Profiles, Permission sets & Roles

What is profile?

A profile is a group/collection of settings and permissions that define what a user can do in salesforce. A profile controls “Object permissions, Field permissions, User permissions, Tab settings, App settings, Apex class access, Visualforce page access, Page layouts, Record Types, Login hours & Login IP ranges.

You can define profiles by user’s job function. For example System Administrator, Developer, Sales Representative.

A profile can be assigned to many users, but user can be assigned single profile at atime.

Types of profiles in salesforce

  1. Standard profiles: By default salesforce provide below standard profiles. We cannot deleted standard ones.

  Read Only, Standard User, Marketing User, Contract Manager, Solution Manager & System Administrator. 

  Each of these standard one includes a default set of permissions for all of the standard objects available on the platform.

  2. Custom Profiles: Custom ones defined by us. They can be deleted if there are no users assigned with that particular one.

Navigation: setup -> Administer -> Manage users -> Profiles

What is Permission Sets?

Permission set is also very similar to profile. What ever you can manage at profiles (Like Object permissions, Field Permissions, User permissions, Tab settings, App settings, Apex class permission, visualforce permission) the same you can manage here also. But the main difference between these two is that user can have only one profile and can have multiple permission sets at time.

So we can define profiles to grant minimum permissions and settings that every type of user needs, then we can use permission set to grant additional access.

Examples: 

1. We have many user in your organization with some fundamental job functions. We can assign all of then with one profile that grants them all access to do their job. But some set of people are working on special apps or some special functionality, for this type of special users we can create permission sets and can be assigned to them.

2. Some users need some temporary access to specific set of  fields and objects we can create permission set with those object & field access and we can assign that specific users.

Navigation: Setup -> Administer -> Manage users -> Permission sets

What is Role Hierarchies?

A role hierarchies controls level of visibility that users have to an organization data. By defining role hierarchies we can share access to records. Users assigned to roles near the top of hierarchies like (CEO, executives and other higher level roles) get to access the data of all users who fall directly below them i hierarchy.

Role hierarchies enable following behaviors.

A manager will always have access to the same data as his or her employees, regardless of the org-wide default settings. For custom objects, you can override this behavior by deselecting the Grant Access Using Hierarchies check box. However, we want our role hierarchy to apply to all of our custom objects, so leave the check boxes selected.

Users who tend to need access to the same types of records can be grouped together—we’ll use these groups later when we talk about sharing rules.