Use Case: Auto-Assign Admin Right
Today we are sharing how to use a flow to auto-assign the admin profile for only a specified period. I find this case very interesting, because the solution itself is not hard to build but it could be helpful for many orgs. But before you decide to implement this solution, make sure to do proper risk assessment. Admin profile is very powerful and should not be assigned without governance. You should evaluate other solutions (ex. Delegated Administration) and take this solution as the last resort.
* Big thanks to Zygmunt for sending in the case!
Lulu Mobile has an org with many users and a group of part-time admins. These part-time admins work case by case, and Lulu Mobile only wants to give them the admin right when there is a case. They want to track how many requests these part-time admins have made, and assign them the admin profile based on the specified time range.
They decided to create a custom object called Admin Right Request. It has fields like Start Date, End Date, Requester, etc.
The part-time admins can ask for access by creating a Request record, while only the master admin can approve it. Once a request is approved, the requester should receive the admin profile on the Start Date, and get the original profile back on the End Date.
We will use a Record-Triggered flow and run it on the Admin Right Request object. We will use three different schedule paths to achieve this requirement.
To change the profile of a user, you can simply change the ProfileId field on the User record.
Notes:
- You can add more fields on the Request record to track more detailed status (ex. Request Stage or Actual Assigning Date/Times)
- Remember to set up proper validation rules so only specific people can approve and modify the request
| Record-Triggered | Get Records |
| Scheduled Path | Update Records |
Does the solution solve your problem? If not, write us what your problem is and we will build the flow for you!