UserManagement Class

Contains methods to manage end users, for example, to register verification methods or handle requests for Salesforce to forget them.

Namespace

System

Usage

Use the register and deregister methods to for your users to register and deregister identity verification methods. Use the obfuscateUser method to scramble user object data on a user’s request. Use the formatPhoneNumber method to ensure the phone number properly formatted.

This class is introduced in API version 43.0. It isn't available in earlier versions.

UserManagement Methods

The following are methods for UserManagement.

  • clone()
    Makes a duplicate copy of the System.UserManagement object.
  • deregisterVerificationMethod(userId, method)
    Deregisters an identity verification method. Use this method to allow users to delete an existing verification method.
  • formatPhoneNumber(countryCode, phoneNumber)
    Formats a mobile phone number for a user. Call this method to ensure that the phone number is formatted properly before updating a user’s mobile phone number.
  • obfuscateUser(userId, username)
    Scrambles users’ data on their request when they no longer want their personal data recognized in Salesforce. When you invoke the method for the user, the data becomes anonymous, and you can never recover it. Use this method to set the username to a specific value after it’s scrambled.
  • obfuscateUser(userId)
    Scrambles users’ data on their request when they no longer want their personal data recognized in Salesforce. When you invoke the method for the user, the data becomes anonymous, and you can never recover it.
  • registerVerificationMethod(method, startUrl)
    Registers an identity verification method. Verification methods include a time-based one-time password, email or text one-time password, Salesforce Authenticator, or U2F. End users register their verification methods.

clone()

Makes a duplicate copy of the System.UserManagement object.

Signature

public Object clone()

Return Value

Type: User Management

deregisterVerificationMethod(userId, method)

Deregisters an identity verification method. Use this method to allow users to delete an existing verification method.

Signature

public static void deregisterVerificationMethod(Id userId, Auth.VerificationMethod method)

Parameters

userId
Type: Id
User ID of the user deregistering the verification method.
method
Type: Auth.VerificationMethod
Verification method used to verify the identity of the user.

Return Value

Type: void

Usage

Use this method to deregister an existing identity verification method. For example, your users can deregister a phone number when their phone number changes. While only end users can register an identity verification method, you and your users can deregister one. Keep this behavior in mind when you implement a custom registration page.

This method is introduced in API version 43.0. It isn't available in earlier versions.

formatPhoneNumber(countryCode, phoneNumber)

Formats a mobile phone number for a user. Call this method to ensure that the phone number is formatted properly before updating a user’s mobile phone number.

Signature

global static String formatPhoneNumber(String countryCode, String phoneNumber)

Parameters

countryCode
Type: String
A valid country code.
phoneNumber
Type: String
A mobile number that contains from 3 through 49 numeric characters, without the country code. For example, (415) 555-1234.

Return Value

Type: String

Returns a user’s mobile phone number in the proper format.

Usage

Use this method to ensure a user’s mobile phone number is formatted as required by Salesforce. Then use the method’s return value to update the mobile field of the user’s record. This mobile number is used for SMS-based identity confirmation. For example, mobile phone numbers are stored along with other identity verification methods in Auth.VerificationMethod enum. This method is introduced in API version 43.0. It isn't available in earlier versions.

Here are some acceptable ways that users can enter their mobile number:

  • +1, (415) 555-1234 (with plus signs, parentheses, and dashes)
  • 1, 4155551234 (only numbers, no symbols)
  • 1 , 415-555-1234 (extra spaces)

Now, consider the following examples.

  • Correct examples:
    • formatPhoneNumber('1', '4155551234');
    • formatPhoneNumber('+1','(415) 555-1234');
    • formatPhoneNumber('1', '415-555-1234');
  • Incorrect example, because the country code and mobile number aren’t separated:
    • formatPhoneNumber(null, '+1 415-555-1234');
  • Example that doesn’t generate an error, but likely won’t work as intended:
    • formatPhoneNumber('+1', '+1 (415) 555-1234');

Format Phone Number Code Example

Here's a code example that uses the formatPhoneNumber method. It gets the mobile number from the user and converts it to the format required by Salesforce. Then it updates the user’s record with the formatted mobile number.

global with sharing class PhoneRegistrationController {
    //Input variables 
    global String countryCode {get; set;}
    global String phoneNumber {get; set;}

    global String addPhoneNumber() 
    {
        if(countryCode == null) return 'Country code is required';
        if(phoneNumber == null) return 'Phone number is required';
        
        String userId = UserInfo.getUserId();
        User u = [SELECT Id FROM User WHERE Id=:userId LIMIT 1];
        String formatNum = System.UserManagement.formatPhoneNumber(countryCode, phoneNumber);        
        u.MobilePhone = formatNum;        
        update u;        
        return null;        
    }
        
}

As long as the country code and phone number are separated, formatPhoneNumber returns a value in the proper format.

obfuscateUser(userId, username)

Scrambles users’ data on their request when they no longer want their personal data recognized in Salesforce. When you invoke the method for the user, the data becomes anonymous, and you can never recover it. Use this method to set the username to a specific value after it’s scrambled.

Signature

public static void obfuscateUser(Id userId, String username)

Parameters

userId
Type: Id
ID of the user whose data this method scrambles.
username
Type: String
The username after the user’s data is scrambled. Sets the value of the scrambled username to a specific string.

