After becoming frustrated with the half-dozen Profiles that all do the same thing (except for subtle differences here and there), I have started on cleaning up my org's permissions scheme.

My basic idea is to have as few Profiles as possible, and a separate Permission Set for each task a User may perform in their job. This allows the organization to change position responsibilities flexibly, reduces my maintenance burden, and documents not only who has access to a thing, but why they have it.

I'm now fully bought into cutting out Profiles altogether, but I recognize that the platform isn't. What is the full set of things that Profiles control that I can't alter in Permission Sets?


1 Answer 1


To start, this is my list so far:

  • The Default Case User must be on a Profile that has Can Modify All Data.
  • Page Layouts Assignments
  • Login restrictions
  • Password policies
  • Session settings
  • A User's default Default Record Types (Users can optionally change their Default Record Types - this simply establishes their defaults).
  • Any User who should be in a Delegated Group for administration must have View Setup and Configuration in their Profile. (? this may be permission settable)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .