ACCESS CONTROL (CONFIGURATION & SETUP)

What is a profile in Salesforce?

The base level of access for a user that controls object permissions

How many profiles can a user have?

Exactly one

What is a permission set?

An additive set of permissions that extends a user’s access beyond their profile

How many permission sets can a user have?

Multiple

Do permission sets remove access?

No

When should profiles be used?

To define the minimum access a user needs to perform their job

When should permission sets be used?

To grant additional access without changing a user’s profile

What is the relationship between profiles and permission sets?

Profiles define baseline access; permission sets extend it

What is a permission set group?

A collection of permission sets bundled and assigned as a single unit

Why use permission set groups?

To simplify access management for users who need the same combination of permissions

When should a permission set group be used?

When many users require the same set of permissions

Where can login IP ranges be configured?

On profiles and permission sets

What do login IP ranges control?

The locations from which a user is allowed to log in

Where can login hours be configured?

On profiles and permission sets

What do login hours control?

The times during which a user is allowed to log in

Which login restriction applies if multiple are set?

The most restrictive login IP range or login hour always applies

What is the order of access control layers?

License → Profile → Permission Sets → Permission Set Groups

If a user has access issues

what should be checked first?

Can permission sets override profile restrictions?

They can only add access

What is the best practice for managing access?

Use minimal profiles and control access primarily with permission sets