When I joined Technology & Product at Salesforce over eight years ago, my mission was simple – make the world of profiles for admins easier. But, becoming the product manager in charge of profiles and user permissions was analogous to taking the red pill from the matrix (listen to my interview on #ButtonClickAdmin podcast to hear the full history!).
When I started, the profile page had grown so unmanageable that I would bring a four story tall roll of paper to Dreamforce to highlight how long, and unusable, the page had become.
From this experience, we built the enhanced profile user interface and kept the length of any particular permission page to the height of a table top. And, in combination with the enhanced list views for profiles, we started to introduce some level of management into permissions by mass editing up to 200 profiles worth of user and object permissions.
Ultimately, getting the ‘profile house’ in order was a matter of introducing least privilege into an Admin’s life.
Least privilege is a simple concept: users should have the least number of permissions necessary to do their job and nothing more. To accomplish this, we needed to break up the singleton that is a profile. But this wasn’t as easy as just assigning multiple profiles to a user.
Profiles were built with specific design constraints in mind:
The easiest way to describe the effort to create permission sets was that it was like changing a propeller into a jet engine while the plane was in flight. To move everyone to a least-privilege model meant we had to roll it out very carefully. And at one point, after we were 99% of the way there, the entire project almost was scrapped due to fear that it would bring the entire service down!! Luckily, cooler heads prevailed.
But for admins, this meant they could start assigning discrete additional permissions to their users aligned to an app, a region, a line of business, or really any other arbitrary business grouping. In talking about comparing profiles and permission sets(3), I ran some simple numbers for a basic org and found that even simple profiles could have thousands of different permissions possible with an infinite number of permission permutations!
Permission sets simplified this problem by reducing the number of permissions you needed in a profile by offloading them to discrete permission sets. Now admins could reduce the overall number of profiles in their org by assigning fewer permissions to a broader group of users and focus on specialization with permission sets.
And, to reduce some of the challenges with licenses, we introduced license-less permission sets which allow you to configure simple permission sets that span license allowances by not choosing a license when the permission set is created. Then at assignment time, we would validate that we don’t invalidate any licenses tied to the permission set assignees and we were off to the races reducing permission set proliferation.
Admins now have more flexibility in creating, assigning, and managing user permissions.
Permissions is a complex topic and not necessarily easy to grasp. Throughout my journey of improving the admin experience, I created a repository for best practices, tips, and tricks related to salesforce admins working with profiles and permissions that should answer all your questions!
Here are some popular posts:
Using the API to extend what an Admin’s user experience:
If you’re a Salesforce Admin, you know the struggle. You build an amazing solution in a sandbox, but then comes “Deployment Day.” You’re juggling sticky notes, hunting through spreadsheet logs to remember which fields you modified, and praying you didn’t forget to add a permission to the change set. You also need to consider your […]
Spring ’26 introduces Screen and Component Styling Overrides in Flow Builder, giving admins more control over how screen flows look and feel without custom code. As with any feature that expands customization, it comes with responsibility. Styling flexibility is powerful, but without a clear approach it can create inconsistency, or a screen that looks like […]
Big news for the Salesforce Admin community: The power of Flow Orchestration is officially at your fingertips. Previously a paid add-on, Orchestration is now a standard Flow type included for all Salesforce customers (subject to edition limits for Flow). For admins, this is more than just a product update. Flow Orchestration is a major toolkit […]
