Distributed Administration using Sandbox and Change Sets - Story From: Recent Ideas

One of the primary use cases I hear with distributed administration is the ability to delegate customization access to some setup (metadata) components.  This often includes components like objects, fields, record types, page layouts, workflow rules, etc. that the business wants to control and have a quick turnaround in production.  The source of frustration for the business is that it usually has to wait for a bandwidth challenged System Administrator to make all of their changes. The challenge for the System Administrator is how to ensure that the business doesn't do something that could damage other users, such as deleting a field required in an integration.

While the Customize Application permission governs a user's rights to manage these setup components, and it's possible to distribute this right over a custom object using Delegated Administration, there aren't many options for managing custom components on standard objects or non-object configurations from setup that ensure the level of control and testing that most System Administrators require.

As an alternative to granting the Customize Application permission to the business users or having the business communicating all of their changes in detail for the System Administrator to make, it is possible to use a developer sandbox to distribute the rights necessary for business users or delegated administrators to manage their components. You would not want to give them a full sandbox copy because the System Administrator profile will ignore all sharing configurations and give those delegated administrators access to *all* data within the org.

When a business user wants to manage some aspect of the application, you would:

1. Create a developer sandbox for the request (don't reuse a sandbox that was created for a separate purpose).
2. Name the sandbox after the user/business group making the request.
3. Activate the sandbox.
4. Give the business user the System Administrator profile making them a delegated administrator over this one sandbox.
5. Train the distributed administrator how to make changes in the sandbox and create a change set.
6. Let the distributed administrator make changes to their sandbox setup.
7. Have the distributed administrator upload their change set to production.
8. Review the changes that the user has included in the change set to ensure they do not disrupt anything like an integration or Apex.
9. Deploy the change set to production.
10. Make any additional changes that weren't included in the change set (for instance, a change to the role hierarchy or sharing rules).

The advantages of this solution are:

• You can grant full administrative rights to a user in a controlled environment without giving them access to *all* data or full administrative rights in production.
• You can review any changes to ensure the integrity of the production org, which is a benefit to the distributed administrator who made the changes (after all, if something were to break as a result of the distributed administrator's changes, they may be affected as well).
• The change set remains active in the org for a period of time allowing for an audit of changes (beyond the setup audit trail).
• This process is an optimization over the existing one where you have to create an efficient communication channel for the business to describe all of the changes that need to be made. So a slight delay between when the delegated admin uploads their change set and when it's been reviewed/deployed, is still less time than if the delegated admin had to document all of the changes and communicate them, especially where the changes are routine (i.e. creating several fields or modifying a page layout).

The disadvantages of this solution are:

• There is a slight delay between when the business uploads the change set and when it gets deployed after being reviewed. While maintaining the integrity of the org make senses, it can be frustrating when the change is perceived by the business to be minor, such as adding a field or changing a field property on a page layout.
• Not all metadata is supported in the metadata API which means some manual changes may need to be made in the production org.
• To enable the distributed administrator to upload a change set, you need to give them full rights in that sandbox, including the ability to manage users or modify all data.

What other practices have you found helpful distributing administrative rights?

Feel free to share them in the comments of this blog!

If you have suggestions for additional distributed administration features, please post them on the ideaexchange (http://sites.force.com/ideaexchange/ideaHome?c=09a30000000D9xt).

CRM Software Free Trial – Your CRM online guide to Web-based Contact Management Software Free Internet Trials and the latest news, article, reviews & comparisons.

CRM Software Free Trial – Your CRM online guide to Web-based Contact Management Software Free Internet Trials and the latest news, article, reviews & comparisons.

Post Footer automatically generated by Add Post Footer Plugin for wordpress.

“We here at the “Web-Based Contact Management Software News, Reviews” are posting for your consumption the latest blog posts from the major Web-Based CRM Software vendors around the world who are focused on the development of products that enhance your CRM experience.” enjoy

——————————

Post Name:
Distributed Administration using Sandbox and Change Sets – Story From: Recent Ideas
* If Needed – To Read the Full Story: (post’s here may be limited by vendor’s RSS feed) – Highlight above post’s blue title, right click and search with google.

Listed Related posts:

1. What can Modify All Data really do? - Story From: Recent Ideas I had this question come up last Friday: "What can Modify All Data really do?" We all know this permission to mean, "system administrator".  But we rarely look at the detail of what makes up the...
2. What can Manage Users permission do? - Story From: Recent Ideas I had a question come up yesterday regarding what the Manage Users permission on a profile actually enables a user to do.  It turns out that it allows a user to do a lot of things...
3. Summer ‘10 Sandbox Preview Window FAQs - Story From: Recent Ideas Frequently Asked Questions Question: What happens to my Summer ‘10 Preview if I submit a sandbox refresh during the Sandbox Preview Window (after 12:01 AM PDT, May 1, 2010)? Answer: Please note, if you submit a...
4. How do I reduce the number of people with View All Data permission? - Story From: Recent Ideas I had this question come up today: "We have over one hundred people in our org with View All Data. This is too many and represents a potential security risk. How can I reduce the number...
5. AppExchange Summer ‘10 – Partner Update - Story From: Recent Ideas The AppExchange development team has been busy at work for the last 3 months and this weekend, we'll be releasing the fruits of their labor. There are lots of great changes coming with this release, but...
6. Summer ‘10 Patch Release: BlackBerry 11.8.1 & Windows Mobile 11.0.2 Available - Story From: Recent Ideas Two Salesforce Mobile patch releases for Summer '10 are now available. BlackBerry 11.8.1  Fix for custom view columns in related listsFix for Content 'Send Email' link in 4.7+ BlackBerry OS Windows Mobile 11.0.2  Fix for daylight...
7. Reduce users with too much administrative rights [Profile Best Practices] - Story From: Popular Ideas Giving out Modify All Data, Customize App, or Manage Users to other users is like giving the ultimate power in the salesforce.com universe.  And with total power comes... a lot of risk. Ultimately, as organizations...
8. Summer ‘11 Sandbox Preview Window Instructions - Story From: Recent Ideas Summer '11 Sandbox Preview Window Instructions The salesforce.com Summer  ‘11 release is quickly approaching and soon you'll be able to take advantage of exciting new features and functionality!  As a Force.com Sandbox customer, you have th......
9. Summer ‘10 Sandbox Preview Window Instructions - Story From: Recent Ideas The salesforce.com Summer '10 release is quickly approaching and soon you'll be able to take advantage of great new features!  As a Force.com Sandbox customer, you have the opportunity to get early access to Summer ’10...
10. AppExchange All-Star: Rhonda Ross, Audatex - Story From: Recent Ideas Rhonda is the lead Salesforce administrator at Audatex, a Solera Company that delivers technology solutions, shared services, and consulting for the insurance and claims industries.  She's an Advanced Salesforce Administrator and Certified Develop......