+ Start a Discussion

profile VS permissionset

What is difference between profile and permissionset  ?


Profiles are used to provide permissions for a group of users under that profile as a whole.


Permission sets are used to provide additional access to specific users in addition to the permissions granted via their profile.




Each user is allowed one and only one profile. A profile sets the base permissions for (typically) a large set of users. You *must* use profiles as every user is required to have a profile. The standard set of profiles provided with an org have limits on what can be modified and are aligned with a certain "typical" set of users for some CRM functions, along with a platform profile. 


Profiles importantly determine the base license associated with that user, which in turn determines how much a salesforce.com customer has paid salesforce.com for that user. But there are also feature licenses that are assigned via other means (for instance if you are a knowledge user, this is turned on 


New profiles cannot be deployed, but you may deploy changes to a profile. 


Permissions set


Permissions sets encapsulate most permissions availabe on profiles. The permissions allowed in permission sets is found in the online help and training.  


Permissions sets are additive in nature. That is to say that if a profile grants access to a feature, it is impossible to turn off access to that feature with a permission set. They giveth, but they cannot taketh away. For this reason, if you plan to use permissions sets, you should treat profiles as baselines for large sets of users. As yourself, "what is the minimum access (or lowest common denomenator) for these users (Sales people, let's say). Then any additional permissions that are assigned to small subsets of users can be done with permissions sets. 


There is no requirement to use permissions sets. In fact, I suspect due to the fact that permissions sets are a relatively recent addition to the platform, there are probably quite a few orgs that could use permissions sets that are not. 


A user is allowed many permissions sets. These are assigned in the setup menu. Under the covers, assignments of permission sets are done with the objects User, PermissionSet, and PermissionSetAssignment, where the third is a junction object. There is a very popular app on AppExchange called "The Permissioner" that seeks to make this process easier.