Profiles, Permission sets & Roles


What is profile?

A profile is a group/collection of settings and permissions that define what a user can do in salesforce. A profile controls “Object permissions, Field permissions, User permissions, Tab settings, App settings, Apex class access, Visualforce page access, Page layouts, Record Types, Login hours & Login IP ranges.

You can define profiles by user’s job function. For example System Administrator, Developer, Sales Representative.

A profile can be assigned to many users, but user can be assigned single profile at atime.




Types of profiles in salesforce

  1. Standard profiles: By default salesforce provide below standard profiles. We cannot deleted standard ones.

  Read Only, Standard User, Marketing User, Contract Manager, Solution Manager & System Administrator. 

  Each of these standard one includes a default set of permissions for all of the standard objects available on the platform.

  2. Custom Profiles: Custom ones defined by us. They can be deleted if there are no users assigned with that particular one.

Navigation: setup -> Administer -> Manage users -> Profiles

profile



What is Permission Sets?

Permission set is also very similar to profile. What ever you can manage at profiles (Like Object permissions, Field Permissions, User permissions, Tab settings, App settings, Apex class permission, visualforce permission) the same you can manage here also. But the main difference between these two is that user can have only one profile and can have multiple permission sets at time.

So we can define profiles to grant minimum permissions and settings that every type of user needs, then we can use permission set to grant additional access.

Examples: 

1. We have many user in your organization with some fundamental job functions. We can assign all of then with one profile that grants them all access to do their job. But some set of people are working on special apps or some special functionality, for this type of special users we can create permission sets and can be assigned to them.

2. Some users need some temporary access to specific set of  fields and objects we can create permission set with those object & field access and we can assign that specific users.

Navigation: Setup -> Administer -> Manage users -> Permission sets

permission set

What is Role Hierarchies?

A role hierarchies controls level of visibility that users have to an organization data. By defining role hierarchies we can share access to records. Users assigned to roles near the top of hierarchies like (CEO, executives and other higher level roles) get to access the data of all users who fall directly below them i hierarchy.

Role hierarchies enable following behaviors.

A manager will always have access to the same data as his or her employees, regardless of the org-wide default settings. For custom objects, you can override this behavior by deselecting the Grant Access Using Hierarchies check box. However, we want our role hierarchy to apply to all of our custom objects, so leave the check boxes selected.

Users who tend to need access to the same types of records can be grouped together—we’ll use these groups later when we talk about sharing rules.





23 thoughts on “Profiles, Permission sets & Roles”

  1. Thanks for providing this information. It is very useful to know the actual definition of roles and etc stuffs

  2. hie, i have small query that , if OWD is private for the data and and the user is granted with permisssions in profile or permission set level.

    will the user can able to see the data as its restricted in OWD?

    Please assist me .

    1. Yes ,He will be able to see the records and data .I can give you a example by which it will be easier to understand.By OWD you close the access for each and every user i.e. making it private .Then you provide particular users a key to access those data through permission set or profiles(Here permission sets and profiles are the keys ) .It’s as simple as that

    1. First login.salesforce.com,
      Click TRY IT Free,
      Then click one of them: sales,service,App,
      Now fill all the fields od blank boxex,
      Then Agree,
      Then click Start Free Trial.

  3. Please tell if i set my OWD as Public read but in profile i give create edit permission will the user in a profile can can edit and write in the object?

    1. Yes samartha the User will be able to Create and edit the records created under Order Object .
      Like i have explained in my Previous Post also here again i will try to explain it in more layman term OWD is like Locking a door then your are giving Keys to the user through profile and Permission Sets .Here Setting OWD Public read Only is like locking the door and then giving it read and write Permission through Profile is like Giving him the Key .I think this explains your Query .

    1. Thanks everyone for your comments .if you have any queries related to salesforce you can ask it here i will try to explain it in as layman term as possible .

  4. Its really superb and good explanation…its really helpfull …
    please can u explain many more things like triggers,apex classes and full of security concepts

Leave a Reply