# Custom profiles, permission sets and delegated administration

*Platform Administrator II Study Guide · Security and Access · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-administrator-ii/security-and-access/custom-profiles-permission-sets-and-delegated-administration*

Choose between profiles, permission sets, permission set groups with muting, View All and Modify All Records, custom permissions and delegated administration, and predict what each can and can't grant, edit or restrict.

- Certification: Salesforce Platform Administrator II
- Exam section: Security and Access
- Study guide: https://www.certifyforce.com/study-guide/platform-administrator-ii

**Official exam objective:**

> Compare and contrast the capabilities of custom profiles, permission sets, and delegated administration.

## What the exam expects

- Decide what still lives on a profile in a Minimum Access - Salesforce plus permission sets model.
- Grant extra access with a permission set when a standard profile can't be edited.
- Use permission set groups and their one muting permission set to remove a permission for one persona.
- Pick View All Records and Modify All Records for one object's records instead of View All Data, Modify All Data or delegation.
- Scope a delegated administrator and predict what they can't do.
- Explain field-level security and custom permissions as access checks assigned through permission sets or profiles.

Key terms: **profile** (a user's one set of default settings, tied to a user license); **permission set** (a reusable bundle that adds access); **permission set group** (bundled permission sets for a persona); **muting permission set** (disables selected permissions inside one group); **delegated administrator** (a non-admin who manages users and selected setup inside a defined scope).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Profile and license | Every profile belongs to exactly one user license type | [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&language=en_US&type=5) |
| Recommended baseline | Minimum Access - Salesforce (or a clone) plus permission sets and groups | [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&language=en_US&type=5) |
| Standard profiles | Permissions can't be edited; session settings and password policies can | [Standard Profiles](https://help.salesforce.com/s/articleView?language=en_US&id=platform.standard_profiles.htm&type=5) |
| Permission set vs profile | A permission in a set is granted even if the profile lacks it | [Permission Sets](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_sets_overview.htm) |
| Permission set in groups | Can be in several groups; updates propagate to all of them | [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5) |
| Muting sets per group | Up to one; mutes object, field and user permissions | [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=sf.perm_set_groups_muting.htm&language=en_US&type=5) |
| View All / Modify All Records | Override sharing for one object | [Object Permissions](https://help.salesforce.com/s/articleView?id=platform.users_profiles_object_perms.htm) |
| Field-level security vs layout | The more restrictive setting applies | [Field Permissions](https://help.salesforce.com/s/articleView?id=sf.admin_fls.htm&language=en_US&type=5) |
| Custom permissions | Assigned through permission sets or profiles | [Custom Permissions](https://help.salesforce.com/s/articleView?id=platform.custom_perms_overview.htm&type=5) |
| Delegated user scope | Specified roles and all subordinate roles | [Delegate Administrative Duties](https://help.salesforce.com/s/articleView?id=sf.admin_delegate.htm&language=en_US&type=5) |
| Delegation and Modify All Data | Can't assign it, or activate or deactivate users who have it | [Delegate Administrative Duties](https://help.salesforce.com/s/articleView?id=sf.admin_delegate.htm&language=en_US&type=5) |
| Delegated custom object admin | No relationships, no org-wide defaults | [Delegate Administrative Duties](https://help.salesforce.com/s/articleView?id=sf.admin_delegate.htm&language=en_US&type=5) |

## Check yourself

- Why mute a permission instead of removing it from a permission set used in several groups?
- When can a delegated administrator not assign a permission set listed in their group?
- What does a profile still decide when all functional access comes from permission sets?
- Which delegated actions are allowed for users in the delegated roles?

## Sources

- [Delegate Administrative Duties](https://help.salesforce.com/s/articleView?id=sf.admin_delegate.htm&language=en_US&type=5)
- [Permission Sets](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_sets_overview.htm)
- [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5)
- [Muting Permission Sets](https://help.salesforce.com/s/articleView?id=sf.perm_set_groups_muting.htm&language=en_US&type=5)
- [Provided Flow Core Actions](https://help.salesforce.com/s/articleView?language=en_US&id=platform.flow_ref_elements_actions_list.htm&type=5)
- [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&language=en_US&type=5)
- [Standard Profiles](https://help.salesforce.com/s/articleView?language=en_US&id=platform.standard_profiles.htm&type=5)
- [Object Permissions](https://help.salesforce.com/s/articleView?id=platform.users_profiles_object_perms.htm)
- [View All and Modify All Permissions Overview](https://help.salesforce.com/s/articleView?id=platform.users_profiles_view_all_mod_all.htm&language=en_US&type=5)
- [Field Permissions](https://help.salesforce.com/s/articleView?id=sf.admin_fls.htm&language=en_US&type=5)
- [Custom Permissions](https://help.salesforce.com/s/articleView?id=platform.custom_perms_overview.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator II pack (USD $19): https://www.certifyforce.com/practice-exams