Profiles vs. Permission Sets
By the end of this lesson, you'll be able to:
- Explain the difference between a Profile and a Permission Set
- Recognize that every user has exactly one Profile but can have many Permission Sets
Prerequisites: Role Hierarchy Explained
Profiles: the mandatory baseline
Every user is assigned exactly one Profile. It controls default object and field permissions, which apps and tabs are visible, page layout assignments, and login restrictions like IP ranges and login hours.
Permission Sets: additive and flexible
Permission Sets grant additional permissions on top of a user's Profile, without requiring you to change (or clone) the Profile itself. A user can be assigned any number of them, and related sets can be bundled into a Permission Set Group for easy assignment.
Salesforce's own recommended direction is to keep Profiles minimal — covering only what every user in that Profile always needs — and use Permission Sets for anything optional or role-specific.
Listing a user's assigned Permission Sets
List<PermissionSetAssignment> assignments = [
SELECT PermissionSet.Name
FROM PermissionSetAssignment
WHERE AssigneeId = :UserInfo.getUserId()
];Every row is one Permission Set (or Permission Set Group) currently assigned to the running user, on top of their single Profile.
Exercise
Write a SOQL query that counts how many Permission Sets are assigned to the user with Id '005XXXXXXXXXXXXXXX'.
Show hint
SELECT COUNT() FROM PermissionSetAssignment WHERE AssigneeId = :userId
Profiles vs. Permission Sets — Quick Check
My Notes
Log in to keep private notes on this lesson.
Questions about this lesson
No questions yet — be the first to ask.
Log in to ask a question about this lesson.
Summary
A Profile is the mandatory baseline of permissions every user must have exactly one of; Permission Sets (and Permission Set Groups) layer additional, optional permissions on top without requiring a profile change.