User access policies for granting and revoking access
Key Takeaway
A manual user access policy runs once on demand, and an active policy runs automatically when user records are created or updated. If a user meets the criteria for more than one active policy, the policy with the lowest Order value is the one applied.
User access policies let you grant or revoke a bundle of access for many users in one operation, so you don't have to assign each license, permission set, or group one at a time. A policy finds users with filters, then runs Grant or Revoke actions.
What a policy can grant or revoke
A user access policy can grant or revoke six kinds of access mechanisms:
- Permission sets
- Permission set groups
- Permission set licenses
- Package licenses
- Public groups
- Queues
Each action pairs Grant or Revoke with one of these mechanisms. A policy supports up to 20 actions.