A Platform Administrator at Cloud Kicks has set up a junior administrator as a delegated administrator in Salesforce. What should the Platform…

Delegated administrators are designed to handle specific administrative tasks without having full administrative privileges. A key limitation is their inability to modify org-wide security configurations. While they can assign or remove existing permission sets for users within their delegated groups, they cannot create new permission sets or modify the permissions contained within existing ones. This restriction ensures that the fundamental security and access model of the organization remains under the control of full System Administrators, preventing unintended escalation of privileges or changes to core data access policies.

A. Delegated administrators can perform both user unlocking and password resets for the users within their specified scope of administration.

B. Delegated administrators are explicitly prohibited from modifying permissions, including field-level security, on standard Salesforce objects.

D. A primary function of a delegated administrator is user management, which includes the ability to assign users to specified profiles.

1. Salesforce Help Documentation, "Delegate Administrative Duties": This official document outlines the specific capabilities and limitations of delegated administrators. In the section detailing what delegated administrators cannot do, it explicitly states they "can’t... Create or modify profiles and permission sets." It also confirms they can "Reset passwords for users," "Unlock users," and "Assign users to specified profiles."

Source: Salesforce Help, "Delegate Administrative Duties," table titled "Delegated administrators can’t:".

2. Salesforce Security Guide, "User Management Administration": This guide details security-related administrative tasks. It reinforces the principle that delegated administration is for managing users within a defined scope, not for altering foundational security structures like permission sets or profiles.

Source: Salesforce Security Guide, PDF version, Chapter on "Controlling Access to Your Org," section on Delegated Administration.

3. Trailhead by Salesforce, "Delegate Administrative Tasks" Module: This official training module provides hands-on learning about delegated administration. The unit "Set Up Delegated Administrators" clarifies the boundaries of their permissions, noting that they cannot modify permission sets, which would alter the org's security model.

Source: Trailhead, "User Management" Trail, "Delegate Administrative Tasks" Module.