How to use permission sets in Salesforce

A permission set adds access to a user without changing their profile. The profile gives the baseline, each set covers one specific need, and a permission set group bundles the sets for one job. Salesforce describes this as the recommended way to manage user permissions.

Profile, set, group: what each one does

According to Salesforce, a set can be assigned to any user, whatever their profile. The same set can also belong to several groups: a change to the set then reaches all of them.

Step 1: start from the narrowest profile

According to the documentation, the "Minimum Access - Salesforce" profile gives the fewest privileges on the platform. It includes four permissions: Access Activities, Chatter Internal User, Lightning Console User and View Help Link. Salesforce recommends assigning it, then adding permissions through permission sets and permission set groups.

Before changing existing profiles, list what each user actually does. Test with a test account first.

Step 2: create a permission set

You need the "Manage Profiles and Permission Sets" permission.

1. In Setup, type "Permission Sets" in the Quick Find box, then click Permission Sets.
2. Click New.
3. Enter the label and description.
4. Choose the licence: a user licence, a permission set licence, or None.
5. Save, then add the permissions. On the Permission Set Overview page, the App Permissions and System Permissions pages hold the settings.

A specific licence limits the set to what that licence allows. With "None", the user must already be entitled to those permissions through their user licence or a separately assigned permission set licence. A new permission set has no licence selected.

One tip from the documentation: build the set around a task, not a job title. Its example is a set for users who must delete and transfer leads.

Step 3: assign the set

You need "Assign Permission Sets" and "View Setup and Configuration".

For one user

1. In Setup, open Users, then the user.
2. In the Permission Set Assignments related list, click Edit Assignments.
3. Under Available Permission Sets, select the set, click Add, then Save.

For several users

1. Open Permission Sets, then the set.
2. Click Manage Assignments, then Add Assignments.
3. Tick the users, then click Next.
4. If you wish, choose an expiration date for the assignment.
5. Click Assign.

Salesforce shows a message if a user lacks the licence required. Guest, self-service, integration and system users do not appear on the Manage Assignments page: use the PermissionSetAssignment API object for them. Salesforce advises against assigning permission sets to inactive users.

Step 4: bundle sets into a group

When several sets always go together, a group makes assignment simpler.

1. In Setup, open Permission Set Groups.
2. Click New Permission Set Group, enter a label and description, then save.
3. Add the permission sets to the group.
4. Assign the group to users.

If the new group does not appear in the list, choose the "All Permission Set Groups" list view. The group calculates the combined permissions of its sets; its status shows whether that calculation is up to date. A muting permission set can turn off selected permissions within a group, when you want most of a set's permissions but not all. Read the official documentation on this point before using it.

Diagnosing a denied access

1. Note the object, field or action involved and the exact message.
2. Open the user's profile and the list of their assigned permission sets.
3. In each set, look for the permission on the App Permissions and System Permissions pages.
4. If it is missing, assign (or create) the set that grants it rather than editing the profile.
5. Also check the licence and, for a report or dashboard, the folder access: see the sales dashboard guide.

Some permissions depend on others: when you save, Salesforce checks whether related permissions must also be enabled.

Common mistakes

• One profile per job: the list becomes impossible to maintain. Prefer a baseline profile plus sets.
• A set named after a person: nobody remembers what it is for. Name it after the task.
• A catch-all set: it opens more than needed. One set, one need.
• Forgetting the licence: assignment fails for users who do not have the required licence.
• Not removing the set when someone changes job: permissions pile up.
• Editing a shared set without checking the impact: if it sits in several groups, every user concerned is affected.

When to ask for help

If permissions are already tangled, with many profiles and access nobody can explain, an administrator can take stock and propose a plan. See our Salesforce profiles and permissions service. To budget for this work, see the pricing page. If a report does not show all the data, check the user's permissions first.

Official references

• Permission Sets (Salesforce Help) (new tab)
• Create a Permission Set (Salesforce Help) (new tab)
• Assign Permission Sets (Salesforce Help) (new tab)
• Permission Set Groups (Salesforce Help) (new tab)
• Create a Permission Set Group (Salesforce Help) (new tab)
• User Permissions and Access (Salesforce Help) (new tab)
• Standard Profiles (Salesforce Help) (new tab)

Frequently asked questions