top of page
  • Writer's pictureCRM Science

Getting Hands-on with Permission Sets and Permission Set Groups in Salesforce


Hands-on instructions of Permission Sets and Permission Set Groups in Salesforce

Welcome to the second part of our blog series on navigating the end of life of profile permissions with Permission Sets and Permission Set Groups. In the previous article, we delved into the concept of managing permissions using these powerful tools. Now, in this second installment, we will roll up our sleeves and dive into a hands-on exploration of permission sets and permission set groups. Get ready to take your Salesforce permissions to the next level as we delve into practical examples and best practices for effectively utilizing these features. Let's begin our journey towards mastering permission sets and permission set groups.


Configuring Permission Sets

Creating Permission Sets

Log in to your Salesforce account and go to the Setup menu by clicking on the gear icon in the upper-right corner of the screen


Setup menu in Salesforce



In the Setup menu, click on the Users option and then select Permission Sets from the dropdown



Select Users and then Permission Sets in the dropdown menu.

Click the New button to create a new permission set



Click the New button with in the Permission Sets settings in Salesforce.


Give the permission set a name and a description that clearly describes its purpose


*The importance of this step cannot be overstated.

  • The naming convention should clearly define what the permission set does

  • The description should include all permissions assigned to the permission set


*Our recommendation is to use Permission Sets for feature based permissions, and Permission Set Groups to house permission sets by role or job function.

Enter Permission Set Information into Salesforce.



Tips: Use prefixes to display the type of permission

  • Object Permissions: [Object Name] - [what the permission does]

  • System Permissions: SYS - [what the permission does]

  • Tab Permissions: TAB - [which tab the permission applies to]

  • Apex: APEX - [name of Apex Class]

  • Visual Force: VF - [name of visualforce page]




Add Permissions to the Permission Set

Permissions are segmented between App & System. Click on the hyperlink for the type of permission you are adding. (For the example below, we will be adding Read, Create, and Edit access to Accounts, but the process would be the same for other permissions)


  1. Click Object Settings


Click object settings in Salesforce.

  1. Select the object (Accounts)


Object Account Settings in Salesforce.

  1. Click the Edit button to make changes



Permission Set Edits in Salesforce.


  1. Use the checkbox fields to select the Object & Field Level permissions


Enable CRE - Create - Read - and Edit in Salesforce.


  1. Click Save


Click Save in Object Permissions in Salesforce.


  1. Repeat the above steps for any other permissions needing to be added to the permission set

Cloning Permission Sets

In the Setup menu, click on the Users option and then select Permission Sets from the dropdown



Setup Menu in Salesforce Click Users and then Permission Sets.


Click the Clone link beside the permission set you want to copy



Clone The Permission Set Label in Salesforce.


Update the Label, API Name, and Description for the new Permission Set, and click Save



Update the Lable API Name CRED in Salesforce


Add or Remove the permissions needed for the new permission set


Configuring Permission Set Groups

Creating a Permission Set Group

In the Setup menu, click on the Users option and then select Permission Set Groups from the dropdown



Click on Setup then Users and then Permission Set Groups from the dropdown menu in Salesforce.

Click the New Permission Set Group button to create a new permission set group



Find New Permission Set Group button in Salesforce.


Give the permission set group a name and a description that clearly describes its purpose, and click Save


*Our recommendation is for Permission Set Groups to be Persona or Role based, where Permission Sets should be feature based and user/role agnostic.



Create a Permission Set Group Label, API Name and Description in Salesforce.


Click Permission Sets in Group



Click Permission Sets in Groups in Salesforce.


Click Add Permission Set to assign permission sets to the Permission Set Group



Add Permission Set in Salesforce.


Use the checkbox fields to select the Permission Sets that need to be added to the Group, and click Add, and then Done



Muting Permission Set in Group

A Muting Permission Set allows administrators to restrict access to functionality within a Permission Set Group.


For example, let’s say we want to ensure that a Permission Set Group never receives access to view encrypted data. Since permission set groups will continue to evolve, adding a Muting Permission provides us the ability to restrict this capability regardless of which permission sets end up being added to the group.


In the Setup menu, click on the Users option and then select Permission Set Groups from the dropdown



Again click on Setup in Salesforce and find Permission Set Groups


Click on the name of the Permission Set Group



Click the name of the Permission Set Groups in Salesforce.


Click the Muting Permission Set in Group button



Click Muting Permission Set in group, in Salesforce.


Click New



Click New in Muting Permission Set Label within Salesforce.


Enter a detailed label of what is being Muted, and click Save



Enter a detailed label of what is muted in Salesforce.


Click the Muting Permission Set Label


Click the Muting Permission Set Label in Salesforce.


Select the category that needs to be muted (in our case, System Permissions)



Select the category that needs to be muted in Salesforce.


Check the Muted box beside the Permission needing to be Muted, and click Save



In Salesforce Check the Muted box beside the Permission needing to be Muted, and click Save.


*Muted Permissions only apply to the Permission Set group they are applied to. If a user was assigned “View Encrypted Data” in a separate permission set or permission set group, they would still have access to this functionality.


Permission Assignments


Users can be assigned to Permission Sets and/or Permission Set Groups. Best practice would be to handle all assignments at the Permission Set Group level where possible.


Adding Permission Assignments


In the Setup menu, click on the Users option and then select Permission Set Groups from the dropdown



In Salesforce find the setup menu, click on the users option then Permission Set Groups from the menu.

Click on the name of the Permission Set Group



Within Salesforce Click on the name of the Permission Set Group


Click the Manage Assignments button



Find the Manage Assignments button


Click Add Assignment



In Salesforce Find Add Assignment



Select the users needing to be added by clicking the checkbox field beside their name(s), and click Next



Select the users needing to be added by clicking the checkbox field beside their name(s), and click Next within Salesforce.


Choose an Expiration Option for the Assigned Users, and click Assign



Select an Expiration Option for Assigned Users within Salesforce.


Editing/Removing Permission Assignments


In the Setup menu, click on the Users option and then select Permission Set Groups from the dropdown



Permission Set Groups Setup Menu in Salesforce


Click on the name of the Permission Set Group



Click on the name of the Permission Set Group in Salesforce.


Click the Manage Assignments button



Find Manage Assignments buttons in Salesforce.



Check the box beside the users name needing to be removed from the Permission



Check the box beside the users name needing to be removed from the Permission in Salesforce.

Click the Trash icon to remove the user from the Permission Set Group OR

Click the Pencil icon to edit the users Expiration Options on the Permission Set Group


Click the trash icon or pencil to remove or edit the current assignments.

Automating Permission Assignments

Permission Sets and Permission Set Groups by default require manual assignment. However, once the permissions are well defined, Salesforce Flows support automation of permission assignments.


The Permission Set Assignment object in flow supports the assigning of both Permission Sets & Permission Set Groups



Create a Record of this object to automate the permission assignments within Salesforce.



Conclusion


Permission sets and permission set groups are powerful tools in Salesforce that can help ensure users have the necessary access to do their jobs while maintaining security and data privacy. By following these best practices, you can create a robust permission management system that meets the needs of your organization while reducing risk.


Comentários


Recent Posts
bottom of page