Configuration and Setup · Topic 4 of 4
Profiles, Permission Sets and Permission Set Groups
Salesforce access: when to use a custom profile or a permission set, permission set groups and muting, and what each setting type controls.
- 3 min
- One profile per user; many permission sets and permission set groups.
- Permission sets add access; they don't remove it (muting works only inside a group).
- Page layout assignments and login hours/IP ranges are profile settings.
What it is
Profiles and permission sets control what users can do: which objects and fields they can access, which apps and tabs they see, and which system permissions they have. Every user has exactly one profile; permission sets add extra access on top of it, and permission set groups bundle several permission sets together.
How it works
What each controls
| Setting | Profile | Permission set |
|---|---|---|
| Object permissions (create, read, edit, delete, View All, Modify All) | Yes | Yes |
| Field-level security | Yes | Yes |
| App and tab settings | Yes | Yes |
| System permissions | Yes | Yes |
| Page layout assignment | Yes | No |
| Login hours and login IP ranges | Yes | No |
| Default record type | Yes (record type access also via permission sets) | Record type access |
| Number per user | Exactly one | Many |
Salesforce recommends keeping profiles minimal and granting most permissions through permission sets and permission set groups.
When to use which
| Situation | Best choice |
|---|---|
| A whole group of users with the same job needs the same baseline | Profile (or a minimal profile plus a permission set group) |
| A few users need one extra permission | Permission set |
| Several permissions belong to a job role | Permission set group |
| A group gives too much for some users | Muting permission set inside the group |
| Different login hours or page layouts | Profile |
Permission set groups and muting
- A permission set group combines permission sets, so you assign one group to users who share a job function.
- A muting permission set inside a group removes specific permissions from that group without editing the underlying permission sets.
Standard versus custom profiles
Standard profiles can't have most of their permissions edited. To change permissions, clone a profile into a custom profile, or better, keep a minimal profile and use permission sets.
A worked example: all support agents share a profile. Three senior agents also need to delete cases. Instead of creating a new profile, create a "Delete Cases" permission set and assign it to those three users.
When a question says "only a few users" need extra access, the answer is almost always a permission set, not a new profile.
How the exam asks about this
- "Two users on the same profile need to export reports." A permission set with Export Reports.
- "A permission set group gives one team too much." Add a muting permission set to the group.
- "Restrict when users of a profile can log in." Login hours on the profile.
What to remember for the exam
- One profile per user; many permission sets and permission set groups.
- Permission sets add access; they don't remove it (muting works only inside a group).
- Page layout assignments and login hours/IP ranges are profile settings.
- Use permission sets for exceptions and permission set groups for job roles.
- Clone a profile to customize it; standard profiles are mostly locked.
Creating a new profile for every small difference leads to dozens of near-identical profiles that are hard to maintain.
Common mistakes
Building a profile for one extra permission. Use a permission set.
Expecting a permission set to remove access. It can only add, except muting in a group.
Looking for page layout assignment in a permission set. It's on the profile.
Check yourself
How many profiles can a user have?
Exactly one.
What does a muting permission set do?
It removes specific permissions granted by a permission set group, without changing the underlying permission sets.
Which settings belong to profiles but not permission sets?
Page layout assignments and login hours and login IP ranges.
Topic 4 of 4 in Configuration and Setup
Test yourself on Configuration and Setup
The full Salesforce Platform Administrator question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Salesforce. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.