Why Your Salesforce Org Has More Admins Than You Think

As a senior Salesforce administrator, I've seen it all. Organizations often assume that their user base is composed of just employees and contractors with varying levels of access. However, once we peel back the layers, a surprising number of additional users are hidden within the organization's Salesforce org. These "shadow" users can include old test accounts, abandoned developer profiles, or even dormant external sharing records.

In this article, I'll walk you through some common ways these extra users creep into your org and provide specific steps to identify them using SOQL queries. By understanding and addressing these hidden users, you can maintain a cleaner and more secure environment, optimize license usage, and improve overall org performance.

The Hidden Users in Your Org

1. Dormant Test Accounts

Test accounts are often created during development phases but forgotten once the project is completed. These accounts might still have access to critical data or permissions that could pose a security risk if left unattended.

2. Abandoned Developer Profiles

Developers and contractors who leave an organization sometimes take their profiles with them, leaving behind unused developer accounts that can inadvertently gain access rights.

3. Dormant External Sharing Records

External users who have been removed but whose sharing records remain active can continue to access data within the org, potentially leading to information leaks or security breaches.

Identifying Hidden Users

To uncover these hidden users, we'll use SOQL queries and a custom Apex class. Let's start by identifying dormant test accounts and abandoned developer profiles.

Step 1: Identify Dormant Test Accounts

First, we need to find out which user records might be old or inactive. A common approach is to look for users who haven't logged in for an extended period.

SELECT Id, Username, LastLoginDate 
FROM User 
WHERE IsActive = true AND Profile.Name != 'System Administrator' AND LastLoginDate < LAST_N_DAYS:365;

This query will return a list of active users who have not logged in within the last year and are not system administrators.

Step 2: Identify Abandoned Developer Profiles

Next, we'll focus on profiles that might be associated with former employees or contractors. Typically, these profiles might still exist but no longer belong to any user.

SELECT Id, Name 
FROM Profile 
WHERE Description LIKE '%Developer%' AND UserLicense.Name NOT IN ('System Administrator', 'Salesforce');

This query identifies developer profiles where the UserLicense is not a system administrator or Salesforce license. This could indicate abandoned developer profiles that still need to be cleaned up.

Step 3: Identify Dormant External Sharing Records

Lastly, let's check for dormant external sharing records by identifying users who have been removed but whose shares remain active.

SELECT Id, SobjectType, ParentId, UserOrGroupId 
FROMSharingSubscription 
WHERE UserOrGroupId NOT IN (SELECT Id FROM User) AND RecordType.Name = 'External Sharing';

This SOQL query helps identify external sharing subscriptions that are no longer associated with any existing user or group.

Implementing a Custom Apex Class

To automate the process of identifying these hidden users, we can create a custom Apex class. This script will run as a batch job and log all identified records to a custom object for further review.

global class IdentifyHiddenUsers implements Database.Batchable<sObject> {
    global Database.QueryLocator start(Database.BatchableContext BC) {
        // Define SOQL queries here
        String query1 = 'SELECT Id, Username, LastLoginDate FROM User WHERE IsActive = true AND Profile.Name != \'System Administrator\' AND LastLoginDate < LAST_N_DAYS:365';
        String query2 = 'SELECT Id, Name FROM Profile WHERE Description LIKE \'%Developer%\' AND UserLicense.Name NOT IN (\'System Administrator\', \'Salesforce\')';
        String query3 = 'SELECT Id, SobjectType, ParentId, UserOrGroupId FROM SharingSubscription WHERE UserOrGroupId NOT IN (SELECT Id FROM User) AND RecordType.Name = \'External Sharing\'';

        return Database.getQueryLocator([query1]);
    }

    global void execute(Database.BatchableContext BC, List<sObject> scope) {
        List<User> users = (List<User>)scope;
        // Process and log the identified users
        for(User u : users) {
            System.debug('User: ' + u.Username);
        }
    }

    global void finish(Database.BatchableContext BC) {
        // Additional cleanup steps or logging can be done here
    }
}

To run this batch job, you would need to schedule it via the Salesforce UI or use a tool like DataLoader.

Using Org Scanner for Automated Analysis

For a more comprehensive and automated approach, consider using tools like OrgScanner (https://orgscanner.dev/?utm_source=devto&utm_medium=content&utm_campaign=free_blitz). This free service can help you identify hidden users, unused objects, and other potential issues in your Salesforce org. By integrating with the Salesforce API, it provides a detailed report that highlights areas for optimization.

Conclusion

Identifying and addressing hidden users is crucial for maintaining a secure and efficient Salesforce environment. By leveraging SOQL queries and custom Apex classes, you can take control of these rogue accounts and improve overall org performance. Don't let dormant users hide in plain sight—take action today!

Try the free scanner at https://orgscanner.dev/?utm_source=devto&utm_medium=content&utm_campaign=free_blitz

Happy administering!