14

Using PermissionSet() and SOQL we can list the permission sets which are owned by profile Select Id,Name, IsOwnedByProfile, Profile.Name, Label from PermissionSet where IsOwnedByProfile=TRUE

My question is can we assign a permission set owned by a profile to different profile? For example: A custom profile named IT KingKong is listed in the Profile.Name column of the result from SOQL above. Can I assign this permission set(owned by IT KingKong profile) to another custom profile?

The interface after clicking 'Edit Assignment' from a User record doesn't list any permission sets owned by profile, it only list custom permission set that we created....

Any insights/help will be greatly appreciated. Thank you!! Source for SOQL: - By Adam Torman

2 Answers 2

12

It is not possible to edit PermissionSet's that are owned by Profiles, so unfortunately, no you cannot update the ProfileId field on PermissionSet to assign it to a new profile. As per the docs...

In API version 25.0 and later, every profile is associated with a permission set that stores the profile’s user, object, and field permissions, as well as setup entity access settings. Permission sets that are owned by profiles can be queried but not modified.

What you can do is write Apex code to query the respective PermissionSet objects for a profile to create a new PermissionSet (not associated with any profile) that you can you assign to one or more users, including users with the originating profile (once you assign them a lesser profile).

2
  • Your very welcome, its an interesting area Permission Sets, I just wish it would get finished soon! Very powerful. Glad in the meantime, this answer helped you out. :) Oct 23, 2013 at 9:13
  • @AdamTorman my pleasure! Hope to see you at DF! Oct 25, 2013 at 17:08
11

I'm the product manager at salesforce.com for profiles and permission sets.

As Andrew already indicated, we only allow query-ability of profiles and their assignments using the permissionset and permissionsetassignment sobjects. The intent was to enable the creation of administrative visualization tools on top of our API to address the question, 'Why does this user have this permission.'

However, there is already a profile sobject to modify the user permissions on a profile and an attribute on the user sobject to manage the actual profile assignment.

Unlike permission sets which are optional (each user may have zero, one, or many), profiles are constrained (each user must have one and only one) to ensure that the user always has a security context within the org. As a result, we can't enable modification of permissionsetassignment where the permission set is parented to a profile because it could cause an inconsistent state for the user where they lose that guaranteed security context, at least without putting a lot of code in place to essentially replicate what we already do with the profileId attribute on the user sobject.

Perhaps in the future if we hear more requests for this, we can re-evaluate that decision. In the meantime, I hope you have enough to accomplish what you are trying to do with permission sets and profiles. Thanks!

2
  • 1
    Thanks for taking a time out to address my question. Here's a recurring scenario: User A has Profile A which has been in use for couple of years and the permissions in those profile weren't documented. Now user B an existing user with Profile B also needs to have the exact level of access(FLS,Object CRUD, API Permission) as of user A. This becomes a massive time consuming activity to go through each permission within Profile A and create a permission set based off on it. What would your suggestion be in this scenario? Thanks again :)
    – Raish
    Oct 26, 2013 at 21:27
  • 1
    So can I programmatically assign permissions on Custom Objects to existing profiles? Is there any sample code available for this?
    – abhi
    Jun 15, 2016 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .