Delegated Administration

Why Delegated Administration Matters

As a Salesforce org grows, a single system administrator (or small admin team) quickly becomes a bottleneck. Password resets, new user creation, unlocking accounts, assigning permission sets and tweaking custom object fields pile up as support tickets. The obvious fix, handing out the Manage Users or Customize Application permissions, is dangerous because those permissions apply org-wide and expose every user, profile and object in the system. Delegated Administration solves this by letting you hand off a narrowly scoped slice of administrative work to trusted business users without turning them into full administrators. It is a core topic in the Advanced Security and Access domain of the Salesforce Advanced Administrator exam because it tests whether you understand the principle of least privilege applied to setup tasks rather than to record access.

What Delegated Administration Is

Delegated Administration is a Setup feature (Setup > Delegated Administration) that lets a system administrator create Delegated Groups. Each group defines two things: who the delegated administrators are, and what they are allowed to administer. A delegated administrator is a regular user, with a regular profile, who gains limited administrative abilities only within the boundaries defined by the group. They do not need the Manage Users permission and they never see or control anything outside their assigned scope.

Key point for the exam: Delegated Administration is about delegating setup and user-management tasks. It is not a record-sharing mechanism. If a question is about who can see or edit records, the answer lies in OWD, roles, sharing rules or manual sharing, not Delegated Administration.

How It Works: Anatomy of a Delegated Group

When you create a Delegated Group you configure the following related lists:

1. Delegated Administrators - The users who receive the delegated powers. A user can belong to more than one delegated group, in which case their abilities are cumulative. Delegated administrators must have the View Setup and Configuration permission on their profile or via a permission set so they can reach the relevant Setup pages.

2. User Administration (Roles and Subordinates) - The roles whose users the delegated admins may manage. Selecting a role automatically includes all roles beneath it in the role hierarchy. Within this scope, delegated admins can create new users, edit existing users, reset passwords, unlock locked-out users, and assign the users to roles within the delegated scope. They cannot touch users outside those roles.

3. Assignable Profiles - The specific profiles the delegated admins may assign when creating or editing users. This prevents a delegated admin from promoting someone to System Administrator. Important: you cannot add a profile that contains the Modify All Data permission to this list.

4. Assignable Permission Sets - The permission sets the delegated admins may assign to or remove from users in their scope. The same restriction applies: permission sets containing Modify All Data cannot be delegated.

5. Assignable Public Groups - Public groups to which delegated admins may add or remove users. Useful when group membership drives sharing rules or queue membership.

6. Custom Object Administration - Custom objects the delegated admins may maintain. For these objects they can create and edit custom fields, page layouts, record types, custom tabs, validation rules and similar customizations. They cannot create or modify relationship fields, change organization-wide sharing defaults, modify object-level permissions on profiles, or administer standard objects.

7. Enable Group for Login Access - A checkbox on the group. When enabled, delegated administrators in the group can log in as users who have granted login access to administrators, which is handy for troubleshooting without escalating to a full admin.

What Delegated Administrators Cannot Do

The exam loves to test the boundaries. Delegated admins cannot:
- Create, edit or delete roles, profiles or permission sets themselves (they can only assign the ones listed).
- Assign profiles or permission sets with Modify All Data.
- Manage users outside the specified roles and subordinates.
- Delete users (no one can) or change settings on standard objects.
- Modify sharing settings, OWDs or sharing rules.
- Manage anything not explicitly listed in their delegated group.

Typical Use Cases

- A regional sales operations lead who onboards new reps for their region, resets passwords and assigns the Sales User profile.
- A business-unit owner of a custom Project app who needs to add picklist values and adjust page layouts without waiting on IT.
- A help-desk team that unlocks users and resets passwords but must never touch executive or admin accounts.
- A departmental coordinator who manages membership of a public group used in sharing rules.

Delegated Administration vs. Alternatives

Manage Users permission: Org-wide, lets the user administer every user, every role and every profile. Too broad for scoped needs.
Customize Application permission: Org-wide control of all objects, standard and custom. Too broad.
Permission sets alone: Grant capabilities but cannot restrict scope to certain roles or objects.
Delegated Administration: Granular, scoped, auditable. The right answer when the requirement includes words like only for their region, only for their department, only for a specific custom object, without granting full administrator access.

Exam Tips: Answering Questions on Delegated Administration

Tip 1 - Spot the trigger phrases. Look for scenarios such as: a manager needs to create users or reset passwords for their team only; a department needs to maintain a custom object without full admin rights; the company wants to reduce the administrator workload while keeping control. These almost always point to Delegated Administration.

Tip 2 - Eliminate over-broad answers. If an option grants Manage Users, Customize Application, Modify All Data, or the System Administrator profile, it violates least privilege and is usually a distractor when the scenario says only or specific.

Tip 3 - Remember role scoping is hierarchical. Selecting a role in User Administration includes all subordinate roles. If a question asks why a delegated admin can manage users they were not expected to manage, the answer is often that those users sit in a subordinate role.

Tip 4 - Know the Modify All Data rule. Any option implying a delegated admin can assign a profile or permission set with Modify All Data is wrong. This is a frequently tested limitation.

Tip 5 - Custom objects only. If the scenario involves maintaining fields or layouts on Accounts, Opportunities or any other standard object, Delegated Administration is not the solution. Likewise, delegated admins cannot create relationship fields or change sharing defaults even on their delegated custom objects.

Tip 6 - Separate setup access from record access. Questions mixing the two are common. Delegated Administration governs user management and object configuration; it never grants visibility to records. If the ask is about seeing or editing data, think sharing model instead.

Tip 7 - Remember prerequisites. Delegated admins need View Setup and Configuration. If a scenario says a delegated admin cannot reach the Users page, check whether that permission is missing.

Tip 8 - Login access requires the checkbox. If a delegated admin needs to log in as users for troubleshooting, the group must have Enable Group for Login Access selected, and the target users must have granted login access to administrators.

Tip 9 - Multiple groups stack. A user in two delegated groups gets the combined permissions of both. Use this when a question describes a user who needs to manage two different sets of roles or objects.

Tip 10 - Think like a consultant. The Advanced Administrator exam rewards the most secure, most scalable, least-maintenance answer. Delegated Administration is usually preferred over creating new admin profiles or handing out permission sets with broad administrative rights.

Quick Recap

Delegated Administration lets you give trusted users scoped administrative powers: manage users in specified roles and subordinates, assign approved profiles and permission sets (never those with Modify All Data), manage membership of approved public groups, maintain approved custom objects, and optionally log in as users. It does not control record visibility, does not cover standard objects, and does not let delegates create or modify roles, profiles or permission sets. Master these boundaries and you will handle any Delegated Administration question on the exam with confidence.