Body
Salesforce access is checked every quarter, and it is removed when someone leaves. This page explains both. It's for anyone with Salesforce access, and especially for department heads and managers.
The quarterly access review
Every quarter, the Salesforce team checks who still needs access. This is an audit requirement, and it is also part of each Salesforce renewal.
What is reviewed
| System |
What it is |
| Salesforce |
The college's CRM, used by many departments |
| Pardot (Account Engagement) |
Email marketing and prospect tracking, synced with Salesforce |
| SUMO |
Appointment scheduling in Salesforce, mainly for Admissions |
| Nintex |
Creates letters, PDFs and other documents from Salesforce data |
| Linvio |
Event management in Salesforce for free events, mainly for Admissions |
| Mogli |
Text messaging with MBA and EMBA applicants who opt in |
| Cvent |
Paid event management, used across the college and university |
| NextGen Dynamic Forms |
Student request forms processed by Student Services and the Registrar |
What department heads do
The Salesforce team sends each department head (or the system's owner) the list of active users in their department. Review the list and reply with anyone who no longer needs access, or whose access should change.
What happens without asking
- Inactive users. If a department has only a few users and someone hasn't logged in for six months or more, they may be deactivated without an email.
- Former faculty with a Salesforce login are deactivated.
- Sponsored NetIDs. For someone using a sponsored NetID, the sponsor is asked whether they still need access.
Why your department matters
Every Salesforce user has a department on their user record, and the review is grouped by it. If you move to a different department, or your role changes, submit a ticket so your access and department can be updated.
When someone leaves
College policy: anyone who leaves the college or Cornell has their access removed within 30 days.
What starts it
The offboarding request for the person creates a task for the Salesforce team. You don't need a separate Salesforce request.
What the Salesforce team does
- Finds their accounts in Salesforce, Pardot and Cvent.
- Checks whether they own records, such as accounts, contacts, leads, applications, engagements or events.
- Reassigns those records to the person their department has named to take them over. For Centers and Institutes, records go to the center's director. If they own records, their login is frozen first, so nobody can sign in while the records are reassigned.
- Deactivates the login, removes them from account teams, and frees their SUMO and Nintex licenses. Linvio and Mogli access ends with the deactivation.
- Records what was done on the offboarding task, for the audit trail.
Once a login is deactivated, the person's name stays on the records and activity they created. Nothing they logged is deleted.