What Is a Permission Set in Salesforce?
A permission set is a collection of settings and permissions that extends a user's access without changing their profile. Permission sets are additive: they g
Updated 2026-09-09
A permission set is a collection of settings and permissions that extends a user's access without changing their profile. Permission sets are additive: they grant access, never remove it.
In more detail
Salesforce's current guidance is to keep profiles minimal and grant everything else through permission sets and permission set groups, because a user has one profile but can hold many permission sets.
Permission set groups bundle several sets together, and muting permission sets can subtract a permission within the group - the one case where a permission set reduces access.
Why it matters for admins
- Effective access is the union of the profile and every assigned permission set, so auditing the profile alone is incomplete.
- They make access changes reversible: unassign the set instead of editing a profile many users share.
- They are the correct answer to "one person needs this extra permission", which otherwise becomes a cloned profile nobody maintains.
Frequently asked questions
- What is the difference between a profile and a permission set?
- A user has exactly one profile, which sets the baseline including licence and default record types. Permission sets are optional add-ons, and a user can have many.
- Can a permission set take away access?
- Only as a muting permission set inside a permission set group. Standalone permission sets are purely additive.
More from the Glossary
- What Is Field-Level Security in Salesforce?Field-level security (FLS) controls which fields a user can read or edit on records they already have access to. It is enforced in the UI, in reports, and in
- What Is a Change Set in Salesforce?A change set is Salesforce's built-in, point-and-click mechanism for moving configuration - not data - from one connected org to another, most commonly from a
- What Is a Duplicate Rule in Salesforce?A duplicate rule defines what Salesforce does when a user is about to save a record that looks like an existing one - block it, allow it with a warning, or ju
- What Is a Record Type in Salesforce?A record type lets one object behave differently for different business processes - different page layouts, different picklist values, and different default v
- What Is a Salesforce ID in Salesforce?A Salesforce ID is the unique identifier of a record. It comes in a 15-character case-sensitive form and an 18-character case-insensitive form that is safe fo
- What Is a Sandbox in Salesforce?A sandbox is a copy of your Salesforce org used for development, testing, and training, isolated from production data and users.
Related reading
- Admin How-ToHow to Check Field-Level Security in Salesforce FastCheck field-level security in Salesforce without clicking through Setup: where FLS lives, how it interacts with profiles and permission sets, and faster ways to read it.
- Admin How-ToHow to Compare Two Profiles in SalesforceCompare two Salesforce profiles field by field: the native Setup route, the permission types worth diffing, and how to keep the result auditable.
- Admin How-ToHow to Log In as Another User in SalesforceLog in as another Salesforce user to reproduce a permission issue - the Setup route, the permissions required, and how to switch orgs without losing your place.