The steps for creating a new user are as follows:

To create a new user for your organization, navigate to the user detail page. This page displays the list of all the users in your organization. To navigate to the New User page, go to Your Name | Setup | Administration Setup | Manage Users | Users. Now click on the New User button.

Looking at the top section of the page, you will see the General Information section:

Enter the user's first name, last name, and e-mail address.

The e-mail address automatically becomes the username, but you can change it if you require prior to saving.

Then select a user license, noting that some further options become unavailable depending on the license type you choose. For example, the Marketing User and Allow Forecasting options are not available for Force.com user licenses because the Forecasts and Campaigns tabs are not available to users with that license. Now select a profile from the available list, which depends on the user license you have chosen.

You can enable additional features by selecting one or more of the following checkboxes:

You will not be able to select these features if they are not supported by your user license type. Also, you will be unable to save the new user record if you do not have any remaining licenses available for these features.

At the bottom of the page, there are further sections, which include the Locale Settings section:

Complete the required information and then check the Generate new password and notify user immediately checkbox and save the details by clicking on the Save button. Upon saving, the user's login name and a temporary password are e-mailed via Salesforce.com to the new user.

The following table lists the key standard user fields with the required fields shown in bold:

The Send Apex Warning Emails field is used to send an e-mail to the user when an application that invokes an Apex script experiences issues. This feature can be used during Apex script development to test the amount of resources being used at runtime.

Grant Checkout Access provides a user with access to Checkout. Using Checkout, the user can purchase Salesforce.com licenses, AppExchange application licenses, and other related products. Additionally, within Checkout, the user can view the organization's quotes, installed products, orders, invoices, payments, and contracts.

After saving the User Edit page, you are presented with the details page for the user where you can view the information that was entered:

In the View User Detail page, the following read-only fields and related lists can be seen:

There are also situations where you may feel it appropriate to recycle an active user record, but it is better to deactivate users when they are no longer using Salesforce and create a new record for each new user.

A typical real-world example of recycling a user record, and one to avoid, is sometimes encountered when a sales team is organized into sales territories.

The sales team user records in Salesforce are stamped with a territory indicator and any account records that are located in their particular territory are assigned to the user record (set as the record owner). In this way, the user record simply acts as a container for the territory.

Managing user records in this way results in both audit and maintenance issues. For example, if Tina Fox changes sales territory her personal information (username, password, e-mail, address, phone number, and so on) all has to be transferred to a new user record requiring Tina to reactivate a new password, re-enter both personal details, and all her personal preferences in the Salesforce application.

The issue worsens if the user record (or territory) that Tina is reassigning to, is held by, say, Timothy Little as he would also need to reset his personal details.

This approach leads to a technically complex method of territory reassignment and a very disappointing user experience for your sales team. Fortunately, Salesforce provides features such as criteria-based sharing rules, sales teams, and territory management to better manage the organization of sales territories.

If you have several users to add, you can add more than one at a time. To add multiple users, navigate to Your Name | Setup | Administration Setup | Manage Users | Users. Now click on the Add Multiple Users button.

As you can see, this can be a quick method for creating users since not all required fields have to be entered in this page:

If, however, after the initial saving of multiple user records, you attempt to edit a user record, via the user edit screen, you will be prompted to fill up all mandatory fields.

If you have an organization with a large number of users or a complex role hierarchy, you can delegate aspects of user administration to users who are not assigned with the system administrator profile.

This allows you to focus on tasks other than managing users for every department or structure that your company has within Salesforce. This provides further benefits for global organizations that encounter time zone and cultural differences as it allows a user based in that region with local knowledge to create the users, which saves time and results in a better user experience.

For example, you may want to allow the manager of the Asia Pacific Operations team to create and edit users in the Asia Pacific Operations Team Leader role and all subordinate roles.

There are currently two options for providing this delegated user management access:

This option is not recommended and should be very carefully considered as it allows a much greater range of system administration functions to be carried out by the user.

In addition to creating and managing users, the Manage Users permission also allows the user to perform the following:

By providing users with the Manage Users permission, as you can see, there are many other permissions that are switched on, which introduce security risks.

