Setup with Agentforce

Every Salesforce admin has the same muscle memory: someone asks for a field, and you tab through Object Manager, pick a type, set the label, choose the page layouts, assign field-level security, and repeat. None of it is hard. All of it is clicks. Multiply by a backlog and it’s a real chunk of the week spent navigating menus rather than deciding anything.

Setup with Agentforce — generally available as of the Summer ‘26 release — is Salesforce’s attempt to collapse that navigation into a conversation. It’s an agent that lives inside Setup, understands your org’s metadata, and builds real configuration from natural-language requests: custom objects and fields, flows, permission sets, report types, formulas. It was built with admin feedback at the center, and it shows in the scope. But it is not a magic wand, it has a specific list of things it can’t yet do, and — like anything with the word “agent” in it — it needs a moment’s thought about access before you switch it on. Here’s the practitioner’s read.

What it actually is

Setup with Agentforce is a conversational layer over Salesforce Setup. You describe what you need, and instead of walking you to a page, the agent brings the Setup tools and information to you and does the work — or drafts it for your review. The tagline Salesforce uses is that it reduces the effort and clicks needed to do your job, and that’s an accurate description of the value: it’s not replacing your judgment, it’s removing the menu-diving between decisions.

Mechanically, it leans on Data 360 to parse your org’s metadata. That’s what lets it answer “which permission set is blocking this user” instead of just “here’s how permission sets work” — it can actually read your configuration, not a generic help article. That dependency is also the reason it has prerequisites, which we’ll get to.

What it can do today

The GA surface is broader than the “it makes fields” demos suggest. The tasks that are genuinely useful in a real admin’s week:

Build the data model. Create custom objects and fields from a description. Usefully, it doesn’t just build blindly — when an existing object or field already fits your requirement, it suggests reusing it, which is a small guardrail against the org sprawl that turns into technical debt.
Create and manage flows. Ask for a flow and it confirms your prompt first, then builds — producing a draft flow in under 30 seconds that you click into and review before anything is active. It’s a scaffolder, not an auto-deployer, which is the right default.
Create and edit permission sets and permission set groups. The everyday access plumbing, from a sentence.
Troubleshoot user access. This is the standout. When a user reports “I can’t see X,” the agent analyzes that user’s permissions against your org’s sharing model — and can compare two users side by side — to identify the exact permission set, sharing rule, or criteria-based restriction causing the discrepancy. Anyone who has spent an afternoon diffing two users’ access by hand knows how much time that returns.
Create custom report types from natural-language instructions, again recommending an existing report type if one already matches.
Help with formulas. It can suggest formulas or correct a broken one and populate them into the formula editor for you to accept.
Surface org health signals. Ask it to review security risks from your Health Check, monitor storage limits, or summarize release updates — shifting some of the work from reactive firefighting to proactive org management.

The through-line: it’s strongest at the lookup-heavy, rule-checking tasks — access troubleshooting, “does this already exist,” health review — where a human is slow because the answer is scattered across Setup, and the agent is fast because it can read all of it at once.

What it can’t do yet

This is the part that keeps you out of trouble, so read it before you promise anything to a stakeholder. The GA release has real edges:

It can help write a formula, but it can’t create or modify the formula field itself. It’ll get the syntax right and drop it in the editor; the field creation is still yours. That distinction trips people up because “help with formulas” sounds like end-to-end field creation and isn’t.
There are scenarios it simply can’t handle directly — the surface is deliberately scoped to well-understood, reversible admin tasks, not arbitrary org surgery. That doesn’t always mean zero help; it often means it points you at the right place rather than doing the change.
It drafts; it doesn’t silently ship. For flows especially, the output is a draft you review and activate. Treat that as a feature, not a limitation — an agent that auto-activated flows in a production org would be a governance incident waiting to happen.

Set expectations accordingly. The honest framing is that Setup with Agentforce is a fast, well-informed junior admin: excellent at the rote and the diagnostic, still needing you for the consequential and the novel. That’s a genuinely useful colleague, not a replacement — which is roughly the same conclusion we reached about whether AI replaces admins at all.

The credit-cost nuance nobody reads carefully

Here’s a pleasant surprise and one asterisk. Setup actions are non-billable — they don’t consume Agentforce Flex Credits. You can hand the backlog to it and experiment freely without watching a meter tick, which is unusual enough in the Agentforce world to be worth saying twice.

The asterisk: a minimal amount of Data 360 credits is consumed for the Help and Navigation action specifically. Salesforce has said it plans to move that action to a different framework around Dreamforce 2026, after which it won’t consume Data 360 credits either. So today, the only place Setup with Agentforce touches a credit balance is the help/navigation lookups, and even that is slated to go to zero. For anyone gun-shy about Agentforce’s per-action pricing, this is about the lowest-risk way to get fluent with an agent that actually does work in your org — the free Foundations credits cover the tiny Data 360 draw comfortably.

Turning it on without opening a hole

The setup has two parts: enabling the capability, and granting access. Get the access part wrong and you either lock out the admins who need it or hand configuration power to people who shouldn’t have it.

Prerequisites. Setup with Agentforce needs both Agentforce and Data 360 enabled in your org — both of which come with Salesforce Foundations on Enterprise Edition and above. Because the agent relies on Data 360 to parse your metadata, enable Data 360 if it isn’t already on and let provisioning fully complete before you expect the agent to work; a half-provisioned Data 360 gives you an agent that can’t read your org.

Permissions. Access is gated by permission sets, and there are three an admin needs to actually use it:

Required permission set assignments per user:
  1. A custom permission set granting "Use Setup with Agentforce"
  2. Data Cloud User        (so the agent can read org metadata via Data 360)
  3. Execute Prompt Template (so it can run the underlying prompts)

The user doing the enabling needs a bit more — Customize Application and Data Cloud user permissions, plus access to the default data space. The design intent is least privilege: this is real configuration power, so it’s gated behind an explicit permission rather than handed to every admin profile by default. Respect that. Assign it deliberately to the admins who should have it, the same way you’d scope any tool that can change the org — the least-privilege posture we argue for with any agent that can act applies just as much when the “external system” it acts on is your own Setup.

A practical note: because the agent can create permission sets and edit access, an over-broadly-granted Setup agent is a privilege-escalation path worth thinking about. Keep the “Use Setup with Agentforce” permission on a tight list, and keep production changes flowing through your normal release process rather than letting the agent become a side door around it.

Where it fits — and where it doesn’t

Setup with Agentforce is at its best in the inner loop of admin work: the field request, the “why can’t this user see the record,” the “does a report type for this already exist,” the first-draft flow you were going to build anyway. Let it handle the navigation and the diffing while you keep the decisions. It pairs naturally with a disciplined org: it’s most valuable when your metadata is clean enough to reason over, which is one more argument for keeping data and config quality high.

Where it doesn’t fit is as a substitute for change control. A draft flow it scaffolds still needs testing, still needs to move through sandboxes, still needs a human to own the activation. The agent makes the building faster; it doesn’t make the governing optional. Teams that treat it as “the admin agent will handle it” and skip the review are setting up the same failure mode that sinks bigger agent projects — confusing a fast draft for a finished, verified change.

What to actually do

Confirm you’re on Enterprise Edition or above and that Agentforce and Data 360 are enabled — Foundations gives you both. Wait for Data 360 provisioning to fully complete, then create a custom permission set for “Use Setup with Agentforce” and assign it, alongside Data Cloud User and Execute Prompt Template, only to the admins who should have configuration power. Start it on the low-stakes, high-frequency work: access troubleshooting, “does this already exist” checks, first-draft flows, formula help. Keep reviewing what it drafts before you activate anything, and keep production changes on your normal release path. Do that, and you reclaim the click-heavy part of the admin week — at essentially no credit cost — without handing the org’s configuration to something you haven’t scoped.

The bigger picture: Salesforce is putting an agent on both sides of the org now — one that drives your org from your IDE for developers, and this one inside Setup for admins. Both are genuinely useful and both reward the same discipline: tight access, human review of consequential changes, and a healthy respect for the fact that “the agent did it” is not the same as “it was checked.”

Understanding the basics

What is Setup with Agentforce?

It’s an agent, generally available since the Summer ‘26 release, that lives inside Salesforce Setup and performs configuration tasks from natural language — creating custom objects and fields, drafting flows, building and editing permission sets and report types, troubleshooting user access against the sharing model, and helping with formulas. It uses Data 360 to read your org’s actual metadata, so it works on your configuration rather than generic help content.

Does Setup with Agentforce cost Agentforce credits?

Setup actions themselves are non-billable and don’t consume Flex Credits. The only exception today is a minimal amount of Data 360 credits used by the Help and Navigation action, and Salesforce plans to move that action to a different framework around Dreamforce 2026 so it won’t consume Data 360 credits either.

What can’t it do yet?

The clearest gap is formula fields: it can write and correct the formula and drop it in the editor, but it can’t create or modify the formula field itself. There are also scenarios it can’t handle directly, and for things like flows it produces a draft you review and activate rather than shipping changes automatically.

What do I need to enable it?

Agentforce and Data 360 must be enabled — both come with Salesforce Foundations on Enterprise Edition and above. Each admin who uses it needs a permission set granting “Use Setup with Agentforce,” plus the Data Cloud User and Execute Prompt Template permission sets. Let Data 360 provisioning finish before expecting the agent to read your metadata.

Rolling out Setup with Agentforce and want the permission model, guardrails, and release path set up so it speeds your admins without becoming a side door around change control? Talk to us — governed, AI-assisted Salesforce operations is exactly the work we do. Start with a read of your org’s current shape using our Org Health Scorecard.

Setup with Agentforce: the admin agent that configures your org, and where it stops