PROFILES VS PERMISSION SETS AND NOW PERMISSION SET GROUP
Updated: Jun 2, 2020
It’s been a few years the debate between profiles and permission sets has been ongoing. Do we stay profile heavy or permission set heavy solutions for our Salesforce instance? What is a good balance between the two? Here at Apphienz we can help you with this dilemma, here's how:
Neither actually, Salesforce has been started guiding us to move in a certain direction over the last year, to reduce our dependence on profiles. This brought us to two design styles until now:
Minimal use of profiles:
Have two profiles, one for the user with basic permissions and the other for system administrator and all other permissions are on permission sets. This was hard to manage as there were too many permission sets to keep track off.
High level role (job function) based profiles:
Have profiles for Sales, Customer Support, Finance, and similar high level groups and have permission sets to drill down into each role like, Inside Sales Rep, Account Executives, Sales Operations in separate permission sets.
To help take this to another level of ease and organization Permission Set Groups got release and are generally available in Spring 20 release. A much awaited and appreciated feature. This is fantastic news because these groups are going to save all of us admins so much time and headache when it comes to assigning permission sets. Permission Set Groups streamline permissions assignment and management by bundling permission sets into one group based on the employee role within the organization. These should be used only for role based (job function) access control.
Best Practice:
Role based access control should be used between permission set group and permission sets.
The name of the permission set group is intended to have the name of the job function like marketing or sales within the organization.
The names of permission set is intended to be the specific access or tasks permission set will provide access to.
Admins are encouraged to create permission sets based on tasks that users regularly perform and group those task-based permission sets into groups that represent users job role.
Migration of Profile to Permission Sets
The above is a cheat sheet provided by Salesforce to help in the migration of Profiles to Permission Sets.
There are several apps available to accomplish the migration of Profiles.
Profile and Permission Set Helper - on Appexchange
Profile Converter
Permission Analyzer
About a year ago Salesforce had provided insight that it is gradually moving away from profiles. But what does this mean, are we going to lose profiles? Permission set groups in definitely a step in that direction. Profiles will not be taken away unless there is a well in advance communication from Salesforce.
How to set up Permission Set Groups
Go to Setup and quick search for Permissions. You will see Permission Set Groups available in the left pane.
Create a New Permission Set Group by clicking on the New button.
Now you can select which Permission Sets you want to include (you will need to have already created your Permission Sets to do this step). Click on the Permission Sets in Group to do this.
After you have selected the sets, you can save and assign the Group to appropriate users just like we assigned the permission sets.
Highlights of Permission Set Groups
With Permission Set Groups, you have the option to mute individual permissions that are in the Group. You can do this by using the Muting Permission Set in Groups. This is a fantastic way to not need to create additional permission sets.
Going back to the start of the blog, let’s go with the first option to have minimal 2 profiles, user and system administrator, with a combination of Permission Pet Groups and Permission Sets. I do like this better!!
Want to learn more about this feature and contact us at Apphienz or reach us at info@apphienz.com