10

I understand, the differences between Profiles and Permission Sets. I just wanna ask are there some configs that make Profile or Permission Set unique.

Are there things that could only be done via permission set and not via Profiles and vice versa ?

11

As far as i know anything you can do w permission sets you can do w profiles, but there are a few things that can as of now only be done w profiles.

The key UI difference in my experience is that only profiles can be used to control page layout assignment.

I took a look and at a top level, it looks like the following items are profile only. There may be others, I have not been able to find a clean list

Permission sets and profiles have come very close to parity. Now that record type assignment can be done in either, it's just a few key things that remain, and these likely would remain on profile, as a user can only be assigned one page layout at a time, so it wouldn't really make sense on a permission set.

FWIW, besides for the page layouts, which I knew about from general experience, I came up w this list by looking at a perm set and a profile in the enhanced editor and noted which top-level sections were missing from perm set.

Permission Set

permission set

Profile

profile

  • Help me provide the list of things you found here different. Need it to decide how many profiles and permission set we should make for smother flow. – Pranay Jaiswal Apr 26 '16 at 5:16
  • As few profiles as possible. Use permission sets wherever you can. I basically only use profiles to control UI, as we don't use login hour restrictions or IP ranges. – gorav Apr 26 '16 at 10:50
  • 1
    Things have changed since both our answers to this question were written. Permission sets can be used to control page layout assignments. A complete profile can be duplicated using a permission set. A Salesforce Product Manager announced at DF17 their Roadmap is to eventually replace profiles with permission sets. – crmprogdev Apr 11 '18 at 15:39
  • 1
    I've seen that roadmap also, look forward to it. I dont believe there is any way to control page layout assignment via permission sets yet, if it is possible please elaborate. I'm going to turn my answer into a community wiki. – gorav Apr 12 '18 at 14:09
12

What permission sets allow you to do is minimize the number of profiles that you have to create. It also allows you to temporarily add and remove permissions for users without needing to change their entire profile. In that sense it's a huge time saver. They help keep your org's profiles simpler and your org "cleaner". There always tend to be "exceptions to the rule" where someone needs unique access to certain records. Permission sets allow you to provide them that access without creating a "special profile" just for that single user.

They also allow ISVs to provide permissions to use their applications without changing your user profiles. Instead, permissions can be added and provisioned for your users who need access to those applications. You only need to purchase licenses for those who really need them (when those licensing models apply or are available).

  • Sir, could you provide a list of features that are specifically provides by profiles and not by permission set that you hav encountered in your years of SF experience? – Pranay Jaiswal Apr 25 '16 at 14:29
  • 5
    A profile includes everything that's in a permission set. A permission set simply allows you deploy permissions with more specificity than a profile does. – crmprogdev Apr 25 '16 at 14:32
  • 3
    Permission sets are useful for some odd little things where you want to add something to a standard profile, particularly System Administrator that you can't add in another way. Main example I've found is viewing encrypted data. – Dave Humm Apr 25 '16 at 14:50
3

In addition to Crmprogdev's answers and comments, this paragraph taken from here may be helpful:

The key difference between the two is that the Profile is the users base set of permissions and all users are assigned to one. A Permission set is just a way to give a user or a set of users extended permissions without granting them to the entire group of users with a certain Profile.

Key example would be that 5 users share the same Profile which does not have permission to create custom report types, but one of the 5 users needs to create custom report types. Rather than create a new Profile just for this one user, you would create a Permission Set that included the Create Custom Report Types permission and assign it to that one user.

Profiles can be used to give or take away permission from the users assigned to it. Permission Sets can only give or extend permission to the users assigned to it.

1

A core difference is that a user can have multiple permission sets and this principle thus enables a more granular way of granting permissions.

This in turn means you can do with a lower amount of profiles which keeps the maintenance of these easier. You can have core role/responsibility profiles and ship permission sets for specific features or abilities as you extend your solution.

-1

Some settings are only in profile we can not control them from permission sets:

enter image description here

-3
  1. If we want to grant any specific permission on an object to a particular user or to a set of user, then we need to create a permission set and grant object level access. THen just assign the permission set to the user.

  2. One user belongs to a particular profile(One profile) but A User can be assigned with multiple permission sets.

  3. The important thing is that: if a lot of people in a profile need the same permission or a particular permission, then rather than creating permission set, the best practice to create a custom profile and add permissions to the custom profile.

  4. The difference between Profile and Permission Sets is Profiles are used to restrict from something where Permission Set allows the user to get extra permissions.

  • This doesn't answer or help the original question in any way and is considered as low value. – Pranay Jaiswal Apr 10 '18 at 18:13
  • 2
    (4) is so confusingly stated that I would call it simply incorrect. Profiles do not establish additional restrictions or negative permissions relative to permission sets, although it's correct that permission sets are purely additive. – David Reed Apr 10 '18 at 19:36
  • I don't know guys, this seems like a legitimate, good faith attempt to answer. Some of the information therein is incorrect, but it is an answer, and does conform to the guidelines in How to Answer. – Adrian Larson Apr 10 '18 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.