The implementation partner left two years ago. Its account in your Salesforce is still active
In almost every system I take over, I find an active account belonging to someone who stopped working with the company long ago. Usually with full rights. Usually nobody remembers it.
Where they come from
The implementation partner gets an administrator account for the duration of the project. The project ends, the invoice is paid, the consultants move on to the next client. The account stays, because switching it off is on nobody’s task list. A year later the only employee who knew the account existed leaves too.
The second variety: an integration account set up “just for a moment” to connect the website or a mailing tool, with a password known to three people, two of whom no longer work at the company. The third: a shared login such as [email protected] that every new sales rep uses, because that is how it has always been done.
Why it matters
- Access. Anyone who knows the password can get in. A former consultant, a former employee, someone who found the password in an old email.
- Licences. An active account is a paid licence. Three forgotten accounts are three licences you pay for every month and nobody uses.
- AI. If someone connects an agent or an AI tool to such an account, it inherits its permissions. An account left by an implementation partner almost always has full ones.
- Accountability. When something disappears from the system, the log will show “Implementation Partner Ltd”. Fine if it really was them. Worse if someone else used their account.
How to find them in 10 minutes
- The user list filtered to “active”, sorted by last login date. Any account with no login for 90 days is a candidate.
- Filter by the System Administrator profile. How many are there? In a company with up to 50 users there should be two, three at most.
- Email addresses outside your domain. Consultants, agencies, freelancers.
- Accounts with Modify All Data, View All Data, Author Apex or Customize Application granted through permission sets rather than the profile. These are easy to miss.
- Login history for shared accounts: how many different IP addresses in the last month.
What to do with them
Accounts of people who have left: deactivate, do not delete. Deactivation keeps the history and the records they owned. Before deactivating, reassign their records to someone active, otherwise leads and cases are left with no one looking after them.
Integration accounts: check what is connected to them. If nothing, deactivate. If something, change the password, switch on MFA or move to certificate-based authentication, and restrict permissions to what the integration actually uses.
Shared logins: split them into named accounts. Yes, that costs licences. The alternative is not knowing who did what.
How to stop it happening again
One rule: every account has an owner in the company and an expiry date. A consultant gets an account until the end of the project plus one month. With ongoing support I go through the user list once a quarter and send it over for confirmation. It takes a quarter of an hour and settles the matter.
Want to know how many such accounts you have? It is point two of ten in the free audit.