Set Up Users in Business Manager

Learning Objectives

After completing this unit, you’ll be able to:
  • Explain how to create a Business Manager user.
  • Explain the difference between how the user and the admin resets a password.
  • Explain why it’s important to create passwords for a storefront that’s under development.
  • Explain what an administrator must do to change a password.


Business Manager is the Salesforce B2C Commerce online tool for configuring and managing B2C Commerce storefronts. Linda Rosenberg, Cloud Kicks’ new administrator, is getting a handle on her admin tasks for Business Manager users. She understands how important it is to assign and restrict access to Business Manager modules based on job tasks. She’s also learned how using predefined roles improves her efficiency and her site’s data security.

Today, she plans to set up some new users and manage permissions for existing users. She also plans to change some existing user data, help users reset their passwords, and configure storefront passwords.

First things first. Her manager has asked her to create records for two new employees: Peter Wong, another administrator, and Traude Beck, a senior merchandiser. Linda learns that merchandisers need access to the Business Manager campaigns and promotion functions, while administrators like her need access to the import and export functions. Linda jots this down for later for when she’s ready to assign their user roles.

To access Business Manager, you must have a B2C Commerce implementation. In this module, we assume you are a B2C Commerce administrator with the proper permissions to perform these tasks. If you’re not a B2C Commerce administrator, that’s OK. Read along to learn how your administrator would take these steps in a staging instance. Don't try to follow our steps in your Trailhead Playground. B2C Commerce isn't available in the Trailhead Playground. If you have a staging instance of B2C Commerce, you can try out these steps in your instance. If you don't have a staging instance, ask your manager if there is one that you can use.

Check for Existing Users

Before she creates the new users in Business Manager, Linda looks to see if they’re already in the system. It’s her second week and she doesn’t want to assume anything. Checking first saves both time and data resources. Here’s what she does.

  1. In Business Manager, log in as the administrator.
  2. Select Administration > Organization > Users.
  3. Click Find. Business Manager User List page

She doesn't see those records. While she’s checking the user list, she notices that she can see at a glance the last time a user logged in and the number of days since they logged in.

Create Business Manager Users

Best practice: Use a naming convention for user IDs and email addresses.

At Cloud Kicks, Linda’s manager instructs her to use pwong for Peter’s user ID and for his email address. Likewise, she uses tbeck for Traude’s user ID and for her email address. Linda is now ready to create the users in Business Manager. Here are the steps she takes.

  1. In Business Manager, select Administration > Organization > Users.
  2. Click New. Business Manager New User page
  3. Enter your (administrator) password.
  4. Enter and select credentials.
    1. Enable the user.
    2. Enter the login ID. Linda enters pwong for Peter.
    3. Click Generate.
    4. Select Send Email to Set Initial Password.
  5. Enter the first and last name, email address, and phone number.
  6. Select the preferred Business Manager user interface locale. Linda selects English.
  7. Select the preferred data locale that displays when the user creates data in Business Manager. Linda selects English.
  8. Apply the changes.

Linda creates a record for Traude in the same way. The preferred data locale that displays when Traude creates data is important because Traude is responsible for creating promotions, products, and content in that language. When Cloud Kicks expands to new geographic locations, the administrator needs to add any new languages to the appropriate users. For now, the default is English.

Once Linda clicks Apply, Salesforce B2C Commerce automatically sends an email to Peter and Traude with a system-generated password that asks them to create a new password that’s difficult to guess.

These are the Business Manager password requirements:

  • They must contain numbers.
  • They must contain upper and lower case letters.
  • The default minimum length is 8, and the default maximum length is 25. (You can change the defaults.)
  • They must contain at least one special character by default.

Linda also asks Peter and Traude to log in and add a security question to use if they forget their password.

Change User Info

Linda’s manager receives an email from corporate security saying that the email address convention has changed. Instead of using the <first initial>underscore<familyname>, she must now use the <familyname><three digit number><first initial> convention for all new hires. Here’s how Linda makes this change.

  • In Business Manager, select Administration > Organization > Users.
  • Enter the user name. Linda enters wong.
  • Click the link for the user’s record.
  • Click Change Email.
  • Enter your administrator password.
  • Change the email address. Linda changes Peter’s to
  • Apply the change.

With Peter’s email updated, Linda clicks Users in the breadcrumb, searches for Traude’s record, and makes the same change.

Manage Credentials

Linda’s also responsible for managing existing user credentials to keep them secure. She handles:

  • Expired passwords
  • Password and ID resets
  • Locked accounts
  • User login settings

Expired Passwords

Business Manager automates some tasks, such as notifying the user by email 7 days and then 1 day before a password expires. Cloud Kicks set up this automation per its password expiration policy.

Password and ID Resets

When Business Manager users forget their login or password, they can retrieve it as long as their account has a valid email address and a security question. Otherwise, they have to ask Linda (or Peter) to generate a new password.

Users have 120 minutes to change their password after the email is sent. To change their password, users must:

  • Provide the current password.
  • Enter a new password in the Password and Confirm Password fields.
  • Create a new password that meets the password requirements.

Users can change their security question and answer only if they also enter their old password. If they leave the new password and password confirmation blank, Business Manager won’t change the password.

Locked Accounts

Sometimes users try and fail to log in too many times and end up locking their account. This just happened to Traude. She received an automated password reset email yesterday that was valid for 2 hours. Because it was at the end of the day, she ignored it. When she came into work today she couldn’t use the reset steps because they had timed out. She contacts Linda, who unlocks it with these steps.

  1. Log in to Business Manager as an administrator.
  2. Select Administration > Organization > Users, and search for the user.
  3. Select the username. Business Manager User Profile page
  4. Click Unlock and notify the user that they can access their account.

User Login Settings

Linda’s manager asked her to update Business Manager user security settings to enforce a more secure policy. Here’s how she does it.

  1. Open Business Manager.
  2. Click Administration > Global Preferences > Security.
  3. Configure the following:
    • Maximum invalid login attempts. She changes this from 6 to 3.
    • Lockout effective period. She leaves this at 30 minutes.
    • The number of days after which a user is required to change their password. She leaves the default 60 days.
    • Accounts will be deactivated if not active. She changes this from 90 to 60 days per the new policy.
    • Is the user is required to answer a security question to change their password? She leaves this as no.
    • Enforce password history. She ignores this.
    • Minimum password length. She changes this from 6 to 8 characters per the new policy.
    • Minimum number of special characters. She leaves this as 1.
    • Minimum login length. She changes this from 4 to 6 characters per the new policy.

New Storefront Protection

Cloud Kicks is in the process of implementing a new site within its organization to expand its business. Currently, only Business Manager users with the Access_Protected_Storefront functional permission can log in to the new storefront. Cloud Kicks needs to expand access to some users who don’t have the Business Manager permission. Linda uses a few security options to enable this.

First, Linda enables password protection for the new site. Then she creates a shared site password that restricts access to the site’s development, staging, and production instances to only the people involved in the implementation. This feature blocks access to both dynamic and static pages. If someone tries to log in without the site password, they get an HTTP response 403 (Access Forbidden) error.

At the same time, Linda’s manager asks her to invalidate static content cache. Static content cache retains content that’s been displayed on the storefront; this content is available to any user until it’s invalidated.

Here are the steps Linda takes.

  1. Open Business Manager and select Administration > Sites > Manage Sites.
  2. Select the new site name.
  3. Click the Site Status tab. Business Manager Site Status page showing storefront password protection
  4. Select the site status: Online (Protected).
  5. Enter a password. In the B2C Commerce storefront, you can use the following special characters for usernames and customer logins: #!&$%*+/?=^`~}|{ This is because storefront applications that enforce a mapping between email address and user name require that login attributes support any character that’s valid in an email address.
  6. Click the Cache tab.
  7. Click Invalidate next to Static Content Cache and Entire Page Cache for Site.

The storefront password doesn’t expire. Storefront password resets expire in 30 minutes.

Next Steps

In this unit Linda learned how to add a user and change user information in Business Manager. She also learned why it’s important to password-protect a fledgling storefront. In the next unit, she learns how to create roles and assign them to users.

Keep learning for
Sign up for an account to continue.
What’s in it for you?
  • Get personalized recommendations for your career goals
  • Practice your skills with hands-on challenges and quizzes
  • Track and share your progress with employers
  • Connect to mentorship and career opportunities