When to use delegated administration
Key Takeaway
To let someone who isn't an admin create and edit users in a role and all its subordinate roles, make them a member of a delegated administration group that specifies that role.
Delegated administration gives a user who isn't an admin a limited set of admin powers. Those powers are scoped to the specific roles, profiles, public groups, and custom objects that you specify. Use delegated administration when someone like a team manager should handle routine user tasks for their own team. The main admin can then focus on other work. Admin duties also don't all sit with one person.
Delegated administration groups and scope
A user becomes a delegated admin by being a member of a delegated administration group. The group specifies what its members can manage:
- Users in specified roles and all their subordinate roles
- Specified profiles
- Specified public groups
- Specified custom objects
A delegated admin's power reaches only what the group specifies. So to let a user who isn't an admin create and edit users in a role and all its subordinate roles, add that user to a delegated administration group that specifies the role.
Maria leads the Warehouse Operations team. Her team's users are in the Warehouse Lead role and its subordinate roles, Shift Supervisor and Picker. Maria isn't an admin. You create a delegated administration group that specifies the Warehouse Lead role. Then you add Maria as a member. Maria can now create and edit users in Warehouse Lead, Shift Supervisor, and Picker. A user in the Finance Analyst role sits outside that branch of the role hierarchy, so that user isn't in Maria's delegated scope.
Permissions are additive, so being a delegated admin doesn't restrict access granted elsewhere. For example, a delegated admin who also has the "Manage Users" or "Customize Application" permission can act outside their delegated scope.