Administrator Accounts in Government Cloud

Available in: Enterprise and Unlimited Editions

Version	1.0
Last Updated	May 2026

In Salesforce, the administrator is the top-level user responsible for managing all aspects of a Salesforce Organization (Org). Administrators control user access, security settings, custom objects, workflows, and compliance configurations. Every Salesforce org must have at least one administrator. In a security and compliance context, the administrator role carries significant responsibility: misconfigured or over-privileged accounts can expose an agency to unauthorized data access or compliance risk.

Administrators have special configuration and security permissions:

• Create, edit, and deactivate users; reset passwords; grant and manage user permissions; create custom fields.
• Establish and manage critical security settings such as Multi-Factor Authentication, Password Policies, Session Settings, Data Sharing, and Certificate/Key Management.
• Create custom Salesforce objects, workflows, validation rules, and reports.

Governing the full account lifecycle—who has administrative access, what they are permitted to do, and how accounts are retired when users depart—is the core discipline covered by this article set. Agencies should apply four operating principles across the lifecycle:

• Usage Conditions: Administrator accounts should be used strictly for administrative tasks. Non-administrative accounts should be used for day-to-day work that does not require elevated privileges.
• Least Privilege: Assign the minimum administrative permissions necessary to accomplish assigned tasks in accordance with mission and business need.
• Segregation of Duties: Use profiles, roles, groups, and object-level permissions to ensure no single administrator holds unlimited authority over all system functions.
• Periodic Review: Validate the necessity of permissions assigned to administrative users on a regular basis. Regularly review Login History and Audit Trail entries for unexpected or suspicious activity

Agencies should also designate a backup administrator to prevent single points of failure and protect against operational lock-out if the primary administrator is unavailable.

• Manage Administrator Accounts in Government Cloud
  Configure, operate, delegate, and decommission administrator accounts in your Salesforce Government Cloud Plus org following FedRAMP-aligned best practices. These procedures cover the full account lifecycle—from adjusting privileges and setting up delegate admins to deactivating departed users and freezing accounts when immediate deactivation is not possible.