Delegated administration capabilities and limits
Key Takeaway
Delegated administration gives a user who isn't an administrator limited admin powers over a defined scope. That user can create and edit users in specified roles and their subordinate roles, assign specified profiles, and assign or remove permission sets, without gaining admin rights elsewhere in the role hierarchy.
Delegated administration lets you hand some admin work to users who aren't administrators, so the main administrator can focus on other work. You set it up with a delegated administration group. The group defines who the delegated admins are and what they can manage. Exam questions often turn on the limits of that scope: what a delegated admin can do, and where their powers stop.
What delegated administration covers
Delegated administration assigns limited admin privileges to users in your org who aren't administrators. The limit comes from scope, which you set on the delegated administration group. A delegated admin manages users in the roles you specify and all their subordinate roles. They assign the profiles you specify and manage membership in the public groups you specify.
The group's admin powers cover the specified roles and their subordinate roles, so the group grants no admin rights over users elsewhere in the role hierarchy.
Being a delegated admin doesn't restrict access granted elsewhere, because permissions are additive. A delegated admin keeps every privilege from their assigned user permissions. If a delegated admin also has "Manage Users" or "Customize Application", they can act outside the scope of their delegated role.
Tomás leads the field technicians at a solar installation company, and he isn't an administrator. The administrator creates a delegated administration group with Tomás as its delegated admin. The group lists the Field Tech Lead role, so its scope also covers the subordinate Field Technician role. The group also lists the Field Technician profile. When a new technician joins, Tomás creates the user in the Field Technician role, assigns the Field Technician profile and adds a permission set for the scheduling app. Later, a user in the Billing Lead role gets locked out. Billing Lead sits beside Field Tech Lead in the role hierarchy, not below it. Tomás has no other admin permissions, so he can't unlock that user, because Billing Lead is outside the group's scope.
Delegated administration works in Salesforce Classic and Lightning Experience, in Enterprise, Performance, Unlimited, Developer and Database.com Editions.