orgadmin.ai

User Management

Salesforce user management: clone, bulk-deactivate, and audit

Create new users as copies of one that already works — profile, role, permission sets and permission set groups, each tickable so you can see exactly what travels. Then manage the whole list in bulk and review the security signals behind it.

Start free trialSee pricing
Salesforce Setup lists your users but deactivates them one at a time, so the quarterly access clean-up never quite happens. The list filtered to 90-plus days idle, six accounts ticked and Deactivate armed — including a System Administrator who has never logged in at all. Activate is greyed out because every selected user is already active. The tiles count all 248 fetched users, not the six on screen.

What you can do

  • Clone an existing user into one or many new accounts in a single run
  • Choose exactly what carries over: profile, role, permission sets, permission set groups, public groups, queues, locale and time zone, manager, and division, department and title
  • See the source user’s real permission sets, groups and queues by name before you tick them, so a clone is never a black box
  • Welcome emails are off unless you turn them on for that run, and the switch tells you how many real inboxes it will reach
  • Per-row results: one duplicate username never discards the rest of the batch
  • The full user list, sortable by name, username, profile, role, created date, last login and status
  • Filter by profile, role, status, and by date — never logged in, idle 30+ or 90+ days, created in the last week
  • Activate or deactivate any number of users in one action, with each refusal reported and explained
  • The Salesforce user your connection authenticates as is never deactivated, so you cannot lock the app out of your own org
  • A user health report: dormant accounts, accounts that have never logged in, frozen and password-locked users, and stale passwords
  • Elevated-access review that names who holds Modify All Data, View All Data or Manage Users, and via which profile or permission set
  • The sharpest signal on the page: dormant accounts that still hold elevated permissions
  • Login locations by country, with rare origins flagged, plus failed logins grouped by reason and by user
  • Licence consumption against what you actually hold

How it works

1

Pick the user to copy

Choose an active user whose access is already right for the role you are filling. The app reads their profile, role, assignments and group membership.

2

Tick what to copy

Every permission set, group and queue is listed by name with its own tick box. Anything that widens record visibility is flagged and off by default.

3

Add the new people

Add a row per user. Usernames prefill from the email address and are checked for format and duplicates before anything is sent.

4

Create, then manage

Users are created with per-row results. From then on the list handles the rest of the lifecycle, and the health tab tells you which accounts to revisit.

Why it's different

A clone you can see inside, and a deactivate you cannot regret

Setup clones a user as an opaque copy and makes you deactivate one row at a time. Here, every grant that would travel is listed by name with its own tick box — including the ones that quietly widen record access — and welcome emails stay off until you opt in for that run. Bulk changes go through a client that may only ever write User, permission-set-assignment and group-member records, and it refuses to deactivate the account your own connection signs in as. A mistake costs you a reactivation, not your access to the org.

Try asking

  • Onboard five new sales reps as exact copies of a rep whose access already works
  • Find every account that has not logged in for 90 days and deactivate them together
  • Answer “who in this org can Modify All Data?” without clicking through profiles
  • Spot the dormant admin account nobody remembered was still active
  • Check whether anyone signed in from a country your team does not work in
  • Free up licences before the renewal conversation

User Management — questions

Yes, if you tick them. Permission sets and permission set groups are listed separately, and a set that only reaches the source user through a group is not copied twice. Grants that come with the profile arrive with the profile.

Not unless you switch it on for that run. The default is off: accounts are created quietly and you can send a password reset when the person actually starts. Your org’s own new-user notification settings still apply.

The rest still succeed. Each row reports its own outcome, so a duplicate username or an exhausted licence is itemised against that person while everyone else is created normally.

No. That user is filtered out of any bulk deactivation on the server and flagged in the list, because deactivating it would cut off the app’s access to your org with no way back in.

Browsing the list and running the health report needs workspace access. Creating or deactivating requires owner or admin, and the deployment must have writes enabled. Every change is audit-logged.

Works even better with

Permissions Workbench

Every profile and permission set in one matrix. Bulk-edit straight from it.

Learn more

Security Review

Fourteen modules, severity-ranked, exportable.

Learn more

Adoption Tracker

Did anyone use the thing you built?

Learn more

Read next

Put User Management to work on your org

Every AI feature on your own provider key, from A$14.99 per user per month.

Start free trialSee pricing
  • 14-day free trial
  • No credit card required
  • Cancel any time