Security guide · by Amr Magdy · October 2026

Salesforce access for VAs and cold callers.

Real estate teams can give VAs and cold callers exactly the Salesforce access they need with profiles, permission sets, sharing rules and field-level security, and protect the lead list by removing export rights. Here’s what each role should see, which features do it, and a VA onboarding and offboarding checklist.

Short version

Most investor teams have VAs and cold callers, often in other countries. Salesforce lets you give them exactly the access they need: permission sets, sharing rules and field-level security. permission sets
Salesforce enforces multi-factor authentication for all employee logins; production enforcement rolled out July 20 to September 3, 2026. Plan it into VA onboarding. source
Field history tracking shows who changed what, for up to 20 fields per object. source

What should each role see?

Role	Can	Can’t
Cold caller / VA	Create and edit leads in their queue; log calls; set outcome and next date	See deal financials, buyer list, exports, other markets
Acquisitions rep	Own leads and deals; make offers; send contracts	Change lead source after creation; delete records
Dispo rep	See under-contract deals and buyers; send deals; log buyer offers	See seller notes beyond what’s needed
Transaction coordinator	Closing tasks, documents, dates	Edit offer or assignment amounts
Owner / manager	Everything, including reports and fees	—

Which Salesforce security features do this?

Feature	What it does	Edition / limit
Profiles	Default settings for each user; one profile per user	Custom profiles in Professional and up
Permission sets and groups	Add permissions on top of a profile; Salesforce’s recommended approach	All main editions
Sharing rules	Open record access beyond org-wide defaults, by owner or criteria	Professional and up; up to 300 per object
Field-level security	Hide or make read-only specific fields, across UI, reports and API	Professional and up
Login IP ranges	Deny logins from outside set ranges	Per profile in Enterprise and up; Professional needs an add-on for per-profile ranges
MFA	Second factor for every employee login; phishing-resistant for admins	Enforced in 2026
Field history tracking	Who changed a field, from what, to what, when	20 fields per object; 18 months in the UI

Sources: profiles · permission sets · sharing rules · field-level security · login IP ranges · MFA · field history

A VA onboarding and offboarding checklist

Before day one

Create the user with the caller profile and permission set; add to the right queue; confirm MFA method; share the call script and the handoff rules.

First week

Review their call outcomes daily; check the fields they skip; fix the layout before blaming the person.

Ongoing

Weekly calibration: compare their warm and hot leads with what acquisitions found.

Offboarding (same day)

Freeze then deactivate the user; reassign open leads and tasks to the queue; revoke integrations or dialer seats tied to them.

How do you protect your lead list?

Remove the export permission from caller and VA profiles; only owners export.
Give VAs list views, not report builder access, if they don’t need it.
Track changes to lead source, phone and owner with field history.
Keep integration users separate from people, so a departing VA can’t take an API connection with them. API access itself is included in Enterprise and an add-on for Professional. source

The other ways data can leave, and what you can see after the fact, are in stopping reps from exporting your seller list.

Questions

How do I give a VA limited access in Salesforce?

Give them a restricted profile plus a permission set with only what they need, hide sensitive fields with field-level security, and use queues and sharing rules so they see only their leads.

Does Salesforce require MFA for VAs?

Salesforce enforces multi-factor authentication for all employee logins, with production enforcement rolled out from July 20 to September 3, 2026.

Can I stop VAs exporting my leads?

Yes. Export is a permission; leave it off caller and VA profiles and permission sets so only owners can export.

Sources

Stop reps exporting your seller list · Adding acquisitions reps · When your Salesforce admin leaves · Real estate CRM guide · Salesforce features · Integrations · Cold caller handoff checklist · Team capacity calculator

Last updated October 2026. Product names, editions and limits change; check the linked source before you rely on one. Not legal advice.

Want your team’s access set up right?

I build Salesforce for real estate investors and wholesalers, set up around how your team actually works. Start with a free 30-minute call or the fixed-price CRM Revenue Audit (USD 1,500).

Book a free 30-minute call See the Revenue Audit

Already on Salesforce? See a sample audit report. On Podio, REsimpli or GoHighLevel? See how a move to Salesforce works.

Or just ask one question about your setup: email · WhatsApp · LinkedIn