Security and Access20% of the exam
Custom profiles, permission sets and delegated administration
Choose between profiles, permission sets, permission set groups with muting, View All and Modify All Records, custom permissions and delegated administration, and predict what each can and can't grant, edit or restrict.
Compare and contrast the capabilities of custom profiles, permission sets, and delegated administration.
~8 min read · 10 practice questions ·
What the exam expects
- Decide what still lives on a profile in a Minimum Access - Salesforce plus permission sets model.
- Grant extra access with a permission set when a standard profile can't be edited.
- Use permission set groups and their one muting permission set to remove a permission for one persona.
- Pick View All Records and Modify All Records for one object's records instead of View All Data, Modify All Data or delegation.
- Scope a delegated administrator and predict what they can't do.
- Explain field-level security and custom permissions as access checks assigned through permission sets or profiles.
Key terms: profile (a user's one set of default settings, tied to a user license); permission set (a reusable bundle that adds access); permission set group (bundled permission sets for a persona); muting permission set (disables selected permissions inside one group); delegated administrator (a non-admin who manages users and selected setup inside a defined scope).
Key facts
Profile and license
- Detail
- Every profile belongs to exactly one user license type
Recommended baseline
- Detail
- Minimum Access - Salesforce (or a clone) plus permission sets and groups
Standard profiles
- Detail
- Permissions can't be edited; session settings and password policies can
Permission set vs profile
- Detail
- A permission in a set is granted even if the profile lacks it
Permission set in groups
- Detail
- Can be in several groups; updates propagate to all of them
Muting sets per group
- Detail
- Up to one; mutes object, field and user permissions
View All / Modify All Records
- Detail
- Override sharing for one object
Field-level security vs layout
- Detail
- The more restrictive setting applies
Custom permissions
- Detail
- Assigned through permission sets or profiles
Delegated user scope
- Detail
- Specified roles and all subordinate roles
Delegation and Modify All Data
- Detail
- Can't assign it, or activate or deactivate users who have it
Delegated custom object admin
- Detail
- No relationships, no org-wide defaults
Sources for this section (9)
- Profileshelp.salesforce.com (opens in a new tab)
- Standard Profileshelp.salesforce.com (opens in a new tab)
- Permission Setshelp.salesforce.com (opens in a new tab)
- Permission Set Groupshelp.salesforce.com (opens in a new tab)
- Muting Permission Setshelp.salesforce.com (opens in a new tab)
- Object Permissionshelp.salesforce.com (opens in a new tab)
- Field Permissionshelp.salesforce.com (opens in a new tab)
- Custom Permissionshelp.salesforce.com (opens in a new tab)
- Delegate Administrative Dutieshelp.salesforce.com (opens in a new tab)
- Why mute a permission instead of removing it from a permission set used in several groups?
- When can a delegated administrator not assign a permission set listed in their group?
- What does a profile still decide when all functional access comes from permission sets?
- Which delegated actions are allowed for users in the delegated roles?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator II pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 29 lessons of the Platform Administrator II guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams