1. A computer-implemented method for controlling access to shared on-demand application programs, the method comprising: defining a support user class in a user profile database for a shared on-demand application program installed as part of tenant organization resources on the shared platform of a networked multi-tenant system, wherein a support user for one of a plurality of tenant organizations is granted read-only privileges to only that tenant organization's metadata of the shared application; enabling an administrator for the one of the plurality of tenant organizations to grant access by a third party to the application as a support user for the tenant organization; enabling the administrator for the tenant organization to grant access by the third party to the application as a specific organization user of a plurality of that tenant organization's users for a limited term, wherein the specific organization user is granted use privileges of the application; and allowing the third party to login via the tenant organization to the tenant organization resources of the shared application on the shared platform and use the application as the specific organization user for the limited term if the administrator for the tenant organization has granted access to the third party as both a support user and as the specific organization user, thereby enabling the third party to troubleshoot a problem associated with application usage by the specific organization user.