Salesforce Advanced Administrator — Skills Reference

Salesforce Advanced Administrator — Skills Reference

This file is an operational playbook, not an exam outline. Each section states the rule as an actionable instruction, gives the real limit/number, tells you when to pick one tool over another, and flags the anti-patterns to catch in review. Read the Operational Rules Quick Reference near the bottom first.

Overview

The Salesforce Certified Advanced Administrator (Salesforce Certified Platform Administrator II, exam code Plat-Admn-301) extends the Administrator credential into complex declarative problem-solving: full sharing and security, advanced Flow and approval automation, custom object design, deployment pipelines, and org-health monitoring.

Load this skill when… designing or debugging the full sharing/security model (OWD, role hierarchy, sharing rules, muting permsets, session-based permsets); debugging Flow order-of-execution or recursion bugs; planning SFDX deployment pipelines or sandbox strategy; setting up auditing (Field History, Event Monitoring, debug logs). Not this skill: day-to-day org config, basic profiles/permsets, simple Flow builds → see salesforce-administrator; Apex triggers, SOQL, code review → see salesforce-platform-developer-1.

Study resources: references/study-resources.md. NPSP applications: salesforce-nonprofit-cloud-consultant. Org-specific rules: per-org appendix in your project CLAUDE.md.

Verify steps assume nothing about your tooling — use your project's Salesforce MCP connection, the Salesforce CLI (sf), or the Salesforce setup UI, in that order of preference. The SOQL and describe calls below are written to work through any of them.

Credential logistics and study path: see references/study-resources.md.

Uncertainty & Escalation

• Always re-verify live: governor limit numbers [volatile — verify live]; sandbox refresh intervals and storage quotas [volatile — verify live]; Field History retention windows [volatile — verify live]; feature availability and retirement dates (e.g. Workflow Rules/Process Builder retirement); any cap or quota cited in this skill.
• Live wins: if any rule or number in this skill conflicts with what the live org or Salesforce release notes show, the live org is authoritative. Log the discrepancy immediately using the Feedback protocol below, then act on what you observed.
• Escalate to a human before proceeding: OWD changes in a production org; any sharing rule addition/removal that broadens access to PII or financial data in production; mass-update or hard-delete on production data (>1k rows); deactivating managed-package automation in production without a sandbox-validated test; any Event Monitoring or Transaction Security policy change that could affect compliance logging.
• Confidence taxonomy: facts in this skill are stable unless tagged [volatile — verify live] or [opinion — house style]. When in doubt, query the org directly before acting.

Security and Access — Operational Knowledge

Access is additive-only. The stack: OWD (baseline) → role hierarchy → sharing rules → manual/Apex sharing. Every layer only widens access. To restrict, lower the OWD — sharing rules cannot take access away.

FLS ≠ object access ≠ record access — three independent gates. Full object Read + INVALID_FIELD on a query = FLS not granted. Verify all three when access fails.

• SFDX field-meta.xml grants FLS to no one. Deploy a <fieldPermissions> entry in a permset/profile alongside every new custom field or every query returns "Invalid field" — including for System Administrator.