Ask Search:
Mina KwonMina Kwon 

Permission Sets vs Profile vs Roles Sharing Rules

Hi,

I have just looked into Permission Sets and saw that it can set pemissions for fields and objects which was what I used to set on a User Profile. And for records settings, I've been using Roles and Sharing Rules. What is the best way is to use this new Permission Sets feature? Does it override any other settings?

 FYI, I have 5 different profiles and 6 different roles. It's always been a challenge as a System Adminitrator to figure out the best way to set security settings that our organization needs because I had to remember all the different settings that I've created months ago.  Can anyone talk about the best practice? Thanks in advance!
Adam TormanAdam Torman
Hi Mina, 
 
I work for salesforce.com as the product manager for permission sets. 
 
Permission sets and Profies are very similar. They both contain similar permissions that can be assigned to a user so that they can do things like run reports or CRUD accounts or read and edit fields. 
 
Where Profiles and Permission Sets tell you whether a user can create an account, it doesn't tell you which account they can read or edit. That's where row level access like roles and public groups come in - if a user's profile says they can read, create, edit accounts then their role and public groups tell you which accounts they can read and edit. 
 
In this way, Roles/Public Groups and Profiles/Permission Sets work together to determine a user's access to functionality and to records. If you have one but not the other, you won't have access to a record - so if you have Read on Accounts on a Profile/Permission Set but not through Sharing with Roles/Public Groups/Ownership then you don't have access and vice versa. 
 
There are some times when one may override the other. For instance, you can have the Profile/Permission Set permission, Modify All Data or View All Data, in which case, we'll ignore sharing and assume you have access to the record - but there are only a few exceptions to the rule that Profiles/Permission sets work hand-in-hand with Sharing Roles and Public Groups.
 
My colleague who is the Product Manager for Sharing, Bud Vieira, and I did a presentation last Dreamforce that you can access online to help understand how these concepts work together to provide scalable access to data and functionality: http://www.youtube.com/watch?v=EaSQk83ea7U. This is a good video for learning how these two ideas work together.
 
Hope this helps! If not, keep asking and we'll keep answering.
 
Thanks!
 
Adam

Paul FuryPaul Fury
Adam, thanks for the reply!

It would be helpful to have tab visibiliity on the Permission Sets.  Recently exposed a custom object to a profile sub-set of users by using Permission Sets.  Took a while to realize they couldn't see it because the "tab" for that object still had to be made visible in their profile.

Just throwing the comment out here in case I can save anyone else some time if they have the same issue. 
Adam TormanAdam Torman
Thanks Paul! We're definitely looking at what it would take to add tab settings in a permission set to make this easier, not only for object tabs but also for visualforce tabs as well.
sam smithsam smith
Hi Adam,

Thank you for the information. I had a raised a question in line with the above topic. Would it be possible to comment on the question I have raised on this topic? Here is the link:

http://success.salesforce.com/questionDetail?qid=a1X30000000d7HVEAY

Thanks much
Smith
vinay007 rajvinay007 raj

Profile - combination of access control and permission to provided to users.

 

Permission set  -It is enhances functionality of profiles,

imagine a scenario where only one user need access to "Account " object and he belong to some 'Any XYZ' profile. then we need to modify that profile which will effect other users with the same profile.(one profile have many users  )

 

so alternatively we can create a permission set with access to "Account"object and assign that to that particular usere 

Tzemach AronovTzemach Aronov
Hi, Adam Torman
Any chance I can get an updated link to the video or an alternative.
Thank you.