Permission Sets and Profile Settings in Change Sets
Developers can use permission sets or profile settings to specify permissions and other access settings in a change set. When deciding whether to use permission sets, profile settings, or a combination of both, consider the similarities and differences.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
| Available in Enterprise, Performance, Unlimited, and Database.com Editions |
| Permission sets available in: Contact Manager, Professional, Group, Enterprise, Performance, Unlimited, Developer, and Database.com Editions |
In API version 40.0 and later, when you deploy the output of a retrieval to another org, the metadata in the deployment replaces the target org metadata. In API version 39.0 and earlier, when you deploy your retrieved permission set output to another org, the deployment contents are merged with your current org data. For example:
- In API version 40.0 and later, if your permission set contains the Manage Roles user permission and you deploy a metadata file without this user permission, Manage Roles is disabled in the target org. Or, let's say you have a permission set with edit access to fields in an object. If the change set fails to include these fields, the permissions are still carried over to the target org and these changes are deployed.
- In API version 39.0 and earlier, if you deploy a metadata file without this user permission, Manage Roles remains enabled.
- Keep in mind that by default, change set deploys enable dependencies. For example, if your change set contains a custom profile with Lead Conversion enabled, Lead object permissions are enabled.
| Behavior | Permission Sets | Profile Settings |
|---|---|---|
| Included permissions and settings |
Assigned apps and tab settings are not included in permission set components. |
|
| Included permissions and settings that require supporting components |
|
|
| Added as a component? | Yes | No. Profiles are added in a separate setting. |
For Visualforce page access and Apex class access, always include supporting components in the change set.
