Salesforce Advanced Admin cheat sheet

Organization-wide defaults offer Private, Public Read Only, and Public Read/Write; the internal and external sharing models are configured separately, and guest user access is locked down by the secure guest user record access setting.

The role hierarchy grants record access upward only: users above the record owner inherit the owner's access, while users in sibling roles gain nothing from the hierarchy.

Each user has exactly one profile (required); permission sets are optional and additive, and permission set groups can bundle permission sets while muting individual permissions inside them.

Field-level security resolves to the most permissive value across the user's profile and all assigned permission sets and permission set groups.

Sharing rules can only widen access beyond organization-wide defaults; no sharing rule, manual share, or team can make access more restrictive than the OWD.

Criteria-based sharing rules evaluate record field values; owner-based sharing rules evaluate the record owner's role, role-and-subordinates, or public group membership.

Delegated administrators can be granted Manage Users, Manage Profiles and Permission Sets, Assign Permission Sets, Manage Roles, and Manage Public Groups, but never Modify All Data.

Login IP ranges, trusted IP ranges, and login hours are configured on profiles and can be overridden per permission set.

Multi-factor authentication is required for all internal users; high-assurance session settings and session timeout values are set at the org and profile level.

A master-detail relationship makes the child inherit the parent's sharing and ownership, removes the child's owner field, cascades deletion to children, and enables roll-up summary fields.

A custom object can be on the detail side of at most two master-detail relationships, and master-detail relationships can be nested up to three levels deep.

Roll-up summary fields require a master-detail relationship and support COUNT, SUM, MIN, and MAX over filtered child records.

Lookup relationships keep records independent: no cascade delete, no sharing inheritance, and cross-object formulas are used to read parent values.

A hierarchical relationship is a lookup to the User object only, commonly used for manager or approver self-references.

A validation rule blocks a save when its formula returns TRUE and displays one error message, optionally on a specific field.

Custom metadata type records are deployable through change sets and packages; custom setting values are not deployable and must be recreated in the target org.

In a dependent picklist the controlling field can be a checkbox or picklist but not a multi-select picklist, and dependency is defined in the field dependency matrix.

Big objects store very large data volumes and require a custom index defined at creation; they are queried with Async SOQL rather than standard SOQL.

Setup Audit Trail records setup changes such as permission edits, new fields, and deployments; the UI shows the 20 most recent entries and the last six months can be downloaded as CSV.

Field history tracking can be enabled on up to 20 fields per object, retains data for 18 to 24 months depending on edition, and cannot track formula or roll-up summary fields.

Login History is retained for six months and can be downloaded; it shows IP address, login type, status, and client browser.

Field Audit Trail is a paid add-on that extends field history retention to as long as ten years using retention policies and big objects.

Event Monitoring is a paid add-on that captures API, page view, and login events; event log data is viewable for 30 days in-app and exportable for up to one year.

Apex debug logs expire after 24 hours, and a single debug log is capped at 20 MB.

Security Health Check scores org settings against a Salesforce baseline and highlights risky values such as weak password policies.

Transaction Security Policies evaluate real-time events such as logins and API calls and can block or require a challenge based on condition-builder or Apex conditions.

Data Loader processes up to 5 million records per operation and uses an API batch size of 200 by default, configurable up to 2,000.

The Import Wizard handles up to 50,000 records per run, supports a limited object list (accounts, contacts, leads, solutions, campaign members, custom objects), and cannot be scheduled.

Deleted records remain recoverable from the Recycle Bin for 15 days; after that they can only be restored from a data export backup.

The UI mass delete operation removes up to 250 records at a time for a selected object.

Weekly Data Export produces a set of files that remain downloadable for 48 hours, and the service keeps six weekly and six monthly exports available for download on a rolling basis.

Duplicate management combines matching rules (what counts as a duplicate) with duplicate rules (what happens on save: allow, alert, or block).

Upsert and relationship loading require an external ID field, which stores a unique identifier from an external system and can be used in place of the Salesforce record ID.

Ownership skew exists when one user owns more than 10,000 records of an object that has more than 10,000 records; lookup skew exists when more than 10% of a child object's records point to the same parent.

Cascade delete applies to master-detail children and permanently removes them without placing them in the Recycle Bin.

Order of execution: before-save record-triggered flows, then before-save Apex triggers, then system validation and custom validation rules, then after-save flows and after-save triggers, then commit and post-commit actions.

A before-save flow updates only the triggering record's fields and performs no DML, making it faster than an after-save flow that creates or updates other records.

Because before-save flows run before validation rules, field values set by the flow are evaluated by the object's validation rules.

A flow interview can execute a maximum of 2,000 elements; deeper logic must be split across flows or moved to Apex.

A fault path attached to an element catches the error, allowing the flow to log it or create an error record instead of failing and rolling back.

A scheduled-triggered flow runs at a configured start time and frequency against records returned by its filter conditions and must be activated to take effect.

An asynchronous path in a record-triggered flow runs its elements in a separate transaction after the record is saved, useful for callouts and long-running logic.

Workflow rules and Process Builder are legacy tools being retired; new automation should be built as flows, and existing rules should be migrated.

Change sets deploy from a sandbox to production or between sandboxes joined by an authorized deployment connection; they cannot delete components in the target org.

Production deployments require at least 75% org-wide Apex code coverage and no Apex class or trigger with 0% coverage.

The RunLocalTests test level runs every test in the org except tests from installed managed packages and is the standard choice for production deployments.

A validation-only deployment runs tests and metadata checks without committing changes to the target org.

Sandbox refresh intervals: Developer and Developer Pro every 1 day; Partial Copy and Full Copy every 29 days. A Partial Copy sandbox includes a template-driven data sample of up to 5 GB.

Deleting metadata in a target org requires the Metadata API with a destructiveChanges.xml manifest, because change sets cannot remove components.

Source tracking is available in scratch orgs and source-tracked sandboxes, enabling the Salesforce CLI to push and pull only changed metadata components.

Unlocked packages support modular, versioned delivery of metadata with upgrade paths, while managed packages are used for distributing to other orgs.

Only one lead assignment rule and one case assignment rule can be active at a time, and rule entries are evaluated in their listed order.

Lead conversion creates or matches an account and contact and optionally an opportunity, mapping lead fields to those records; converted leads become read-only.

A support process defines the status picklist values available for a case record type, allowing different case lifecycles in the same org.

Entitlements pair with entitlement processes and milestones to track service-level targets such as first response and resolution times on cases.

Omni-Channel routes work items by routing configuration, agent capacity, skills, and presence status instead of leaving items in a queue for manual claiming.

Queues can own cases and leads; queue members gain access through membership, and members can be users, roles, roles-and-subordinates, or public groups.

Web-to-Case accepts up to 5,000 case submissions per day per org and requires the case origin and default owner to be configured.

Sales stages map to forecast categories, and each opportunity record type can use a different sales process with its own stage values.

Path exposes a guided set of key fields per stage on leads, opportunities, and cases and is configured per record type.

Organization-wide defaults set the baseline access a user has to records they do not own; the external sharing model is configured separately for community and guest users.

The role hierarchy grants access upward only: a user above the owner inherits the owner's record access, while sibling roles receive nothing from the hierarchy.

Profiles are mandatory and permission sets are additive; when multiple grant field access, the most permissive field-level security setting wins.

Sharing rules, manual shares, and teams can only widen access beyond organization-wide defaults and can never restrict it.

Delegated administrators can manage users, profiles, permission sets, roles, and public groups for selected roles but cannot be given Modify All Data.