Development Mode - ALlows visibility of view state on Visualforce pages.
- Allow Forecasting - Pertains to collaborative forecasting and the forecast hierarchy.
¶ Security
User context looms over all actions in Salesforce. Field and object visibility are based on profiles, permission sets, and permission set groups. User criteria determines row visibility on each object through row-level sharing.
- Each User has 1 (and only 1) profile.
- One or more permission set(s) can be assigned to each user.
- Multiple sets can be bundled into a permission set group.
- Permission sets are a way to create 'managers' over base level users
- For example: Limited admin style permissions to edit special fields held in permission sets
¶ Profiles and Permission Sets
Profiles and permission sets are nearly the same thing. Profiles have:
- Global app, or system level permissions
- Page layout assignments
- Permission sets do not have these
The best practice is to have:
- Broad permissions, fewer profiles
- More granular elevated permission sets
Profiles and Permission Sets both govern Object, Field, and Record type access. Record types are used to segement out different types of objects. They also govern Tab visibility whcih determines which sections of Salesforce they can even access.
Generally speaking: Profiles should be limited as a single users' permissions and be granted the lowest access that every member of your org should have. Teams of users who should have greater capabilities inside Salesforce should be part of a permission set that all members in the team share.
¶ Creating a User
There are likely a few ways to create a User, but the most "technical way" is through the Advanced Setup. Find the Setup page for Users by going to Administration → Users → Users on the sidebar menu. This will show you a listing of all the Users in your org. To add a new one, click the New button at the top of the Users panel.
Note: Different editions of Salesforce may look different when editing a user. Some editions (like the Starter Edition) will only show an invite screen vs. a screen similar to the Edit User screen as shown below:
- The Role specifies a heiarchal level of permissions/
- The User License will generally stay as "Salesforce" for a basic Salesforce setup, but this refers to how the account is funded basically.
- The Profile defines the user's base level permissions. Remember that every user has only 1 profile. A team of users should be a part of a Permission Set.
- Under the Approver Settings, the Delegated Approver is user that would be able to run approvals on this user's belaf, while the Manager would be the approver of the records the user intearcts with. Delegated Approvers are useful for when the user is away (like on vacation).
¶ Managing a User
Users can be looked up using the top-level search menu. By typing a name, User objects will appear in the list with other objects. You can also get to the Users via the Adavanced Setup by clicking the gear at the top right and clicking "Advanced Setup". The Users listing is under Administration → Users → Users. From there, click the arrow on the right and click Edit to edit the user. The page should look similar to the image below:
¶ Deleting a User
You cannot directly delete a User from Salesforce. Instead, you can "Soft Delete" a user, which deactivates the user by setting their Active checkbox to Unchecked. You can set this via the Edit User screen as shown from the Managing a User section of this page. Setting a user to inactive will immediately disable their ability to log in. It will also remove them from all delegated groups and shared privileges. Additionally, deactivating a user will open a spot in your org license, meaning the user account will no longer be funded.