Your Salesforce admin just left. Here are the first two weeks.

What should you do in the first hour?

Four things, and none of them involve changing how Salesforce works yet.

1. Make sure you still have an admin. Go to Setup, then Users, and look at who has the System Administrator profile. If the person who left was the only one, that's the first problem to fix. Give a second trusted person admin access today. If nobody still with you has it, contact Salesforce Support or your Salesforce account executive now. They'll need to confirm you're authorized for the org before they can help, and that takes time.
2. Freeze their user. On the user's record there's a Freeze button. It stops them logging in without touching anything they own. More on why not to deactivate below.
3. Change the shared passwords they knew. Dialer, texting tool, Zapier, the Gmail or Outlook account used for lead notifications, your website forms. In investor companies these are often shared logins, and the admin had all of them.
4. Check Login History. Setup has a Login History page. If you see their user logging in after they left, or logins from an integration you don't recognize, you know where to look next.

If you're on an investor CRM built on Salesforce, call the vendor too. Ask them, in writing, what they look after and what was your admin's job. Teams often find out at this point that some of the automations were built by their own person on top of the vendor's setup, and the vendor doesn't support those.

Should you freeze or deactivate a Salesforce user who left?

Freeze first. Deactivate later, once you've moved what depends on them.

Freezing only blocks login. Everything they own stays as it is, and every automation that references them keeps working. The catch is that a frozen user still uses a license, so you keep paying for the seat until you deactivate.

Deactivating is where things go wrong if you rush it. Salesforce's own list of things to consider before deactivating a user includes several that hit investor orgs:

• You can't deactivate someone who's the only recipient of a workflow email alert, or who's selected in a custom hierarchy field, until you change those.
• A dashboard whose running user is deactivated can show unexpected results. If your admin built the owner's dashboard and it runs as them, that's your Monday numbers.
• Older Process Builder automations can't update records owned by an inactive user, so any lead or deal still owned by them can quietly stop updating.
• Files they uploaded stay owned by them.
• If they own more than 10,000 records of one object, Salesforce recommends transferring those before you deactivate.

One more thing people don't expect: deactivating frees the license for someone else, but your bill doesn't go down unless you also lower the number of licenses with Salesforce. If you don't plan to backfill the seat, ask your account executive about it at renewal. That's also a good moment to ask about a discount, which teams can often get depending on the business and the number of users.

What runs under their name?

This is the real work of the first week. Most of what an admin builds keeps running without them, but a lot of it reports to them, logs in as them or is owned by them. Go through each row. If nobody left on your team is comfortable in Setup, hand this table to whoever covers Salesforce next. It's the list I'd work through if I took over your org.

While you're in there, open the Automation app (it's in the app launcher in recent releases). Its Monitor tab lists failed and paused flow runs with the reason, which is the fastest way to see whether anything has already started failing since your admin left.

What breaks first in a home-buying company?

I run the Salesforce for a two-market home-buying company in Ohio. If I left tomorrow, these are the things I'd want the next person to check first, because they run every day, they fail without any noise, and the team notices last:

• Missed-call alerts. A seller calls a marketing number, nobody picks up, and the alert that should go to a rep or a Slack channel doesn't fire. You find out when the seller signs with someone else.
• Dialer call sync. Calls stop landing on the seller record. Reps keep working, the record goes quiet, and the "no activity in 7 days" list fills with leads that were actually called.
• New marketing numbers. The admin was the one who added each new call-tracking number and mapped it to a lead source. Nobody does it now, so new campaigns show up as "unknown" and your cost per contract by source drifts without anyone noticing.
• Follow-up that stops on reply. If the text cadence breaks, it either stops for everyone or keeps texting sellers who already answered. The second one is the expensive one.
• Contract and closing alerts. Unsigned DocuSign reminders, title and closing tasks, deadline tasks on deals under contract.
• New hires. Nobody knows how to set up a new rep: user, permission set, dialer, texting, assignment. The new rep ends up working out of a spreadsheet for two weeks.

For each one, do a live test this week: call a marketing number and let it ring out, text a test lead and reply, create a test lead from your web form. Watching it work is faster than reading how it was built.

What should you ask your admin before they go?

