---
schema_version: "1"
id: 833447367ba1f8a703b759c8c79ae8a14ae3b4ac841c338612ed42541bd6b2ea
title: Control Authorization with Custom Profiles and Roles
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_identity_set_up_profiles.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_identity_set_up_profiles.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b581b1eb6ec5394020e9c3c7d36dbc536881aac0c4acd622e3fe087a7c725de7
description: In identity and access management, it's important to control who is authorized to access resources. You can manage authorization by assigning your users profiles and roles. Profiles define how users access data and what they can do in Salesforce. Roles allow you to create a user hierarchy so that users can access data owned or shared by subordinates.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Control Authorization with Custom Profiles and Roles

In identity and access management, it's important to control who is authorized to access resources. You can manage authorization by assigning your users profiles and roles. Profiles define how users access data and what they can do in Salesforce. Roles allow you to create a user hierarchy so that users can access data owned or shared by subordinates.

Salesforce provides standard profiles with pre-configured permissions and settings that define authorization. For more fine-grained control, you can clone a standard profile and edit its permissions. To modify a standard profile and assign it to a user, take these steps.

1. From Setup, in the Quick Find box, enter Profiles, then select **Profiles**.
2. Next to External Identity User, click **Clone**.
3. Enter a name for the profile and save.
4. To customize the profile, click **Edit**. You can modify the permissions associated with the profile.
    1. Click **Edit**.
    2. Search for API Enabled, and then select the checkbox next to this permission.
        
        API Enabled gives users API access to your org’s data through any back-end mechanism.
    3. Click **Save**.
5. Create a role structure.
    
    Sites require a user role hierarchy to help control how users share Salesforce data. Assign a role to the user who manages your site.
    
    1. From Setup, enter Role in the Quick Find box, then select **Roles**.
    2. From the dropdown list, select **Product-based Sample**, then select **Set Up Roles**.
    3. Under CEO, click **Add Role**.
    4. For the role label, enter Customer Manager.
    5. Click **Save**.
6. Add the Customer Manager role to the user site manager so that the manager can modify the Customer profile.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note The person who manages the site for your company must have a role. However, you can’t assign roles to users who have the External Identity license, which enables access to the Salesforce Customer Identity product.
    
    1. From Setup, enter Users in the Quick Find box, then select **Users**.
    2. Next to your username, click **Edit**.
    3. Under Role, select **Customer Manager**.
    4. Click **Save**.

You’ve now learned the basics of authorizing users. For more information about configuring authorization, check out the [Data Security](https://trailhead.salesforce.com/module/data_security) Trailhead module. For more information about creating users and securing access, see the [User Management](https://trailhead.salesforce.com/module/lex_implementation_user_setup_mgmt) Trailhead module.