Memory hook: A license opens the product; permissions open the work.
Must remember
Company settings establish organizational defaults such as fiscal year, business hours, locale and currency behavior. User locale/time zone can affect presentation independently of company defaults. Business hours influence supported service timing; a fiscal-year change can affect reporting and should not be treated as a cosmetic label.
A user license sets the available product capabilities; feature/permission-set licenses enable eligible additional features. Profiles and permission sets then grant supported permissions within those entitlements. Adding a permission cannot bypass a missing license. Usernames must satisfy Salesforce uniqueness requirements and need not equal the person's working email address.
Freeze a user to block login promptly when appropriate; deactivate to remove active access and release the relevant user license under the platform's rules. Users are normally deactivated rather than deleted so ownership/history remains attributable. Transfer or review owned records, automation, schedules and integration dependencies before deactivation. Freezing alone does not free the license.
Login hours, IP restrictions, identity verification, MFA/federated login and session settings address different boundaries. A trusted network setting is not identical to a profile IP restriction. Test the actual login method and user context, including integrations and agent identities, before concluding access is blocked correctly.
Setup Audit Trail records configuration changes; login history helps diagnose authentication attempts. Neither is a complete history of every data-record change. Select evidence for the question, retain appropriate administrative records and limit powerful setup permissions.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Temporarily stop a user logging in | Freeze, while resolving deactivation dependencies. |
| Feature unavailable despite assigned permissions | Check user and feature license entitlements. |
| Investigate who changed setup | Setup Audit Trail. |
Traps
- Freezing a user does not release the license.
- User locale and org defaults are not always identical.
Active recall
1. License versus permission?
Product entitlement versus allowed operations within that entitlement.
2. Why deactivate instead of delete?
To preserve record/history attribution while removing active access.
3. Why review dependencies first?
Scheduled work, ownership and integrations may depend on that user.
4. Login history versus Setup Audit Trail?
Authentication attempts versus administrative configuration changes.
5. Why test different login methods?
SSO, interactive login and integrations can have different policy paths.