--- schema_version: "1" id: a2ce8fc6b1fbe9be0e532aad88f71c9b5e72f37784e28ab3e45be50f7e32e34a title: Permissions and Access Settings collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/permissions_about_users_access.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.permissions_about_users_access.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 6f9a0a2dacea7ddb3a48b93144fffc6cdbddd0f479595a81182c733150ab3821 description: User, object, and field permissions and access settings can be specified in profiles and permission sets. To use them effectively, understand the differences between profiles and permission sets. products: - Security - Salesforce Platform release: "264" --- # Permissions and Access Settings User, object, and field permissions and access settings can be specified in profiles and permission sets. To use them effectively, understand the differences between profiles and permission sets. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
The available permissions and settings vary according to which Salesforce edition you have.
Permission sets available in: Essentials, Contact Manager, Professional, Group, Enterprise, Performance, Unlimited, Developer, and Database.com Editions
![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/images/icon_tip.png) Tip Setup with Agentforce can help you manage permissions more efficiently. For more information, see [Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_overview.htm&language=en_US) and [User Access Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_user_access.htm&language=en_US). Permissions and access settings specify what users can do within an organization: - Permissions determine a user's ability to access object records and perform certain tasks, such as viewing the Setup menu, permanently deleting records in the Recycle Bin, or resetting a user's password. - Access settings determine other functions, such as access to Apex classes, app visibility, and the hours when users can log in. Every user is assigned only one profile, but can also have multiple permission sets. When setting up your users, use profiles to manage default settings, such as assigned apps, record types, page layouts. Then use permission sets to configure permissions and access settings. This table shows the types of permissions and access settings that can be specified in profiles and permission sets and the recommended feature for managing them. | Permission or Setting Type | In Profiles? | In Permission Sets? | Recommended Feature | | --- | --- | --- | --- | | Assigned apps | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Profiles for default assigned apps, permission sets for additional assignments | | Tab settings | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Record type assignments | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Profiles for default record types, permission sets for additional assignments | | Page layout assignments | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) |   | Profiles | | Object permissions | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Field permissions | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | User permissions (app and system) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Custom permissions | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Apex class access | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Visualforce page access | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | External data source access | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Connected app access | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Legacy SAML service provider access (not created via connected apps) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) | Permission sets | | Login hours | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) |   | Profiles | | Login IP ranges | ![Check icon indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-access-264-0-0-production-enus/a92be132-3cbc-412a-9262-130636120c14/resources-global/_corporate/images/checkmark.png) |   | Profiles | - **[User Permissions](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&release=264.0.0&type=5)** User permissions specify what tasks users can perform and what features users can access. For example, users with the View Setup and Configuration user permission can view Setup pages, and users with the API Enabled user permission can access any Salesforce API. - **[Object Permissions](https://help.salesforce.com/s/articleView?id=platform.users_profiles_object_perms.htm&release=264.0.0&type=5)** Object permissions specify the base-level access users have to create, read, edit, and delete records for each object. - **[Field Permissions](https://help.salesforce.com/s/articleView?id=platform.users_profiles_field_perms.htm&release=264.0.0&type=5)** Field permissions, or field-level security, lets you specify whether users can view or edit each field for an object. - **[Custom Permissions](https://help.salesforce.com/s/articleView?id=platform.custom_perms_overview.htm&release=264.0.0&type=5)** Use custom permissions to give users access to custom processes or apps. - **[Permission Dependencies and Alignment](https://help.salesforce.com/s/articleView?id=platform.users_perm_dependencies.htm&release=264.0.0&type=5)** Some object and user (app and system) permissions are dependent on each other to make sure that assigned users have the correct access to related data and tasks. When needed, Salesforce automatically enables dependent permissions in profiles and permission sets to grant assigned users required object and feature access. - **[Revoke Permissions and Access](https://help.salesforce.com/s/articleView?id=platform.permissions_revoking_access.htm&release=264.0.0&type=5)** You can use profiles, permission sets, and permission set groups to grant access but not to deny access. Permissions granted from profiles, permission sets, and permission set groups are honored. For example, if Transfer Record isn't enabled in a profile but is enabled in a permission set, the assigned user can transfer records regardless of whether the user owns them. To revoke a permission, you must remove all instances of the permission from the user. #### See Also - [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&release=264.0.0&type=5 "Profiles define default settings for users. When you create users, you assign a profile to each one.") - [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&release=264.0.0&type=5 "A permission set is a collection of settings and permissions that give users access to various tools and functions. Permission sets extend users’ functional access without changing their profiles and are the recommended way to manage your users’ permissions.") - [Revoke Permissions and Access](https://help.salesforce.com/s/articleView?id=platform.permissions_revoking_access.htm&release=264.0.0&type=5 "You can use profiles, permission sets, and permission set groups to grant access but not to deny access. Permissions granted from profiles, permission sets, and permission set groups are honored. For example, if Transfer Record isn't enabled in a profile but is enabled in a permission set, the assigned user can transfer records regardless of whether the user owns them. To revoke a permission, you must remove all instances of the permission from the user.")