If they gave notice and you're on good terms, pay them for a few hours of handover and record the calls. These are the questions I'd ask, and I'd want my own replacement to ask me the same:

1. What breaks most often, and what do you do when it does?
2. What do you check by hand every week that isn't automated?
3. Which logins, API connections or accounts are in your name?
4. Which automations are you nervous about, and why?
5. What's held together with a workaround you meant to fix?
6. Is anything scheduled to run monthly or quarterly that we haven't seen yet?
7. Who else has admin access, and why?
8. Which reports does the owner actually read, and which ones are wrong?
9. What were you halfway through building?
10. If you had a week to rebuild one thing, what would it be?

If they've already gone and won't help, don't panic. Everything below can be worked out from the org itself. It just takes longer.

How do you write down what they built?

You don't need a 40-page document. You need enough that the next person can find their way around without guessing. I'd write three things.

1. A one-page map of how a lead moves

From the first call or form to a closed deal: lead sources, how leads are created, how they're assigned, what follow-up runs, what happens at offer, contract, closing and dispo. For each step, note which automation runs and which report shows it. If you use the Kept-Deal Map, its five stages (spend, answer, follow-up, offer, keep) are a good skeleton.

2. A list of every automation

Setup lists every flow. Put each one in a sheet with one line each: what it does, which object it runs on, whether it's active, and who asked for it, if anyone knows. Add every Zap and Make scenario that touches Salesforce, because those don't show up in Setup at all.

3. A record of recent changes, before it disappears

Download the Setup Audit Trail this week. It's the only record of what your admin changed in Setup, and Salesforce only keeps 180 days of it. After that, the history of how your org got this way is gone. It downloads as a CSV from the View Setup Audit Trail page.

Who covers Salesforce now?

Three honest options, and the right one depends on how much changes in your business month to month:

• Hire a replacement. Right if you have a full week of Salesforce work every week. Hiring takes time, so plan for a gap. My guide to hiring a Salesforce admin for a real estate team has the job post, ten interview questions and salary data.
• A monthly retainer. Right if you have a steady trickle of changes but not a full-time job's worth. It also works as a bridge while you hire. The trade-offs are in hire, freelancer or retainer.
• Your ops lead covers it. Fine for small changes, as long as they have a backup and someone checks the automations every month.

Whatever you choose, make it a rule from now on that two people have admin access, and that nothing important runs as one person's login.

The two-week checklist

Copy this into a task list and tick it off.

Day one

• A second person who's staying has System Administrator access
• Their user is frozen, not deactivated
• Shared passwords they knew are changed (dialer, texting, Zapier, notification inbox, web forms)
• Login History checked for activity after they left
• Vendor called, if you're on an investor CRM built on Salesforce

Week one

• Flow error emails go to Apex Exception Email recipients, with two people listed
• Default Workflow User changed
• Every integration moved to a dedicated integration user
• Connected Apps OAuth Usage checked and unknown apps revoked
• Scheduled reports and dashboards reassigned, and the numbers checked
• Records, queues, assignment rule entries and the default lead owner moved
• Email alerts that go only to them pointed somewhere else
• Scheduled jobs and data exports rescheduled
• Company Information primary contact updated
• Live tests: missed call, text reply, web form lead, a test deal moved to closing
• Automation app Monitor tab checked for failed flow runs

Week two

• Setup Audit Trail downloaded and saved
• One-page lead-to-close map written
• Automation list written, including Zaps and Make scenarios
• Handover questions answered, if they're willing
• Decision made on who covers Salesforce now
• User deactivated, and the license count reviewed with Salesforce

Questions

Related guides

Sources

Checked in October 2026. Salesforce and vendor features change with each release, so check the linked page before you rely on a detail.

1. Salesforce Help: Freeze or unfreeze user accounts. Freezing blocks login and doesn't free the license
2. Salesforce Help: Considerations for deactivating users. What blocks deactivation and what can break
3. Salesforce Ben: Salesforce admin resignation checklist. Flows, default workflow user, scheduled jobs, integration users, company information
4. UnofficialSF: the Automated Process user and the Default Workflow User. Which user scheduled flows and scheduled paths run as
5. Automation Champion: who receives flow error emails. Last modifier by default, or the Apex Exception Email list
6. Salesforce Ben: free Salesforce Integration user licenses. API-only integration users in Enterprise and higher editions
7. Salesforce Developers: Setup Audit Trail (admin security workshop). Setup history and the CSV download
8. Gearset: Salesforce audit trail. 180 days of setup history
9. Milestone: Spring '25 release notes. The Automation app and its Monitor tab for failed and paused flow runs