Calling all Admins, hold on to your hats. Salesforce has gone and shaken up how we think of managing user permissions by introducing permission set groups.
Traditionally, we use profiles for permission management. They define the minimum of what our users can see and do within Salesforce, controlling access to objects or the ability to use features like Einstein Lead Scoring.
Permission Set Groups are a new feature that allows admins to provide a collection of individual permission sets that are to be assigned to our users, separate to their profiles. This enables us to offer out permissions and settings on a broader basis than we could with simple permission sets, while also saving us time in terms of implementing them.
Best practice will be to create Permission Set Groups based on specific job roles. Users will not be individually assigned to these permissions via a Profile but rather through their membership of the Permission Set Group itself. You will then create Permission Sets based on the rights and access your users need on a regular basis and assign these Permission Sets into groups that will represent their job roles. The best part is that you can include the same Permission Sets to multiple groups which means that if you ever need to update the Permission Set, those changes will propagate to all the Permission Set Groups that it is a part of. On top of all of this, you can still apply permission sets on an individual basis to continue applying the level of permission granularity that you’ve been used to.
If that wasn’t enough excitement, we have also been given the ability to mute permissions which will allow us to restrict access. Here’s an example of how this works within our Permission Set Groups:
Let’s say you have two Sales Teams, a New Business Sales Team and a Retentions Sales Team. As their admin, you understand that their job roles are slightly different, so you create a Permission Set Group for each to reflect the access and rights they need. They share a few Permission Sets across the teams as well, and one of them allows them to delete Opportunities. If you don’t want your Retentions Sales Team to delete Opportunities, you can create a muting Permission Set and apply it to this group. This way you do not need to make any changes to the original Permission Set as this would propagate to anyone else who has this Permission Set.
Did you know, we have a Salesforce tutorial page that has a variety of how to videos with tips and guidance on a whole host of Salesforce subjects.