Delegated administration is a more secure method for providing delegated user management access as it allows you to assign limited administrative privileges to the selected non-administrator users in your organization.

Delegated administrators can perform the following tasks:

To create delegated groups, navigate to Your Name | Setup | Administration Setup | Security Controls | Delegated Administration. Now click on the New button or select the name of an existing delegated administration group:

Here we look at the existing group that has been named User Management:

The Delegated Administrators section allows you to select and add the users that are to be given the delegated administration permission.

The User Administration section allows you to select and add roles which the delegated administrators can assign to the users they create and edit. They can assign users for the stated roles and all subordinated roles.

The Assignable Profiles section allows you to select and add profiles which the delegated administrators can assign to the users they create and edit.

To enforce security, profiles with the Modify All Data permission (such as the System Administrator profile) cannot be assigned by a delegated administrator. See the following example message shown when attempting to allow the delegated administrator to assign the System Administrator profile:

Select the Enable Group for Login Access option, if you want to allow delegated administrators in this group to log in as users who have granted login access to their administrators and are in the roles selected for the delegated administrator group:

To look at how users can grant login access to their administrators, refer to the section Logging in as another user towards the end of this chapter.

To view or edit user information, navigate to Your Name | Setup | Administration Setup | Manage Users | Users. Now, click on Edit next to a user's name. Change the necessary information and click on Save.

Users can also change or add to their own personal information after they log in.

If you change a user's e-mail address and do not select the Generate new password and notify user immediately option, a confirmation message will be sent to the new e-mail address that you entered to verify the change of e-mail. The user must click on the link provided in that message for the new e-mail address to take effect.

If you change a user's e-mail and reset the password for a user at the same time, the new password is automatically sent to the user's new e-mail address, and e-mail verification is not required.

Click on Unlock to unlock a user that is locked out of Salesforce.

You have the following options for resetting passwords for users in Salesforce CRM:

There are several password and login policy features that help you to improve your organization's security. To set these password policies, navigate to Your Name | Setup | Administration Setup | Security Controls | Password Policies. Select the required settings and then click on Save:

Let's look at each of the policies.

To assist other users, you can log in to Salesforce as another user. If you have been granted access, you will see a Login button on their user record if they have granted login access to their administrator.

System administrators can also log in as any user in their organization without asking users to grant login access.

If you have had this feature activated by Salesforce, you can enable login access by navigating to Your Name | Setup | Administration Setup | Security Controls | Login Access Policies. On the Login Access Policies page, enable Administrators Can Log in as Any User. Finally, click on Save.

To log in as another user, navigate to Your Name | Setup | Administration Setup | Manage Users | Users. Now click on the Login link next to the user who has granted you access:

You can also log in as another user from the User Detail page using the Login button as shown in the following screenshot:

The Login link or button only appears for users who have granted login access to an administrator. After you have logged in as another user, you will notice a message at the top-right corner of all Salesforce pages that display the message You are currently logged in as.

To return to your administrator account, click on the logged in user's name (the user who has granted you access, Trevor Howard in this example). Then click on the Logout option:

There are many occasions when it is useful for you to log in as one of the users in your organization. This could be, say, to check data access from their role or profile or to check reports or dashboards and so on.

Rather than instructing individuals one-by-one, you can save time for both yourself and the users in your organization by preparing a how-to guide to help users grant login access to you. Produce a how-to guide that lists the steps that they need to take to make the required setting; the following is an example:

When the Administrators Can Log in as Any User feature is enabled, users will no longer have the option to grant login access to administrators, but they can still grant login access to Salesforce.com support.

Where additional apps have been installed, the list of entities that users can select to grant access may increase. For example, if your organization has installed the Non Profit Starter Pack app published by the Salesforce.com Foundation (see http://www.salesforcefoundation.org/nonprofitstarterpack), you will see the option to grant access to this organization's support team as shown in the following screenshot:

You can create custom fields for users and set custom links that appear on the user detail page. To navigate to the user field's page, go to Your Name | Setup | App Setup | Customize | Users | Fields and then scroll down to the User Custom Fields section:

The User object can be considered as a special object in Salesforce as there are restrictions on what can be configured. For example, there can be only one record type and page layout for the User object.