Get Started Free A Profile in Salesforce is a required user setting that defines a user’s baseline access: login hours, IP ranges, default apps, page layout assignments, object permissions, field-level security, tab visibility, and default record types. Every user has exactly one Profile, tied to one user license type. Unlike Permission Sets, which only grant additional permissions, Profiles define a user’s minimum access level.
You’ll meet this term whenever a Salesforce admin sets up a new user, assigns login restrictions, or audits who can do what in the org. Salesforce officially recommends keeping Profiles minimal (using the “Minimum Access – Salesforce” profile as a baseline) and granting all additional access through Permission Sets and Permission Set Groups.
PRACTICAL EXAMPLE
A nonprofit uses the Minimum Access – Salesforce profile for most users and manages permissions through Permission Set Groups. The profile handles settings that can’t be assigned through Permission Sets, such as login hours and login IP ranges. Access to objects, fields, apps, and system permissions is granted through Permission Set Groups based on a user’s role, such as Coach, Manager, or Admin. New users are assigned the Minimum Access profile and the Permission Set Group that matches their job responsibilities. This approach reduces the number of Profiles that need to be maintained and makes access management easier.
Quick Facts
-
Required, one per user: every Salesforce user must have exactly one Profile assigned. A user cannot exist without one.
-
Available in most editions: Profiles are available in Salesforce Classic and Lightning Experience in these editions: Essentials, Professional, Enterprise, Performance, Unlimited, Developer, and Database.com. Custom Profiles are supported in all except Database.com. In Contact Manager and Group editions, you can assign standard Profiles to users but cannot view, edit, or create custom Profiles.
-
Tied to one user license type: each Profile belongs to exactly one license type. Changing a user’s license requires changing their Profile.
-
Controls baseline access: login hours, IP ranges, default apps, page layout assignments, default record types, and baseline permissions. Some settings, including page layout assignments, Global Publisher Layout assignments, login restrictions, and default app assignments, remain Profile-based and cannot be managed through Permission Sets. Record type access can be extended through Permission Sets, but default record types are still controlled by the Profile.
-
Standard vs Custom Profiles: Standard Profiles can’t be renamed, fully edited, or deleted, but they can be cloned. Cloning is the recommended starting point for creating custom Profiles. Custom Profiles can be cloned, renamed, edited, and deleted.
-
Salesforce recommended pattern (2026): start with “Minimum Access – Salesforce” Profile as the baseline, then grant all additional access through Permission Sets and Permission Set Groups.
Note
Even when admins adopt a permission-set-led security model, Profiles can’t be eliminated. Every Salesforce user must have a Profile, and some settings remain Profile-based. For example, Global Publisher Layout assignments control the Global Actions users see. These are assigned through Profiles and have no equivalent Permission Set.
Organizations use Profiles for baseline user configuration, including login restrictions, page layout assignments, default apps, Global Publisher Layout assignments, and default record types. Object permissions, field-level security, system permissions, and most feature access are managed by Permission Sets and Permission Set Groups.
FAQ
Can a user have multiple profiles in Salesforce?
No. Each user must have exactly one Profile assigned. To grant a user additional access beyond what their Profile allows, use Permission Sets and Permission Set Groups, which stack on top of the Profile without changing it.
Can we edit standard profiles in Salesforce?
Partially. Standard Profiles can be edited, but only for specific settings: custom app settings, tab settings, desktop integration client options, session settings, and password policies. For full control over a Profile (including renaming and deletion), clone the standard Profile to create a Custom Profile, then edit the clone.
What's the difference between a Role and a Profile?
Profiles control what users can do: create, read, edit, and delete, plus access to objects, fields, page layouts, record types, apps, and tabs. Roles control what users can see: which records are visible based on their position in the hierarchy.
