Loading

Find Users who are not assigned to a Permission Set

Veröffentlichungsdatum: May 28, 2026
Beschreibung

In Salesforce, a Permission Set is a collection of settings and permissions that gives users access to specific tools and functions beyond what their profile provides. There are two types of Permission Sets in Salesforce:

  1. Permission Set Owned by User (User-Created): Manually created by an administrator and explicitly assigned to one or more users. Read more: Permission Set Overview.
  2. Permission Set Owned by Profile (System-Generated): Every Salesforce profile is automatically associated with a system-generated Permission Set that stores the profile's user, object, field, and setup entity access permissions. These Profile-owned Permission Sets can be queried but cannot be modified.

By default, every Salesforce user is assigned to the Profile-owned Permission Set, which is not visible in the Salesforce User Interface. When you query the PermissionSetAssignment object through Data Loader or Workbench, you will see these system-generated assignments alongside any user-created ones. To find users who have NOT been explicitly assigned a user-created Permission Set, use the query and steps below.

Lösung

To identify Salesforce users who are not assigned any user-created (non-profile-owned) Permission Sets, follow these steps using Data Loader:

  1. Log in to Data Loader and select the Export option.
  2. Check the checkbox Show all Salesforce objects and select the Permission Set Assignment object.
  3. Run the following SOQL (Salesforce Object Query Language) query to retrieve all users who have at least one user-created Permission Set assignment:

    Select AssigneeId, PermissionSet.isOwnedByProfile FROM PermissionSetAssignment WHERE PermissionSet.isOwnedByProfile = False

    This query returns PermissionSetAssignment records where the associated Permission Set was created by an administrator (not auto-generated by a Profile).
  4. Remove duplicate records from the exported file in Excel using the Remove Duplicates option under Data.
  5. Create a Report in Salesforce based on the User object to display the User Id, then export it.
  6. Perform a VLOOKUP between the file from Step 5 and the file from Step 4 to identify users whose Id does NOT appear in the Step 4 results — these users are not assigned to any user-created Permission Set.

Note: The Step 4 export shows users who HAVE a user-created Permission Set. Users NOT in that list are the ones without an explicit assignment. Every user will always appear in Permission Set queries with at least one profile-owned assignment — this is expected Salesforce behavior.


Important: Assistance with troubleshooting SOQL queries or gathering data via API tools such as Workbench or Data Loader is outside the scope of Salesforce Premier Support.

Nummer des Knowledge-Artikels

000388269

 
Laden
Salesforce Help | Article