Return Value

Type: void

Usage

This method is introduced in API version 43.0. It isn't available in earlier versions.

You can use the obfuscateUser method to protect the personal information of your org’s users. When invoked, Salesforce permanently scrambles the user’s object data and replaces it with random character strings. The user’s detail page exists, but the fields contain meaningless strings of characters. Salesforce merely obfuscates (scrambles) personal data because you can't delete a user in Salesforce; you can only disable or deactivate a user. In other words, the user record remains in the database and this method performs a soft delete.

Note

Note

Take care when using this method. The users’ data becomes anonymous and can never be recovered.

Considerations

  • This method requires that the org’s User Management setting, Scramble Specific Users' Data, is enabled from Setup.
  • This method affects the standard fields of the user object—excluding a few fields such as the user ID, timezone, locale, and profile.
  • It is recommended that you note the user's ID and other attributes for post processing, such as the email address, if you want to send the user a confirmation.
  • This method changes only the user object. The association between the user and other objects is removed, but no other objects are changed. For example, contact, ThirdPartyAccountLink (TPAL), and user password authentication (UPA) objects remain unchanged.
Note

Note

Assure your admins that invoking this method doesn’t trigger an email change notification.

This method is part of our effort to protect users’ personal data and privacy. For more information on what you can do to actively protect user data, see Data Protection and Privacy in Salesforce Help.

obfuscateUser(userId)

Scrambles users’ data on their request when they no longer want their personal data recognized in Salesforce. When you invoke the method for the user, the data becomes anonymous, and you can never recover it.

Signature

public static void obfuscateUser(Id userId)

Parameters

userId
Type: Id
ID of the user whose data this method scrambles.

Return Value

Type: void

Usage

This method is introduced in API version 43.0. It isn't available in earlier versions.

You can use the obfuscateUser method to protect the personal information of your org’s users. When invoked, Salesforce permanently scrambles the user’s object data and replaces it with random character strings. The user’s detail page exists, but the fields contain meaningless strings of characters. Salesforce merely obfuscates (scrambles) personal data because you can't delete a user in Salesforce; you can only disable or deactivate a user. In other words, the user record remains in the database and this method performs a soft delete.

Note

Note

Take care when using this method. The users’ data becomes anonymous and can never be recovered.

Considerations

  • This method requires that the org’s User Management setting, Scramble Specific Users' Data, is enabled from Setup.
  • This method affects the standard fields of the user object—excluding a few fields such as the user ID, timezone, locale, and profile.
  • It is recommended that you note the user's ID and other attributes for post processing, such as the email address, if you want to send the user a confirmation.
  • This method changes only the user object. The association between the user and other objects is removed, but no other objects are changed. For example, contact, ThirdPartyAccountLink (TPAL), and user password authentication (UPA) objects remain unchanged.
Note

Note

Assure your admins that invoking this method doesn’t trigger an email change notification.

This method is part of our effort to protect users’ personal data and privacy. For more information on what you can do to actively protect user data, see Data Protection and Privacy in Salesforce Help.

ObfuscateUser Code Example

public class UserManagementController{
    public List <User> users {get; set;}
    
    public UserManagementController()
    {
        Profile p = [select id from profile where name = 'Customer Community User'];
        
        users = [select username, id from User where profileId=:p.id AND isactive=true];
    }

    //Use method with extreme caution. Data can't be recovered.   
    @InvocableMethod(label='User Management' description='Obfuscate User data and more')
    static public void obfuscate(List<User> users)
    {
        String uid = ApexPages.currentPage().getParameters().get('uid');
        
        if(uid == null)
            return;
        
        User u = [select contactId from user where id=:uid];
            
        System.UserManagement.obfuscateUser(uid);
        
        if(u.contactId != null)
        {
            List <Contact> contacts = [select id from Contact where id=:u.contactId LIMIT 1];
            if (contacts == null || contacts.isEmpty() == true)
            return;
                
            delete contacts;
        }
    }
}

registerVerificationMethod(method, startUrl)

Registers an identity verification method. Verification methods include a time-based one-time password, email or text one-time password, Salesforce Authenticator, or U2F. End users register their verification methods.

Signature

public static System.PageReference registerVerificationMethod(Auth.VerificationMethod method, String startUrl)

Parameters

method
Type: Auth.VerificationMethod
Verification method used to verify the identity of the user.
startUrl
Type: String
Path to the page that users see after they log in.

Return Value

Type:System.PageReference

Usage

Use this method to enable users to complete identity verification, such as 2FA, or to log in to their community without a password. Users register these methods to verify their identity when logging in. You create a custom registration page when implementing mobile-friendly passwordless logins. See passwordlessLogin.

The PageReference returned by registerVerificationMethod redirects the user to the Salesforce verification page. If the user enters the correct code, the user is redirected to the community page specified by the start URL. For example:

PageReference pr = System.UserManagement.registerVerificationMethod(Auth.VerificationMethod.TOTP,startUrl);
PageReference p =  System.UserManagement.deregisterVerificationMethod(userId,Auth.VerificationMethod.SALESFORCE_AUTHENTICATOR);
    

This method is introduced in API version 43.0. It isn’t available in earlier versions.