The decision turns on how many custom objects the user touches and whether they need Sales or Service Cloud features.
- List object access per user persona
For each user persona, list the standard and custom objects they need to read or write. Be specific; over-estimating leads to license over-spend.
- Check the 10-custom-object cap
If the persona touches more than 10 custom objects, Light App does not fit. Move up to Enterprise App.
- Check Sales and Service Cloud needs
If the persona needs Opportunity, Quote, Order, or Case, they need a Sales or Service license. Light App and Enterprise App both exclude these.
- Default to the cheapest license that fits
Once the requirements are clear, pick the lowest-tier license that covers them. License over-spend is one of the biggest hidden costs in Salesforce contracts.
- Configure permission sets within the license
Layer least-privilege permission sets on top of the license. The license sets the ceiling; permission sets set the floor.
- Coordinate at contract time
Salesforce account teams structure license mixes. Get the mix right at contract; mid-term changes are painful.
- The 10-custom-object cap is hard. Users hitting it need an Enterprise App upgrade; permission sets cannot bypass the cap.
- Light App users cannot access Opportunity, Quote, or Case. Mistakenly assigning the license to a sales user blocks their work.
- API and storage limits are tighter than higher-tier licenses. Heavy-usage users may need an upgrade even when the object access fits.
- Identity Only is cheaper than Light App for pure SSO. Pick Light App only when the user needs actual Salesforce data access.