A Salesforce Administrator at an international renewable energy company needs to provision access for a newly contracted auditor. The auditor requires temporary access to view standard Accounts and Contacts, as well as Create and Edit permissions on a custom object named "Energy Audits". Company security guidelines mandate maintaining a minimal number of custom profiles and enforcing the principle of least privilege using additive access control models.
Which administration strategy should the administrator execute to provision this user in alignment with Salesforce best practices?
- Provision the user with a standard baseline profile that grants view access to Accounts and Contacts, and assign a Permission Set that grants Create and Edit permissions on the Energy Audits object.Answer
- BClone the standard user profile to create a dedicated profile named "Auditor Profile" with Create and Edit access enabled for the Energy Audits object, then assign it to the user.
- CAssign the user a standard profile and add the user's explicit IP range under Profile Login IP Ranges to automatically elevate access to the Energy Audits object upon authentication.
- DCreate the user account with a System Administrator profile and immediately freeze the user account whenever audit activities are inactive to restrict daily record edits.
Answer
Assign the user a standard baseline profile providing foundational access to Accounts and Contacts, combined with a Permission Set granting Create and Edit permissions on the custom Energy Audits object.
The recommended approach for provisioning users requiring specialized access beyond their baseline standard role is to assign a baseline profile and extend privileges using Permission Sets. This minimizes profile creation and adheres strictly to Salesforce security design principles.
Step-by-Step Solution
Key Concept
User Provisioning & Permission Set Assignment