If you are new to Salesforce administration, wrapping your head around the security model can feel like learning a foreign language. Between profiles, permission sets, OWD, and role hierarchies, it is easy to get confused. However, understanding how user access works is the single most important skill for keeping company data safe and compliant.
Key Points Summary
- Every user must have exactly one profile, but they can have multiple permission sets.
- Profiles set baseline access; permission sets layer on additional rights dynamically.
- Roles have nothing to do with what you can do; they strictly control what data rows you can see.
- Modern Salesforce architecture strongly encourages using "Minimum Access Profiles" combined with Permission Set Groups.
1. Salesforce Profiles: The Mandatory Baseline
A Profile is the foundational building block assigned to every user account. It sets your universal ground rules:
- Object Permissions: Can you Create, Read, Edit, or Delete (CRED) records on a table like Accounts?
- System Settings: Are you allowed to view setup menus, export reports, or log in during specific hours?
- App Access: Which custom applications appear in your app launcher?
2. Permission Sets: The Flexible Add-On Keys
Historically, administrators created custom profiles for every unique job title. This led to "profile bloat," where managing dozens of nearly identical profiles became a nightmare. Today, we use Permission Sets to keep things clean.
Imagine 50 sales reps share the same basic "Standard User" profile. Suddenly, five of them need access to a new financial approval app. Instead of cloning a brand-new profile for those five users, you simply assign them a
Financial App Access Permission Set. Their core profile stays clean and untouched.
3. The Role Hierarchy: Managing Data Visibility
It is common for beginners to confuse Roles with Profiles. While a profile controls your permissions (actions), a Role controls your record visibility.
The Role Hierarchy creates a vertical management tree. If a Sales Representative owns an Account record, their Sales Manager (sitting directly above them in the hierarchy) can automatically view that record, regardless of standard sharing rules. This ensures leadership always has visibility into team performance.
Frequently Asked Questions (FAQ)
No. Every user in Salesforce must have exactly one profile assigned at any given time. If a user needs different duties, you modify their profile or layer on permission sets.
A Permission Set Group allows you to bundle multiple permission sets together into a single package. Instead of assigning 10 individual permission sets to a new employee, you assign them one Permission Set Group.
Roles only control data visibility (seeing records). They never grant or restrict object-level permissions (CRUD). A user with a high-level executive role still cannot edit an Account if their profile explicitly denies them Edit access.
- Over-Assigning System Administrator: Never give users full admin rights just because they need access to a specific tool. Use targeted permission sets instead.
- Cloning Profiles Blindly: Avoid cloning out-of-the-box system profiles repeatedly; this inherits legacy permission clutter. Start minimal and build up.
- Profiles: Exactly one per user. Defines baseline object and system access.
- Permission Sets: Unlimited per user. Add-on keys for specialized tasks.
- Roles: One per user. Establishes vertical data reporting visibility.