Profile-only settings versus permission set capabilities
Key Takeaway
Permission sets add access on top of a user's one profile. You must still use the profile for default record types, page layout assignments, login IP restrictions, and login hour restrictions.
Every Salesforce user has exactly one profile and can also have multiple permission sets, depending on the edition. The profile holds the user's default settings, such as default apps, default record types, page layout assignments, and login restrictions. Permission sets add permissions and access on top of the profile. Salesforce recommends permission sets as the main way to manage what users can do. Knowing which settings still need a profile tells you when a permission set is enough and when users need a different profile.
Profiles and permission sets
Each user gets one profile when the user is created. Every profile belongs to exactly one user license type.
A user can also have multiple permission sets, depending on the edition. You can assign a permission set to users regardless of their profiles.
Permissions control access to object records and tasks, such as viewing the Setup menu, permanently deleting records in the Recycle Bin, or resetting a user's password. Access settings control other functions, such as Apex class access, app visibility, and the hours when users can log in.