Understanding How to Use Profiles and Permission Sets
This Article will show you when to use a Profile and when to use a Permission Set to give users access.
Using the Profiles
Each user has a single profile that controls which data and features they can access. A profile is a collection of settings and permissions. Profile settings determine which data the user can see, and permissions determine what the user can do with that data, for example - view, create, edit, and delete records.
The settings in a user’s profile determine whether they can see a particular app, tab, field, or record type.
The permissions in a user’s profile determine whether they can create or edit records of a given type, run reports, and customize the app.
While the Role will determine what level of data the user has access to, The Profile will limit the visibility of a specific field to a user based on Profile. In this way we can assign a salesperson a Sales User profile and they will not have the ability to See Costs as they relate to a deal. A user with a store Manager Profile can see that cost but will not have the ability to Set Discounts. A user with an executive level Profile can Set Discounts.
We can also use the profile assignment to determine which version of a specific Page an end user can see by default. So we can make it so anyone with the Service User Profile will not see Financial Accounts. We can also set user Home Page assignments so relevant reports will show up in the end users Dashboard. We can set Password reset restrictions, and restrict the work hours or IP locations that a User with a Profile can access the Organization. In this way you can insure that a user with a Service user Profile can’t log in from a machine outside of the local network of your store, or from an unauthorized IP Address.
When to User Permission Sets
Permission Sets are very similar in all of their functions to the Profile, There are two key differences:
You can have multiple Permission sets assigned to a single user
You can give and take away Permission sets from a specific user without changing any other Profile functions.
If you have a single user who needs a level of access above all other users with the same profile, you can assign a custom Permission Set in order to give them access to a specific Object or Field. At the end of a project, if you no longer wish to give access, you can remove the Permission Set. The user will still have all of the Standard Profile based permissions.
The use-case for Permission Sets can vary. A Service Manager's permission sets might be giving to a trusted Service Writer while the Service Manager is on Vacation. Or they might be assigned to a user from one branch giving temporary insight to other branches in order to work on a specific project.
To learn more about Salesforce Permission Sets click here.