Administrators and Separation of Duties

While the practice of having one person perform all administrative duties can make sense, it can lead to troubles. For example, what if:

• Your administrator falls ill, and a mission-critical change must be made to your org.
• Your administrator left your company on unhappy terms but is the only person who has the administrator profile credentials.

Prevent possible problems by ensuring that more than one person can perform key administrative tasks. Consider implementing a process to ensure business continuity if your sole administrator is unavailable. You can also delegate administration tasks by assigning a delegated administrator.

• Define Delegate Administrators
  Enable delegated administrators to manage users in specified roles and all subordinate roles. You can assign specified profiles to those users, and log in as users who have granted login access to administrators. A delegated administration group is a group of users who have the same admin privileges. These groups are not related to public groups used for sharing.
• Delegate Administrative Duties
  Use delegated administration to assign limited admin privileges to users in your org who aren’t administrators. For example, let’s say you want the Customer Support team manager to manage users in the Support Manager role and all subordinate roles. Create a delegated admin for this purpose so that you can focus on other administration tasks.
• Delegate Site Administration to an External User
  Delegate the administration of your site to an external user to increase your site’s capacity for growth and reduce bottlenecks. External administrators can add, update, and disable members, and they can reset passwords and manage user permissions.