A permission set is a collection of settings and permissions that can be assigned to one or more users to grant additional access on top of what their profile already provides. Permission sets are purely additive — they can only grant access, never remove it — which makes them the modern Salesforce-recommended way to manage variable permissions across users who share the same profile.
What lives inside a permission set
Almost everything a profile can grant, a permission set can also grant:
- Object permissions (Read, Create, Edit, Delete, View All, Modify All)
- Field-level security (Read / Edit on individual fields)
- App and tab visibility
- System permissions (API Enabled, Modify All Data, View Setup, etc.)
- Apex class and Visualforce page access
- Connected app access and OAuth scopes
- Custom permissions
- Record type assignments (in some cases)
- Service Presence, Login Flow assignment, and other modern features
The handful of things still profile-only: login hours, login IP ranges, password policies, and the default record type per object. Everything else has migrated — or is migrating — to permission sets.
Why Salesforce pushed the industry to permission sets
The historical pattern was “one profile per role” — a Sales Rep profile, a Sales Manager profile, a Sales Ops profile, etc. Orgs ended up with dozens or hundreds of nearly-identical profiles that drifted apart over time. Permission sets fixed this by letting you keep a minimal common profile for everyone in a department and stack additional permissions onto specific users.
The modern recommended pattern looks like this:
Profile: "Sales Minimum Access" (everyone in sales gets this)
+ Permission Set: "Lead Management" (reps + ops)
+ Permission Set: "Opportunity Forecast" (reps + managers)
+ Permission Set: "Territory Management" (managers + ops)
+ Permission Set: "Data Loader Access" (ops only)Each user composes the access they need from the building blocks they’re assigned.
Permission Set Groups — the next layer up
A Permission Set Group is a bundle of permission sets you can assign as a single unit. Behind the scenes, Salesforce computes the union of all included permission sets and exposes it as one assignment. Groups also support muting permissions: you can include a permission set but mute specific permissions inside it for users assigned through this group only.
Use groups when you have a recognizable role made of multiple permission sets — “Senior Sales Rep” might be a group containing Lead Management + Opportunity Forecast + Forecast Manager Override.
Permission set vs profile — the quick comparison
| Dimension | Profile | Permission Set |
|---|---|---|
| Required on every user? | Yes | No |
| Cardinality | Exactly one per user | Many per user |
| Effect | Baseline access | Additive on top of profile |
| Can remove access? | Yes (within its bundle) | No — additive only |
| Controls login hours / IP ranges? | Yes | No (profile-only) |
| Migration direction | Becoming minimal | Becoming primary mechanism |
Real-world scenario
“A new analyst needs the same access as a regular sales rep, plus the ability to run Workbench queries via the API for one quarter.”
Don’t clone the Sales Rep profile to “Sales Rep + API Access” — that creates profile sprawl and an audit headache. Instead:
- Keep the analyst on the Sales Rep profile.
- Create or reuse a Permission Set named “API Access (Workbench)” that grants the API Enabled system permission.
- Assign that permission set to the analyst.
- At the end of the quarter, unassign the permission set. Profile untouched, audit trail clean.
Common interview follow-ups
- Can a user have multiple permission sets? Yes. Permission sets are designed to be stacked.
- Can a permission set remove access? No — only Permission Set Groups can mute permissions, and only for users assigned through that group.
- Are permission sets license-aware? Yes. A permission set tied to a Salesforce-license-only feature can only be assigned to users with that license type (or a compatible permission set license).
- What’s a permission set license? A separate add-on license (like CRM User, Sales Console User) that enables certain permission sets to grant their permissions. The user needs the matching permission set license assigned before the permission set’s grants take effect.
Verified against: Salesforce Help — Permission Sets and Permission Set Groups. Last reviewed 2026-05-17.