Can I compare Profiles?

Question

We have many profiles in our org, and I suspect that some of them are redundant because the person who originally set them up didn't seem to understand the purpose of Profiles (confusion with Roles, perhaps). I would like to consolidate and clean them up, but I need to be able to do a diff on them to determine which ones are redundant. Any was to do such a thing?

Answer 1

Yes, you can compare profiles, how ever it's a bit limited. You can compare until 15 settings, using a view

Go to: Setup -> Manage Users -> profiles -> Create a new View.

Give it a name, and select the Settings you want to compare.

It's indeed limited, but it's better than nothing.

I'll point out that the way I solved the too_many_profiles was to start and move users from one to another, and wait for them to complain. I use to notify them of the change, and ask them to let me know if/what has changed. Than I create a permission set for them, and all is well.

Found that solution to be very sufficient.

*Some personal story: this was actually an idea in SF ideas that I asked for, and it was delivered :-)

http://success.salesforce.com/ideaView?id=08730000000BpoAAAS

Answer 2

My name is Adam Torman and I'm a platform product manager at salesforce.com responsible for profiles and permission sets.

I get this question quite a bit and I wish there was an 'easy' button to push that could give you the information your looking for.

The reality is that the concept of 'easy' doesn't scale nearly as well as a user's profile or permission set.

Take an org with 100 custom objects, each object with approximately 50 fields. Add on average 2 page layouts per object with a record type a piece. Include 10 apps, 100 apex classes and 100 visual force pages. For any given profile or permission set, that means there are 11,000 permissions that can be configured ((100*6) + (100*50*2) + (100*2) + (200)) with an almost infinite number of possible combinations.

And that's not even everything that a profile can contain! Add to that 10 profiles you want to combine and compare across 100 users with 20 add-on permission sets and you have a proverbial needle in the haystack.

So when it comes to administering profiles and permission sets, it's really about finding the right tool for the job. There are many tools available to manage these profiles and permission sets, but no single tool I would recommend because every tool begins with a fundamental question, "what do I want to know" or "what do I want to do"?

Examples of questions I frequently hear include:

1. Who has Modify All Data?

2. Does Sam Bradley have the right to click on this tab or view that Visualforce page?

3. What's different between Sam Bradley and Mike Liescher?

4. What's different between the Standard User and the Basic profiles?

5. What's different between the PTO Manager and PTO Administrator permission sets?

6. How can I assign this permission set to 100 new users?

7. How can I remove the Modify All Data permission from any users with the Basic Profile or have North American Managers in their title

8. How can I automate the assignment of the API Enabled permission set anytime a user becomes a manager and remove it if it no longer applies?

9. How can I disable the View All Data permission from all profiles, add it to a single permission set, and assign it to all users who originally had the profile with the permission?

10. How can I organize my permission sets the same way I organize my business or distribute apps to people?

Each question maps to a specific task that I am performing as an administrator. Now combine each task with the concept that each user, profile, and permission set can contain an infinite number of permission and settings combinations and you have the need to find the right tool for the right job to answer the right question. And each task may map to a different tool or API that can be used to answer it.

There are some great resources to help answer specific questions. For instance:

1. I did a great dreamforce 2012 session with Sherrie Smith from Paychex Inc where we outlined some techniques comparing and managing profiles: http://www.youtube.com/watch?v=LcqS1KvMvK8

2. I did another great dreamforce 2012 session with some of my team members and partners where we dug into some of the great tools you can build on top of our API: http://www.youtube.com/watch?v=LcqS1KvMvK8

3. One of those tools included a graphical interface for comparing users, profiles, and permission sets but looking specifically at their user permissions: https://perm-comparator.herokuapp.com by John Brock

4. Check out: Using SOQL to determine your force.com user's permissions ( http://blogs.developerforce.com/engineering/2012/06/using-soql-to-determine-your-users-permissions-2.html )

5. Probably the best tool for a more extensive comparison of profiles is the force.com IDE native compare ( http://wiki.developerforce.com/page/Force.com_IDE ). Mike Chale's comment about using the ANT Migration Tool is another manfiestation of this.

6. There are some other great open resources that take the MdAPI XML and parses it to show differences like Quick Diff ( http://www.quickdiff.com/ ), or Model Metrics Diff Dog - Setting up and using DiffDog for Salesforce.com ( http://www.modelmetrics.com/tomgersic/setting-up-and-using-diffdog-for-salesforce-com-deployment-validation/ )

There are also some great AppExchange Packages including:

1. The Permissioner by Arkus: ( https://sites.secure.force.com/appexchange/listingDetail?listingId=a0N30000008XYMlEAO )

2. Snapshot by Dreamfactory: ( https://sites.secure.force.com/appexchange/listingDetail?listingId=a0N300000016cejEAA# )

The key part here really is identifying what you want to compare and why. The why part is pretty important since once you know how profiles are different, you'll want to do something with that information.

