"Manage Users" Permission

The following lists detail the specific actions enabled by the Manage Users permission, organized by functional area: Profiles, Sharing, User Management, and Other Permissions.

Profiles

The Manage Users permission grants the following Profile-related capabilities, allowing the user to create, assign, and manage profiles and their associated field accessibility settings.

• Manage Profiles (more detail below)
• Assign Profiles
• View Field Accessibility
• User Management​

​        

Sharing

The Manage Users permission grants the following sharing-related capabilities, enabling the user to control role hierarchies, public groups, queues, territory assignments, and team management across the organization.

• Manage User Roles
• Manage Forecast Roles
• Assign Roles
• Manage Public Groups
• Manage ALL Personal Groups
• Assign Public Groups
• Manage Queues
• Assign Queues
• Manage Territories
• Manage Sharing Settings
• Recalc Sharing Rules
• Manage Dimension Categories
• Manage Sales Teams
• Manage Account Teams
• Manage Opportunity Teams

User Management

The Manage Users permission grants the following user management capabilities, allowing the user to create and edit internal and portal users, manage passwords and login settings, assign licenses, and control user sessions.

• Create/Edit Internal User and have access to all User fields
• Manage Hierarchical User Fields
• Assign License
• Activate User
• Expire All Passwords
• Set Org Password Policies
• Reset User Password
• Reset Username
• Reset Email
• Assign Mobile Configuration
• Assign Workflow Manager Field
• Manage a User's Divisions
• Manage a User's OAuth
• Remove user sessions
• View Login History
• View Training History
• Delegated Portal Administration
• Create/Edit Portal User
• Manage Customer User
• Change the Account Name on Portal enabled contact records
• Enable, Disable, View, Login as Community/Portal Users

Other Permissions

The Manage Users permission also enables the following additional capabilities that do not fall under Profiles, Sharing, or User Management.

• Manage Opportunity Update Reminders
• Activate Opportunity Update Reminders
• Manage SAML (Security Assertion Markup Language) Subject
• Mass Emailing Users

The rights to manage a profile are more complex than most setup objects need. Many permissions control access to manage all aspects of the Profile, because of the various relationships between setup components and the profile. There are specific permissions to manage different controls within a profile. To be safe, an admin with both Customize Application and Manage Users can manage all aspects of a profile. If a user only has Manage Users, they can:  

Clone or delete a profile or change any of the following:

• Properties (Description/Name)
• Page Layouts
• Record Types
• Tab Settings
• Assigned Apps
• User Permissions
• Desktop Client Access
• Login Hours

If a user has both Manage Users and Customize Application, they can also change the following:

• Object Permissions
• Field Permissions
• Apex Class Access
• Visualforce Page Access