We can add Permission Sets to Connected App's related list.
I want to know how it really works, especially when user has multiple Permission Sets assigned, how it would restrict user when using Connected App.

I had a test, try to block user with Permission Set, here is the step:
・Create 2 Permission Sets(P1, P2) and 1 Profile, all these assign to 1 user.
・P1 has access to Account Object.
・P2 has not access to Account object.
・The Profile has not access to Account object.
・Create 1 Connected App, only relate P2 to it, which has not access to Account.

Then, the user using Connected App to query Account records. Actually I successfully got query result without blocking.

My question is why it didn't blocked the user? If all Permission Sets assigned to the user would take effect, why Connected App need to add a Permission Set? Or I need API Client Whitelisting enable?

Any help would be appreciated.

  • You can only extend the rights through permission set. Check if profile has connected app access. If it has then P2 will have access to connected app. – MIX DML Nov 18 '15 at 9:46
  • Hi @Prabhat Kumar, I think "extend the rights through permission set" is by assign user, not by add to Connected App. And, I set profile to API disable, and it still get the query result. – ling Nov 19 '15 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.