Before looking at the features available to manage users, we start with a brief introduction to the concepts of record owner, profiles, and sharing in Salesforce CRM.

Generally, permissions and access settings can be specified for users at profile level and at individual user permission set level. Although certain permissions and access settings can only be specified in profiles. A summary of the permission and settings types that are available in Profiles and Permission Sets can be seen in the following table:

All users in your organization with access to Salesforce CRM require a username, an e-mail address, a password, and a profile along with an active user license.

Depending on the features your organization has purchased, you may have user options such as Marketing, Service Cloud, and Mobile, which give particular users the ability to access other features that are only available with a specific user license. A user can be assigned to one or more of these options.

You can also create and manage other types of users outside your organization by applying the appropriate licenses that provide limited access to your Salesforce organization, as detailed later in this chapter.

In association with the user license, you can govern all user's access to data using the options available in either the profile settings or the sharing features.

Profile settings control access to applications and objects while sharing features control access to specific records.

To navigate to...

To view or edit user information, navigate to Setup | Manage Users | Users. Now, click on Edit next to a user's name. Change the necessary information and click on Save.

Users can also change, or add to, their own personal information after they log in.

If you change a user's e-mail address and do not select the Generate new password and notify user immediately option, a confirmation message will be sent to the new e-mail address that you entered to verify the change of e-mail. The user must click on the link provided in that message for the new e-mail address to take effect.

If you change a user's e-mail and reset the password for a user at the same time, the new password is automatically sent to the user's new e-mail address, and e-mail verification is not required.

Click on Unlock to unlock a user that is locked out of Salesforce.

This feature allows you to freeze user records. Often there are times when you may not want to deactivate a user immediately (such as when a user is part of an approval process) but you must prevent them from logging into your organization (as they have left the company, for example) while you perform the steps to deactivate them.

To freeze a user record, navigate to Setup | Manage Users | Users. Now, click on a user's name to access their user detail page. Now click the Freeze button.

You have the following options for resetting passwords for users in Salesforce CRM:

Resetting passwords

If users have forgotten their password, they can click on the Forgot your password? link on the Salesforce CRM login page which presents them with a screen to enter their username, as shown in the following screenshot:

The user will then receive an e-mail from Salesforce that contains a new password link that will require them to answer a previously set security question such as Where were you born? before their password is reset and they can log in to Salesforce.

To reset a user's password, navigate to Setup | Manage Users | Users. Now select the checkbox next to the user's name.

Optionally, to change the passwords for all currently displayed users, check the box in the column header to select all rows.

Click on Reset Password to have a new password e-mailed to the user(s).

Note

After you reset user's passwords, some users may need to...

Salesforce provides several features to allow you to control user's access to your instance of Salesforce CRM. Here we are going to look at the key control mechanisms and access policies that are available for you to set.

Password policies

There are several password and login policy features that help you to improve your organization's security. To set these password policies, navigate to Setup | Security Controls | Password Policies. Select the required settings and then click on Save.

Let's look at each of the password policies which are shown in the following screenshot:

There are several session security features that help you improve your organization's security. These features include setting the session expiration timeout, locking sessions to the IP address from which they originated, and other organization-wide session settings. To set these session options, navigate to Setup | Security Controls | Session Settings.

Select the required settings as shown in the following screenshot and then click Save.

Let's look at each of the session security features.

There are various features for setting the session timeout as per the following sections:

The feature for setting login page caching and autocomplete which stores, user's login details (just the list of usernames but not the password) is as per the following sections.

The feature for setting identify confirmation, which allows further mechanisms to extend the standard use of e-mail confirmation, is as per the following sections

Cross-Site Request Forgery (CSRF) is a malicious technique in which unauthorized commands are crafted (by script or a link on a page, for example) to be sent by a user to a website that has been authenticated.

These options protect against Cross-Site Request Forgery (CSRF) attacks by modifying the non-setup pages to include a random string of characters in the URL parameters or as a hidden embedded field. The system then verifies this string of characters and only executes the command if the value matches the expected value. There are various features for setting protection against CSRF attacks as per the following sections:

Content Security Policy (CSP) is a security standard created to prevent malicious content executing in trusted web content. Setting the option within this section applies the policy to associated e-mail templates within Salesforce.

Session-level security settings are used for connected apps, reports, and dashboards. Here you can restrict access to these areas of functionality based on the level of security associated with the authentication (login) method for the user's current session. You can restrict access to connected apps, reports, and dashboards by setting the level of security associated with the user's current authentication (login) method; each login method has one of two security levels which is either Standard or High Assurance. Different authentication methods are assigned with the following security levels:

To change the security level associated with a login method navigate to Setup | Security Controls | Session Settings. Locate the Session Security Levels, select the login method and then click...

The Logout URL setting allows you to specify a URL that starts with http:// or https:// that users are redirected to after they have logged out of Salesforce. If the Logout URL is not specified, the user is redirected to https://login.salesforce.com . If My Domain is enabled and Logout URL is not specified, users are redirected to https://"my-domain".my.salesforce.com.

To assist other users, you can log in to Salesforce as another user.

To log in as another user, navigate to Setup | Manage Users | Users. Now click on the Login link next to the user record as shown in the following screenshot:

You can also log in as another user from the User Detail page using the Login button as shown in the following screenshot:

After you have logged in as another user, you will notice a message at the top-right corner of all Salesforce pages that display the message You are currently logged in as.

To return to your administrator account, click on the logged in user's name (the user who has granted you access, Trevor Howard in this example). Then click on the Logout option:

There are many occasions when it is useful for you to log in as one of the users in your organization. This could be, say, to check data access from their role or profile or to check reports or dashboards and so on.

If the Administrators Can Log in as Any User feature is disabled, rather than instructing individuals one-by-one, on how to grant you login access you can save time for both yourself and the users in your organization by preparing a how-to guide to help users grant login access to you. The following is a sample how-to guide that lists the steps that they need to take to make the required setting and is shown in the following screenshot:

When the Administrators Can Log in as Any User feature is enabled, users will no longer have the option to grant login access to administrators, but they can still grant login access to Salesforce.com support.

Where additional apps have been installed, the list of entities that users can...