Salesforce is moving away from profiles and towards permission sets. As such, permission sets and permission set groups should be leveraged as much as possible.
This means each user should have
- One profile
- One main permission set group
- 0, 1 or a small number of permission sets
This translates to using profiles and permission sets for the following functionality:
Profile
- To set things like login hours/IP ranges
- Defaults for record types and apps
- Page layout assignment
Permission Set/Permission Set Group
- User permissions
- Object permissions
- Field permissions
- Tabs
- Record types
- Apps
- Apex classes
- Visualforce pages
You can also create the permission set “System Administrator” and assign the aggregated permissions from all custom permission sets.
The takeaway
Eventually profiles will be fully replaced by permission sets and groups. To plan for this, take advantage of their functionality and start using them sooner rather than later.
Category:
Salesforce