You are here:
Permission Set Group Status and Recalculation
A permission set group calculates the combined permissions from the included permission sets. The permission set group status indicates whether the calculation and resulting permissions in the group are up-to-date and available for the assigned users.
Required Editions
| Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience |
| Available in: Contact Manager, Group, Essentials, Professional, Enterprise, Performance, Unlimited, Developer, and Database.com Editions |
Whenever you add, delete, or edit a custom permission set in a permission set group, a calculation is applied to ensure the correct aggregation of permissions. Permissions in the permission set group can start recalculating as soon as the change is made, but the process isn’t instantaneous. The recalculation is queued and then processed, which can take time depending on multiple factors. Permission changes for Salesforce-owned standard permission sets that are added to permission set groups are calculated daily.
Users assigned to the permission set group retain the combined permissions available in the group as of the last completed calculation.
You can also manually recalculate a permission set group. You can use a manual recalculation if your permission set group has a status of Failed after deployments or package updates. On the permission set group’s detail page, click the Recalculate button.
Recalculation Statuses
| STATUS | DESCRIPTION | User Assignment | Group Editing | Notes |
|---|---|---|---|---|
| Updated | Combined permissions correctly reflect all permissions added to the group. |
Allowed | Allowed | |
| Outdated | Changes are captured and system is updating the permission set group. | Unable to modify user assignments for the group | Allowed | Users assigned to the group don’t yet have the updated permissions. |
| Updating | The permission set group is recalculating because of recent changes to one or more of its permission sets. The recalculating process is quick, so you rarely see this status. |
Not Allowed | Not Allowed | Users assigned to the group don’t yet have the updated permissions. When the recalculation is complete, the group status changes to Updated or Failed. |
| Failed | The permission set group recalculation failed. |
Not Allowed | Allowed | Verify if a recent addition of a component to one of the permission sets in the permission set group is causing the failure. Remove the recently added component and see if the error persists. If your permission set group references a managed package component, and the managed package gets into an inactive state, the permission set group fails recalculation. If you use managed packages, verify that they aren’t expired. While a permission set group is in a failed state, changes aren’t propagated to the combined permission page. Users assigned to the group don’t have updated permissions. |
Recalculation Timing
The time that it takes to recalculate a permission set group can increase because of these factors.
- A large number of included permission sets in the permission set group.
- Complex included permission sets, which can result from a large number of enabled object permissions, field permissions, Apex classes, Visualforce pages, and other settings.
- The inclusion of permission sets without a required license in the permission set group, as all enabled object and user permissions must be evaluated for each assigned user.
- A large number of permission and access setting changes being introduced at once.
- A large number of users assigned to the permission set group.
- Concurrent recalculations that are triggered by other processes, such as package installations, Apex tests, and metadata deployments.
- Failures during the recalculation process, which can lead to longer processing times.
Because recalculation runs asynchronously, the processing time can range from seconds to hours for large or complicated updates. If you frequently experience long permission set group recalculation times, consider these potential solutions.
- When managing permission set assignments for a large number of users, use API tools such as Data Loader.
- Periodically review your permission sets and permission set groups. Remove any included permission sets that are redundant, and remove users from permission sets if they already have the same access from a permission set group.
- If an automatic recalculation failed, try to manually recalculate the permission set group.
- Make sure you’re following best practices for creating permission sets and permission set groups.
If you continue to encounter issues, contact Salesforce Customer Support.