Hope this helps some! Give a shout if you want some help with it.

AT

Answer 3

My preferred method is by retrieving the profile details with the ANT-based Migration Tool. You can configure it to retrieve profiles and roles, which will come down as XML files. These can then be compared using your favorite diff tool.

More details on the Migration tool can be found on the Salesforce site.

Answer 4

For those of you still looking at this post years later, check out this web app presented at Dreamforce 2013:

https://perm-comparator.herokuapp.com/

All credit and thanks to John Brock the mad genius!

Drag and drop profiles/users/perm sets and instantly organize by comparison category (common/different/unique permissions), and further groups permissions into 'user', 'object' and 'setup entity' permissions.

Answer 5

You should check out Security Zen www.securityzen.net

It let's you compare both Profiles and Permission Sets both within orgs and between orgs. It also let's you deploy security from one environment to another. You can also find it on the Salesforce App Exchange.

Answer 6

Related to Mike Chale's suggestion via the migration tool, you can download the profile meta data in Eclipse and compare two .profiles side by side. Or you can copy and paste the contents of the files into a text editor to compare only the relevant sections if that makes sense.

Answer 7

I have developed a chrome extension that can compare (profiles from same or different orgs) and highlight all the differences. You might want to check it out:

Extension available @ https://chrome.google.com/webstore/detail/profile-comparator-for-sa/ijbipklcimjilmnaffocmjkfddhpaadg

Video that shows how this could be used: https://www.youtube.com/watch?v=8RVxcjSucQI

let me know if that helps.

Answer 8

You could use the Data Loader to download all of the records in the Profile Object into a CSV and use Excel to do some analysis of all of the Boolean fields. That might be easier than the XML reading/parsing.

Admittedly it is not much help with the Object/Field related settings which would obviously be required.

Answer 9

I can see some steps to follow in this process:

1. Identify what are the profiles associated with the users (exporting the data). For those not in use and not standard profiles, we can keep them as candidates to be removed (depending on if you want to clean up).
2. Compare the profiles in use, trying to compare only those used by users with more or less the same role. Consolidate.
3. After the comparison and consolidation process, you will probably need to think about Permission Sets to move some settings and permissions from profiles to permission sets. In this way, you will be able to reduce the number of profiles.

Anyway, the main problem is reduced to comparing profiles properties, one by one, and then deciding what to do.

I will recommend the use of the Metadata API to be able to get all the Profile properties and develop a routine to navigate all the properties and fields to compare them.

If you are familiar with programming with the Metadata API, these are the properties listed in API 52:

readMetadataResponse metadata = metaClient.readMetadata(new readMetadataRequest(sessionHeader, null, "Profile", new string[] { profileName }));
profile = (Profile)metadata.result(0);

profile.applicationVisibilities[]: application, visible, @default
profile.categoryGroupVisibilities[]: dataCategoryGroup, dataCategories, visibility
profile.classAccesses[]: apexClass, enabled
profile.customMetadataTypeAccesses[]: name, enabled
profile.customPermissions[]: name, enabled
profile.customSettingAccesses[]: name, enabled
profile.externalDataSourceAccesses[]: externalDataSource, enabled
profile.fieldPermissions[]: field, editable, readable
profile.flowAccesses[]: flow, enabled
profile.layoutAssignments[]: layout, recordType
profile.loginFlows[]: flow, flowType, friendlyName, uiLoginFlowType, useLightningRuntime, vfFlowPage, vfFlowPageTitle
profile.loginHours: sundayStart, sundayEnd, mondayStart, mondayEnd, tuesdayStart, tuesdayEnd, wednesdayStart, wednesdayEnd, thursdayStart, thursdayEnd, fridayStart, fridayEnd, saturdayStart, saturdayEnd
profile.loginIpRanges[]: description, startAddress, endAddress
profile.objectPermissions[]: @object, allowCreate, allowRead, allowEdit, allowDelete, viewAllRecords, modifyAllRecords
profile.pageAccesses[]: apexPage, enabled
profile.profileActionOverrides[]: actionName, content, formFactor, pageOrSobjectType, recordType, type
profile.recordTypeVisibilities[]: recordType, visible, @default, personAccountDefault
profile.tabVisibilities[]: tab, visibility
profile.userPermissions[]: name, enabled

You should keep in mind that the Profile and the Permission Set objects changes in general with each API version.

Then, is up to you if you develop the routine yourself or use a solution in the market as it is commented in Trailhead: Tools to Compare Profiles:

1. https://perm-comparator.herokuapp.com/
2. https://securityzen.net/
3. https://tools.bluecanvas.io/perms/
4. https://bofc.io/compare-multiple-operations/how-to-compare-multiple-profiles-of-salesforce-in-few-clicks/
5. https://salesforceispointclick.blogspot.com/p/toolsforce.html