Configuration and Setup15% of the exam
Profiles, permission sets, groups and muting
How to grant object, field and system permissions with the least effort and least privilege: what only a profile can do, why permission sets and permission set groups are the recommended model, how permissions combine, and how a muting permission set removes a permission from one group without touching the others.
Given a scenario, determine the appropriate use of a custom profile or permission set (using the various profile settings, permission set group, and muting).
~7 min read · 6 practice questions ·
What the exam expects
- Decide whether a requirement belongs on a profile or in a permission set, knowing which settings only profiles hold.
- Grant a one-off permission to a single user without cloning a profile.
- Predict a user's effective permissions when a profile and several permission sets grant different levels on the same object.
- Remove a permission that a profile grants, and explain why a permission set can't do it.
- Bundle permission sets into permission set groups by job function, and use a muting permission set to withhold one permission from one group.
Key facts
Profiles per user
- Detail
- Exactly one
Permission sets per user
- Detail
- Many, depending on edition
Profile-only settings
- Detail
- Login hours, IP ranges, page layout assignment, default app and record type
Combining permissions
- Detail
- Most permissive result across profile, permission sets and groups
Denying access
- Detail
- Not possible with profiles, permission sets or groups
Recommended baseline profile
- Detail
- Minimum Access - Salesforce, or a clone of it
Permission set group
- Detail
- Users get the combined permissions of its permission sets
Permission set reuse
- Detail
- One permission set can be in many groups
Muting permission sets per group
- Detail
- Only one
Muting scope
- Detail
- Only permissions from that group's permission sets, only for that group's users
Mute permission
- Detail
- Requires Manage Profiles and Permission Sets
Assignment expiration
- Detail
- Permission set and group assignments can end on a set date
Sources for this section (5)
- Which settings can only be configured on a profile?
- What access does a user have when the profile grants Read and a permission set grants Create and Edit on the same object?
- When a shared profile grants a permission that most of its users must lose, how do you remove it while keeping it for a few?
- Where does a muting permission set live, and which permissions can it mute?
- Why are permission set groups easier to maintain than one profile per job function?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 28 lessons of the Platform Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (6 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams