Since both users have the same Profile, the permissions to read Opportunities are identical, so the issue is almost certainly related to data visibility rather than permissions. The most likely causes are: first, the Role Hierarchy — the user may be in a Role that does not have access to records owned by the Opportunity's owner, while the other user may be in a higher role or a different branch of the hierarchy with access; second, sharing rules — a specific sharing rule may grant the other user access to records in a certain criteria or owner group that the first user does not belong to; third, manual sharing — the record owner may have manually shared that specific Opportunity with the second user individually. To investigate, open the Opportunity record and click the Sharing button on the record to see the complete sharing breakdown showing exactly which users, roles, and groups currently have access and why.

A User License is the foundational entitlement that determines which Salesforce features and objects a user can potentially access, and must be assigned to every user — for example, a full Salesforce license grants access to standard CRM objects like Leads, Opportunities, and Cases, while a Salesforce Platform license grants access only to custom apps and objects. A Feature License is an additional, specific capability layered on top of the User License without changing the base license, assigned as a checkbox on the User record. A concrete example is the Marketing User feature license: a sales rep with a standard Salesforce User License cannot manage Campaigns by default, but enabling the Marketing User feature license checkbox on their User record grants them access to Campaign objects and campaign-related fields without requiring any change to their base User License or Profile.

The first action should be to Freeze the user account immediately, not to Deactivate it. Freezing is instantaneous and prevents login within seconds, while full Deactivation may require additional steps like reassigning owned records, removing from territories, and updating approval processes, introducing delay during which the potentially compromised account remains accessible. Freezing also preserves the complete user record and all audit trail information intact for the security investigation that follows, without freeing up the license or disrupting any owned data relationships. After the immediate lockout via Freeze, the security team can investigate Login History for unauthorized access patterns, force a password reset, review recent record changes, and then make an informed decision about whether to proceed with full deactivation or simply unfreeze after securing the account.

Username uniqueness in Salesforce is enforced globally across the entire Salesforce platform, not just within a single organization. The username in question is already in use by a user in a completely different Salesforce organization somewhere else in the world, which is why it does not appear anywhere in your own org's user list. The resolution is to use a different, more specific username — the standard convention to ensure uniqueness while maintaining consistency is to append the company's domain and environment identifier, such as changing john.smith@genericcompany.com to john.smith@yourspecificcompany.com, or adding an environment suffix like john.smith@yourcompany.com.sandbox for sandbox users. Some organizations use a dedicated internal username convention with a company-specific prefix that essentially guarantees global uniqueness from the start.

Delegated Administration is the appropriate solution. For each department, a Delegated Administration Group is created, the department manager is added as the Delegated Administrator, their managed user scope is set to only the Roles relevant to their department, and only appropriate Profiles like Standard User are added to their Assignable Profiles list. This allows each manager to create and manage users within their defined scope, reset passwords, unlock accounts, and assign the permitted Profile, without accessing any Setup configuration, without the ability to create or modify Profiles or Roles, and without any visibility into other departments' user management activities. This approach scales the user management workload across the organization without creating security gaps that would come from distributing System Administrator access.

Salesforce does not allow User records to be deleted because they are permanently referenced throughout the system — every record they created or modified, every task or activity they logged, every approval they participated in, and every audit trail entry references their User record. Deleting the record would break all of these historical references and corrupt the org's audit history. The correct process for a departing employee has several steps: first, transfer ownership of their open Opportunities, Cases, and Leads to an appropriate active user; second, remove them from any Territories if Territory Management is used; third, update any Approval Processes where they are assigned as an approver or delegated approver; fourth, check if they are a queue member and remove them from relevant queues; and finally, Deactivate their account by unchecking the Active checkbox, which prevents login, frees up the license, and retains the complete historical record intact.