3 Ways to Deactivate Users in Your Salesforce Account
People switch roles, projects end, and sometimes an account just shouldn’t stay active. In Salesforce, though, turning off a user isn’t as easy as hitting delete, data, automations, and permissions are all intertwined.
This quick guide walks through three safe ways to deactivate users while keeping records, workflows, and licenses in order. Pick the option that fits your admin style and stay compliant without extra cleanup.
Table of Contents
Use Salesforce’s UI
Here, you’ll use the Salesforce UI to deactivate a user account without touching any code or external tools. The process is quick, but a couple of checks keep your org data safe.
Step 1: Open the Users page
- Inside Lightning Experience, click the gear icon in the upper-right corner, then pick Setup from the dropdown menu.
- In the Quick Find box, start typing “Users,” then select the Users link that appears under Administration.
- Classic UI looks different, yet the Setup link at the top right still gets you to Manage Users > Users.
Step 2: Locate the user you want to deactivate
- Scroll through the table, sort by column headers, or use the search bar that sits just above the list view.
- If the user is buried in a long list, switch the View dropdown to “Active Users.” Easier to spot.
Step 3: Freeze first if the person is still logged in (optional)
- Open the row-level action menu next to the user’s name, then choose Freeze to halt their session immediately.
- Salesforce logs them out and blocks new logins, giving you space to finish cleanup.
- Salesforce Help notes that Freeze is handy when you’re unsure about open approvals or batch jobs tied to the user.
Step 4: Deactivate the user
- Choose Edit on the row that holds the user record you want to turn off today.
- In the detail page that opens, find the Active checkbox and remove its checkmark to signal deactivation.
- Scroll to the bottom of the form and click Save so Salesforce commits the change immediately.
Salesforce immediately removes their login access but keeps their records, as the docs state. You can’t deactivate yourself, and you can’t deactivate the last active System Administrator, so plan for that.
Step 5: Handle loose ends
Salesforce’s article “Deactivate Users” points out several common blockers administrators meet:
- Scheduled jobs that the departing user owns can block deactivation; reassign those jobs to a new owner or delete them outright.
- Check whether the user is set as the default owner for new leads or cases, and assign that role to someone else before saving.
- Review every workflow email alert: if the departing employee is the only recipient, add another mailbox so notifications still go out.
Fix any flagged item, then repeat Step 4.
Step 6: Confirm the user is really out
- Back on the Users list, open the View dropdown and pick “Inactive Users” so the table shows only deactivated accounts.
- Locate the person’s name, confirm the Status column reads Inactive, and notice that the Freeze button no longer appears.
Process complete; the user cannot log in, their history remains intact, and your org stays tidy and secure.
Use Torii
Torii lets you disable Salesforce accounts without logging in to Salesforce each time. The platform gathers all your SaaS tools in one place, handles provisioning and off-boarding, and keeps license data current.
Automation in Torii means the job runs the moment a chosen event happens, such as a hire, departure, or contract renewal. When the same change pops up day after day, the time savings add up fast.
To turn off Salesforce users from inside Torii, follow these steps:
1. Sign up for Torii
Start with a complimentary two-week proof of concept; contact the Torii team to set it up.
2. Connect your Salesforce account to Torii
After your workspace is live, link Salesforce to Torii. Use the directions in the Salesforce Integration Guide: Salesforce Integration Guide.
3. Create a Torii workflow for Salesforce
Open Workflows in Torii, set the trigger, then add the action that deactivates Salesforce users. From now on, every time the trigger fires, Torii updates Salesforce automatically.
Use Salesforce’s API
Need to turn off a user account without clicking around the UI? The User object in Salesforce has an IsActive field you can flip through the REST or SOAP API. Here’s the quick path.
Step 1: Grab an access token
Use whatever OAuth 2.0 flow you already have wired up. A successful call to the /token endpoint returns:
{
"access_token": "00Dxx0000000000.ARwAQ.",
"instance_url": "https://yourInstance.salesforce.com"
}
Keep the access_token and instance_url; you’ll need both in every call that follows.
