Is it possible to assign Permission Sets Owned By Profile?

Question

Using PermissionSet() and SOQL we can list the permission sets which are owned by profile Select Id,Name, IsOwnedByProfile, Profile.Name, Label from PermissionSet where IsOwnedByProfile=TRUE

My question is can we assign a permission set owned by a profile to different profile? For example: A custom profile named IT KingKong is listed in the Profile.Name column of the result from SOQL above. Can I assign this permission set(owned by IT KingKong profile) to another custom profile?

The interface after clicking 'Edit Assignment' from a User record doesn't list any permission sets owned by profile, it only list custom permission set that we created....

Any insights/help will be greatly appreciated. Thank you!! Source for SOQL: - By Adam Torman

Answer 1

It is not possible to edit PermissionSet's that are owned by Profiles, so unfortunately, no you cannot update the ProfileId field on PermissionSet to assign it to a new profile. As per the docs...

In API version 25.0 and later, every profile is associated with a permission set that stores the profile’s user, object, and field permissions, as well as setup entity access settings. Permission sets that are owned by profiles can be queried but not modified.

What you can do is write Apex code to query the respective PermissionSet objects for a profile to create a new PermissionSet (not associated with any profile) that you can you assign to one or more users, including users with the originating profile (once you assign them a lesser profile).

Answer 2

I'm the product manager at salesforce.com for profiles and permission sets.

As Andrew already indicated, we only allow query-ability of profiles and their assignments using the permissionset and permissionsetassignment sobjects. The intent was to enable the creation of administrative visualization tools on top of our API to address the question, 'Why does this user have this permission.'

However, there is already a profile sobject to modify the user permissions on a profile and an attribute on the user sobject to manage the actual profile assignment.

Unlike permission sets which are optional (each user may have zero, one, or many), profiles are constrained (each user must have one and only one) to ensure that the user always has a security context within the org. As a result, we can't enable modification of permissionsetassignment where the permission set is parented to a profile because it could cause an inconsistent state for the user where they lose that guaranteed security context, at least without putting a lot of code in place to essentially replicate what we already do with the profileId attribute on the user sobject.

Perhaps in the future if we hear more requests for this, we can re-evaluate that decision. In the meantime, I hope you have enough to accomplish what you are trying to do with permission sets and profiles. Thanks!