Salesforce Delegated Administration: Define, And Set Up Guide

Salesforce delegated administration is a feature that lets you hand specific admin tasks to trusted non-admin users, such as managing users in chosen roles, resetting passwords, and assigning set profiles or permission sets, without giving them full access to the system. You set it up in Setup by creating a delegated group, adding the delegated administrators, and defining the roles, profiles, permission sets, and custom objects they are allowed to manage.

For a growing org, this is how you keep senior admins from becoming a bottleneck while still holding the line on security. A team lead can reset a password or activate a new hire in their department, and nothing else. This delegated admin guide defines delegated administration in Salesforce, explains what a delegated administrator can and cannot do, and walks through the delegated administration setup step by step.

Here is the quick view before the detail.

‍

What Is Delegated Administration In Salesforce?

Delegated administration in Salesforce lets a full system administrator assign a narrow set of admin duties to other users. It gives non-admin users limited admin access to handle everyday user management, such as password resets and role assignments, without the broad control of a full admin profile. It is a core part of Salesforce access management, and it suits large organizations with distributed teams.

The idea rests on a simple security principle: people should have exactly the access their job needs, and no more. Instead of a single overloaded admin doing every password reset across the company, a delegated administrator handles the users in their own corner of the org. Senior admins keep control of the risky settings, and routine user account management moves closer to the people who understand the context.

Why Use Delegated Administration

Delegated administration gives you an organized way to manage users while keeping the org secure. Three benefits stand out.

• Efficiency. Spreading routine admin responsibilities across team leads means password resets and user permissions get handled quickly, so senior admins can focus on higher-value work.
• Security. Delegated administrators get only the administrative permissions their role needs. Limiting access this way supports least-privilege security and reduces the chance of an unwanted change.
• Scalability. As the company grows, managing users and roles gets harder. Delegated groups let you distribute that work cleanly, so org administration keeps pace with the business.

‍

What A Delegated Administrator Can And Cannot Do

A delegated administrator works inside a clearly bounded scope. Understanding those delegated administration permissions up front is what keeps the setup safe. The table below shows the common tasks a delegated admin can take on and the limits that come with them.

This can-and-cannot boundary is the heart of the feature. A delegated administrator assigns access that already exists; they never create new permissions. You decide the exact admin permissions each group holds, which keeps user access control in the hands of your senior admins while day-to-day work spreads out. The official Salesforce Admins hub is a good reference for how these controls fit the wider platform.

‍

Common Use Cases For Delegated Administration

Access delegation earns its place wherever admin work outgrows a single person. A few patterns come up again and again, and they show why so many teams turn the feature on as they grow.

• Departmental user management. A support or sales lead handles onboarding, password resets, and role changes for their own team, cutting the wait on the central admin.
• Regional or franchise orgs. Each region manages its own users and set custom objects, while global settings stay locked to headquarters.
• Help-desk password resets. A first-line help desk resets passwords and clears lockouts for a defined set of users, and nothing else.
• Managed service handoffs. A partner or internal team runs routine user account management without holding the keys to org-wide configuration.

In each case, the same principle holds: the delegated admin does real work, but only inside the boundary you set. Practical walkthroughs on SFDC Fanboy and Salesforce Tutorial show how admins apply these patterns in real orgs.

‍

How To Set Up Salesforce Delegated Administration

Setting up delegated administration takes five steps. You define a group, add the people who will act as delegated admins, then decide exactly which roles, profiles, permission sets, and objects they can manage. Here is how to set up delegated administration in Salesforce.

Step 1: Open The Setup Menu

Sign in with a full system administrator account. Select the gear icon in the top-right corner and choose Setup. In the Quick Find box, type "Delegated Administration" and select it from the results. This is the screen where all delegated admin configuration lives.

Step 2: Create A Delegated Administration Group

Delegated groups are how you package a set of responsibilities. Each group defines what its delegated administrators can manage.

• Click New in the Delegated Administration Groups list.
• Give the group a clear name, such as "Sales Region Managers" or "Support Leads."
• Decide whether the group can enable Salesforce for users, if that fits their role.
• Click Save.

Descriptive names make delegated groups easy to audit later, so pick something that reflects the team and its scope.

Step 3: Add The Delegated Administrators

Next, name the people who will hold this delegated admin access.

• Open the group you created.
• In the Delegated Administrators section, click Add.
• Select the users who will act as delegated admins for this group and save.

These users gain the group's abilities the moment you save, so add only the people who genuinely need them.

Step 4: Assign Roles, Profiles, And Permission Sets

This step defines the real scope of the group and is the core of your delegated administration permissions.

• Under Roles and Subordinate Roles, add the roles whose users the group can manage. Delegated admins can manage those users and everyone below them in the role hierarchy.
• Under Assignable Profiles, add the profiles the group is allowed to assign, such as "Sales Reps" or "Support Agents." Pairing roles and profiles this way sets both who the group manages and what those users become.
• Under Assignable Permission Sets, add the permission sets the group can grant. Since Salesforce is moving user permissions toward permission sets and permission set groups, this is where most access now lives.

Because the group can only assign what you list here, this screen is where careful profile management and permission management pay off. List the minimum that the team needs.

Step 5: Add Custom Objects, Then Test

Finish by granting any custom object administration the group needs, then confirm everything works.

• Under Custom Object Administration, add the custom objects the group can manage, and set the access level for each.
• Keep standard objects and org-wide security settings out of scope to protect data integrity.
• Log in as one of the delegated admins and confirm they can manage their assigned users, profiles, and objects.
• Try to reach a restricted area to confirm the boundary holds, then gather feedback from the team.

Testing is what turns a configuration into a trustworthy setup. It catches any gap before a delegated admin runs into it in real work.

‍

Delegated Administration Limitations And Best Practices

Delegated administration is powerful, but it has clear boundaries worth knowing before you rely on it. Understanding the Salesforce delegated administration limitations keeps expectations realistic and the org safe.

• Delegated admins can assign profiles and permission sets, but they cannot create or edit them. That stays with full admins.
• They can manage users only in the roles you list and the roles beneath them in the role hierarchy.
• They cannot change org-wide security settings, sharing rules, or standard object permissions.
• The feature covers user management and set custom objects, not broad configuration or metadata changes.

A few Salesforce delegated administration best practices keep the setup clean as it scales. Give each group the narrowest scope that still lets the team work, and name groups clearly so an audit is quick. Because delegated admins can only assign what already exists, tidy permission management upstream, with well-defined permission sets, makes their job safer. Community guides on Salesforce Geek cover how permission sets and delegated groups work together.

Review delegated groups regularly, and pair the setup with a wider look at access, which our guide to performing a Salesforce health check covers. For teams onboarding many users at once, delegated administration also works well alongside automatic user provisioning, which handles account creation so delegated admins can focus on ongoing management.

‍

Frequently Asked Questions

1. What is delegated administration in Salesforce?

Delegated administration is a Salesforce feature that lets a full administrator grant limited admin duties to non-admin users. Those delegated administrators can manage users in set roles, reset passwords, and assign chosen profiles and permission sets, all without full access to the org.

2. What can a delegated administrator do in Salesforce?

A delegated administrator can create and edit users in assigned roles, reset their passwords, assign specified profiles and permission sets, and administer chosen custom objects. They work inside a fixed scope and cannot change org-wide security settings or create new permissions.

3. How do I set up delegated administration in Salesforce?

Go to Setup, open Delegated Administration, and create a new group. Add the users who will be delegated admins, then define the roles, assignable profiles, assignable permission sets, and custom objects the group can manage. Save and test by logging in as a delegated admin.

4. What are the limitations of Salesforce delegated administration?

Delegated admins can assign profiles and permission sets but cannot create or edit them, cannot manage users outside their assigned roles, and cannot change sharing rules, standard object permissions, or org-wide security settings. The feature is scoped to user management and set custom objects.

5. Is delegated administration good for security?

Yes. It supports least-privilege security by giving each delegated admin only the access their role needs. That reduces the risk of unwanted changes and keeps sensitive settings with your senior admins, which strengthens overall security and access control.

‍

Simplify And Secure Your Salesforce User Management

Delegated administration is one of the cleanest ways to share the admin load without loosening security. Set up thoughtfully, it makes user management faster, keeps access least-privilege, and lets your Salesforce org administration scale with the business, all while senior admins keep control of the settings that matter most.

If you would like help designing delegated groups and a wider access model that fits your team, Minuscule Technologies offers Salesforce administration services built around your needs. With expert Salesforce consulting, you get a setup that is secure, easy to audit, and ready to grow. Contact us today to get started.