Configuration and Setup15% of the exam
Profiles, permission sets, groups and muting
How to grant object, field and system permissions with the least effort and least privilege: what only a profile can do, why permission sets and permission set groups are the recommended model, how permissions combine, and how a muting permission set removes a permission from one group without touching the others.
Given a scenario, determine the appropriate use of a custom profile or permission set (using the various profile settings, permission set group, and muting).
~7 min read · 6 practice questions
What the exam expects
- Decide whether a requirement belongs on a profile or in a permission set, knowing which settings only profiles hold.
- Grant a one-off permission to a single user without cloning a profile.
- Predict a user's effective permissions when a profile and several permission sets grant different levels on the same object.
- Remove a permission that a profile grants, and explain why a permission set can't do it.
- Bundle permission sets into permission set groups by job function, and use a muting permission set to withhold one permission from one group.
Key facts
Profiles per user
- Detail
- Exactly one
Permission sets per user
- Detail
- Many, depending on edition
Profile-only settings
- Detail
- Login hours, IP ranges, page layout assignment, default app and record type
Combining permissions
- Detail
- Most permissive result across profile, permission sets and groups
Denying access
- Detail
- Not possible with profiles, permission sets or groups
Recommended baseline profile
- Detail
- Minimum Access - Salesforce, or a clone of it
Permission set group
- Detail
- Users get the combined permissions of its permission sets
Permission set reuse
- Detail
- One permission set can be in many groups
Muting permission sets per group
- Detail
- Only one
Muting scope
- Detail
- Only permissions from that group's permission sets, only for that group's users
Mute permission
- Detail
- Requires Manage Profiles and Permission Sets
Assignment expiration
- Detail
- Permission set and group assignments can end on a set date
Sources for this section (5)
- Where do you see every user assigned to a permission set?
- How many profiles and permission sets can one user hold?
- When you need every permission a user holds, from the profile and all permission sets and groups, in one place, what do you open?
- What do integration permission sets define?
- Why does a permission set group show a status?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 28 lessons of the Platform Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (6 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both