Permissions in Profiles Retirement Postponed — Spring '26 End-of-Life Not Enforced

Although profile-based permissions are still supported, Salesforce recommends adopting a least-privilege model using profiles for baseline settings and permission sets for access control.

What Should Be Managed in Profiles

Use profiles to define default user settings:

• Default assigned apps
• Default record types and page layouts
• Login hours
• Login IP ranges
• Password policies
• Session settings

Best Practice:

• Assign users the Minimum Access – Salesforce profile (or a clone)
• Avoid adding permissions directly to profiles where possible

What Should Be Managed in Permission Sets

Use permission sets and permission set groups for access and permissions:

• Object permissions
• Field-level security
• User permissions (system and app)
• Custom permissions
• Tab settings
• Record types (non-default)
• Visualforce page access
• Apex class access
• Connected app access
• Assigned apps (non-default)

Using Permission Set Groups

• Combine multiple permission sets into Permission Set Groups
• Align groups with user roles or job functions
• Simplify assignment and management

Migration Recommendations

To transition from profiles to permission sets:

1. Plan and document your current permissions model
2. Design permission sets and groups based on user roles
3. Use User Access Policies to automate assignments
4. Test thoroughly in a sandbox environment
5. Roll out changes to production after validation