Step 2: Locate the user’s Id
If you don’t already have the 18-character User Id, run a simple SOQL query.
curl \
-<b>H "Authorization</b>: Bearer YOUR_ACCESS_TOKEN" \
-<b>H "Content-Type</b>: application/json" \
https://yourInstance.salesforce.com/services/data/v59.0/query?q=SELECT+Id,Username+FROM+User+WHERE+Username='[email protected]'
The response gives you the Id field for that user. Copy it.
Step 3: Deactivate the user
Send a PATCH request directly to the user record you just located.
curl \
-X PATCH \
-<b>H "Authorization</b>: Bearer YOUR_ACCESS_TOKEN" \
-<b>H "Content-Type</b>: application/json" \
-<b>d '{"IsActive"</b>: false}' \
https://yourInstance.salesforce.com/services/data/v59.0/sobjects/User/005xx000001Sv6kAAC
Salesforce returns 204 No Content on success. That single line flips the account from active to inactive.
Step 4: Confirm the change
Fire off a quick GET request to confirm the flag really changed.
curl \
-<b>H "Authorization</b>: Bearer YOUR_ACCESS_TOKEN" \
https://yourInstance.salesforce.com/services/data/v59.0/sobjects/User/005xx000001Sv6kAAC?fields=Id,IsActive
If IsActive now reads false, the user is deactivated and can’t log in.
Step 5: (Optional) Freeze instead of deactivate
Sometimes you must block logins while keeping the user active for integrations or approvals. Update the related UserLogin record through the Tooling API.
curl \
-X PATCH \
-<b>H "Authorization</b>: Bearer YOUR_ACCESS_TOKEN" \
-<b>H "Content-Type</b>: application/json" \
-<b>d '{"IsFrozen"</b>: true}' \
https://yourInstance.salesforce.com/services/data/v59.0/tooling/sobjects/UserLogin/0Noxx0000000ABC
Freezing stops logins while leaving IsActive true, which can be handy during audits.
That’s it; with four quick calls the account is off.
Torii for SaaS Management
Ready to bring order to your sprawling SaaS ecosystem today? Get in touch with our team and see how quickly you can regain visibility and control. Torii’s SaaS Management Platform helps you to:
- Uncover shadow apps: Continuous monitoring spots unapproved tools the moment they appear.
- Slash expenses: Identify idle licenses and redundant tools to keep your budget lean.
- Automate onboarding and offboarding: Let Torii handle routine IT workflows, reducing manual effort and mistakes.
- Receive proactive renewal notices: Get timely reminders so you never overlook an upcoming contract.
Torii brings Finance, IT, and Security together with a single source of truth, ending spreadsheet chaos and scattered data.
See what Torii can do for your team, and explore customer success stories, at Torii today.
Frequently Asked Questions
You can deactivate a Salesforce user three ways: uncheck \"Active\" on the Users page, run an automated Torii workflow, or send a PATCH call to the User object's IsActive field through REST or SOAP API.
Verify no scheduled jobs, default lead or case ownerships, or email alerts rely on the user. Reassign or delete each blocker, then try deactivation again to avoid errors, missed notifications, or orphaned automation.
Freeze blocks login immediately without changing the IsActive flag. It's useful when the person is still signed in, owns pending approvals, or powers integrations you're not ready to cut off, giving administrators time to clean up safely.
Yes. After connecting Salesforce to Torii, build a workflow that triggers on events like off-boarding. The Deactivate Salesforce User action runs instantly, updates license counts, and eliminates manual clicks every time the trigger condition occurs.
First obtain an OAuth access token, run a SOQL query for the 18-character User Id, then send a PATCH request to /sobjects/User/{Id} with {IsActive: false}. Salesforce returns 204 No Content, confirming the account is now inactive.
Salesforce always requires at least one active System Administrator to preserve governance and prevent lockouts. If you try to disable the final admin, the platform blocks the change until another user gains the System Administrator profile.
