---
schema_version: "1"
id: 3c0727f9658a739d5a700f817224a76e7752f9477911c8321f14e83b56089f38
title: Session-Based Permission Set Groups
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/perm_set_groups_session_use.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_session_use.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6fb59e6a04d10ff4bcba44c7fa1dc03ecd63d58efe6de620bf7eb839c7b37076
description: A session-based permission set group applies to a specific user session and grants users functional access to the permission sets included in the permission set group.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Session-Based Permission Set Groups

A session-based permission set group applies to a specific user session and grants users functional access to the permission sets included in the permission set group.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (<a href="https://help.salesforce.com/articleView?id=overview_edition_lex_only.htm&amp;language=en_US" target="_blank">not available in all orgs</a>) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Contact Manager</strong>, <strong>Group</strong>, <strong>Essentials</strong>, <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, <strong>Developer</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

Let's say you have a Salesforce app that contains confidential information. You only want specific users to be able to access the information in this app during a specific session. Some users (for example, team managers) require expanded access for the same length of time. You can create a permission set group that includes the different permission sets required for the confidential access. To create custom logic for the expanded access, create a Flow or use the API. The session-based permission set group activates only when the manager-level users authenticate into your environment using a token. When the token expires, the users must reauthenticate to access the application again.

To activate session-based permission set groups via the API, provide a value for the PermissionSetGroupId field on the SessionPermSetActivation SOAP API object.

Before assigning session-based permission set groups to users, ensure that they can meet the conditions of the permission sets in the permission set group. For example, grant user access to the required tools, such as authenticators. As a best practice, inform users of the conditions under which they can access certain applications and tools.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/images/icon_important.png)

Important If you include a regular permission set in your session-based permission set group, the permission set group makes the permission set session-based. Users assigned to the permission set group have access to the permission set for the duration of the session. If a user is separately assigned permissions from a different permission set, those permissions remain effective for that user, even when the permission set group session ends. For example, you assign a session-based permission set group that contains View All Data. The user is assigned View All Data from a separate permission set outside the session-based permission set group. When the session ends for the permission set group, the user still has the View All Data permission from the regular permission set.

- **[Create Session-Based Permission Set Groups](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_create_session.htm&release=264.0.0&type=5)**  
    To allow users functional access to permission sets only during specified sessions, create a session-based permission set group. For example, grant access to an application only during an authenticated session. Then activate the session-based permission set group in a flow or via the API.
- **[Allow Users to Activate or Deactivate a Session-Based Permission Set Group](https://help.salesforce.com/s/articleView?id=platform.perm_set_groups_session_activate_flow.htm&release=264.0.0&type=5)**  
    Create a flow that users can run to activate or deactivate a session-based permission set group. The session-based permission set group grants users functional access to permission sets only during specified sessions.