Profiles versus permission sets for manufacturing user access
Key Takeaway
Permission sets only add access, so they can't remove what a user's profile grants. Keep a shared profile lean, and give each user the task-based permission sets that match their work.
Every Salesforce user has exactly one profile. The profile holds baseline settings such as login hours and page layout assignment. Permission sets add access on top of the profile for specific jobs or tasks. Salesforce recommends permission sets as the way to manage user permissions. Features such as Rebate Management have their own named permission sets, which you assign based on what each user does.
Profiles and permission sets
Think of the profile as the base layer and each permission set as an add-on stacked on top of it. Permission sets extend a user's access without changing their profile.
| Profile | Permission set | |
|---|---|---|
| How many a user has | Exactly one | Multiple, depending on the Salesforce edition |
| What you configure there | Default apps and record types, IP ranges, login hours, page layout assignment | Object permissions, field permissions, user permissions (app permissions and system permissions), custom permissions, tab settings, Apex classes, Visualforce pages, connected app access |
A requirement about login hours or which page layout a user sees points to the profile, not a permission set. You can configure permissions in profiles too. However, Salesforce recommends using profiles for default settings and permission sets for permissions.