How Salesforce Support uses Login Access in customer support

Table of Contents

• What is Login Access?
• Why does Salesforce Support request Login Access?
• What approval processes are involved in Login Access requests?
• What are Support users allowed to do when using Login Access to log in as an affected user?
• What system restrictions exist for Support users who are logged into a customer's organization as an affected user?
• How long will Support users have Login Access to "login as" the affected user?
• Does “Admin Assist” support use Login Access?
• What can “Admin Assist” support do within a customer's organization?

What is Login Access?

Login Access is a native functionality of the Salesforce platform that allows a user to log in to an organization as another user via UI, API, or mobile for testing and troubleshooting purposes.

For more information about this feature, see our Grant Login Access documentation.

 

Why does Salesforce Support request Login Access?

Salesforce Support users may request Login Access when it is necessary to log in to Salesforce applications to replicate, isolate, troubleshoot, and ultimately resolve issues stemming from customer initiated support inquiries when support is not possible with existing access to a customer's organization settings, setup tree, or other customer metadata.

No one within Salesforce Support may log in to your organization to resolve issues without this explicit permission and duration for the access.

 

What approval processes are involved in Login Access requests?

In order for Salesforce Support users to use Login Access to log in to a customer's organization, the customer themselves (i.e. the individual user) must first use the process outlined in “grant login Support with login access to your organization” to explicitly approve Salesforce Support's request to log in with their user profile.

Salesforce Support users then follow an explicit internal process to document that their use of Login Access is permitted in a Support case.

The ability for Salesforce Support users to use Login Access to log in to customer organizations itself goes through an approval process for each individual employee or partner who requests this access to do their necessary job functions. Only a small subset of full-time employees and trusted, contractually-bound partners (less than 6% of all active employees/partners) have the ability to use Login Access to log in to customer organizations.

 

What are Support users allowed to do when using Login Access to log in as an affected user?

When using Login Access, Salesforce Support users have the same record and data access and application and administrative rights as the user they are logged in as.

For example: If the Support user is logged in as a limited-access end user then the Support user will only have that level of access in the customer organization. Alternatively, if the Support user is logged in via an administrator user or another user with elevated access, that is what the Support user sees.

Support users will request that any UI actions (clicks) that result in changes to a production environment be performed by the customer.

Support users may make changes to lower environments (e.g. sandboxes), but the Support user must first obtain written approval from the customer (via case comments) for any requested changes and the changes are approved in accordance with our internal process (Please Note: Data 360 and Agentforce Support will not make any changes in any environment via login access).

Support users cannot export data from a customer’s organization via the UI.

 

What system restrictions exist for Support users who are logged into a customer's organization as an affected user?

There are safeguards built into the Salesforce Platform which prevent unauthorized changes to a customer organization's security posture while using Login Access.

For example:

• Email change confirmation
• Username change confirmation
• IP range change confirmation
• Blocking access to the 'Grant Account Login Access' page.

In addition to these Platform security features, the access granted to Salesforce Support when using Login Access is restricted to the user they are logged in as, so they can only see and do what the user they are logged in as can see and do.

 

How long will Support users have Login Access to "login as" the affected user?

When granting Login Access to Salesforce Support, the customer user themselves explicitly selects a duration for which Login Access for Salesforce Support will remain active for their user account.

This access is typically granted for any of the following periods of time:

• 1 day
• 3 days
• 1 week
• 1 month
• 1 year

The customer user can update the duration of, or revoke, Login Access granted at any time. No one other than the individual customer user can change or revoke Login Access on behalf of that user.

 

Does “Admin Assist” support use Login Access?

Instead of using the Login Access feature, Salesforce Support users who support customers with the “Admin Assist” entitlement use the Premier Courtesy Licenses which were provisioned as a part of that entitlement in order to log in to customer organizations.

 

What can “Admin Assist” support do within a customer's organization?

The list of tasks that Admin Assist are allowed to perform on a customer's behalf are outlined in Admin Assist: Task List.