Get Started Free A Permission Set in Salesforce is a container of settings and permissions that grants a user additional access on top of their Profile. Permission sets are strictly additive: they can grant access, but never remove permissions granted by a user’s Profile or another Permission Set. A user has exactly one Profile but can have many Permission Sets assigned at once. Salesforce recommends using minimal Profiles and granting additional access through Permission Sets and Permission Set Groups whenever possible.
You’ll meet this term whenever a Salesforce admin needs to give specific users extra access without rebuilding their Profile: a sales rep covering for a peer on leave, a manager who occasionally edits closed Opportunities, or an integration user that needs API permissions during a migration.
PRACTICAL EXAMPLE
A company runs all sales users on a single Minimum Access- Salesforce Profile. New hires get the “Sales User” Permission Set Group assigned, which bundles three Permission Sets: “Lead and Opportunity Edit”, “Account Read”, and “Standard Sales Reports”. When a rep is promoted to manager, the admin adds the “Sales Manager” Permission Set Group with permissions to manage forecasts and run team reports. When the rep covers a peer on parental leave, they get the “Team Pipeline Coverage” Permission Set assigned with a 90-day expiration date. After 90 days, Salesforce automatically removes the assignment.
Quick facts
-
Additive only: Permission Sets can add access but never remove it. If a permission is already granted by the Profile, no Permission Set can take it away. To restrict access, you need a Muting Permission Set inside a Permission Set Group.
-
Multiple per user: unlike Profiles (one per user), Permission Sets can be assigned to many users, and a user can have many Permission Sets. They stack additively.
-
Available in: Essentials, Contact Manager, Professional, Group, Enterprise, Performance, Unlimited, Developer, Database.com. Professional Edition includes a default limit of 10 Permission Sets per org. You can increase this limit by upgrading your Salesforce edition or purchasing additional capacity. Salesforce Technical Support can’t increase the limit. Contact your Account Executive to request.
-
Permission Set Groups bundle them: a Group combines multiple Permission Sets into one assignable unit, useful for personas like “Senior Sales” or “Field Service Manager”.
-
Cannot include everything: page layout assignments, default record types, login hours, and IP ranges stay on the Profile, not on Permission Sets.
-
Custom Permissions for visibility filters: Lightning page component visibility supports Custom Permission filters but not Permission Set assignments directly. To show a component, such as a Related List, only to specific users, create a Custom Permission, assign it through a Permission Set or Profile, and use that Custom Permission in the component’s visibility filter. Users must still have the required object, field, and record-level access to view the related records.
Note
A frequent mistake: admins create a “Restricted User” Permission Set expecting it to limit access, then wonder why nothing changes. Permission Sets can only add, never remove. To actually restrict a user, change the baseline Profile to a more limited one, or use a Permission Set Group with a Muting Permission Set that disables specific permissions the included Permission Sets would otherwise grant. Muting Permission Sets only work inside a Group, not when assigned directly.
FAQ
What is the difference between a Permission Set and a Profile in Salesforce?
A Profile sets baseline access for a user and can restrict access. A Permission Set adds access on top of the Profile and can only grant, never restrict. A user has exactly one Profile and can have many Permission Sets. The current best practice is to keep Profiles minimal (login hours, login IP ranges, page layouts, default record types) and put all granular permissions into Permission Sets and Permission Set Groups.
How many Permission Sets can a user have in Salesforce?
There is no fixed limit on the number of Permission Sets a user can have. A user can be assigned multiple Permission Sets, subject to the number of Permission Sets available in the org. Professional Edition includes a default limit of 10 Permission Sets per org, while Enterprise, Performance, Unlimited, and Developer editions support 1000.
Can a Permission Set be assigned to a Profile in Salesforce?
No. Permission Sets are assigned to users, not to Profiles. A common workaround for "everyone on this Profile needs this access" is to assign the Permission Set to users through a Permission Set Group, or grant the access on the Profile itself if it applies to everyone using that Profile.
