What are your best practices in migrating profiles and permission sets? I have been trying to migrate them from one org to another org. However it is not working. Do you have to move the entire code base at once to migrate the profiles. Please advise.
Moving profile depends on difference of profile in Sandbox and the production.
If you are doing with continuous integration process then you can move profile by changeset.
To move profile with changeset you must have source profile same as target organisation and added new permissions and modified permissions. If there is some permission which is missing in source profile then there can be chances of unexpected behaviour. Login IP ranges, FLS can be reset by doing this. So, carefully examine permissions then deploy.
It is always preferred to make those changes live manually in production instead of changeset. It is difficult to know which access changed.
Profile permissions always need to be examined. Each component in organisation is part of Profile whether it is class or vf or a field.
A profile moved in other environment must have accessibility setting for all components for all component exist in target environment.