Add a specific Salesforce capability to one or more users through a Permission Set rather than editing their shared Profile.
- Identify the permission
Open the Permission Reference (Salesforce Help) and look up the exact permission name needed. Confirm the API name and the category.
- Create or open the Permission Set
Setup, Permission Sets. Create a new set named for the capability (Run Reports In Public Folders) or open an existing relevant set.
- Enable the permission
Open System Permissions inside the Permission Set. Check the box next to the target permission. Save.
- Assign to users
On the Permission Set detail, click Manage Assignments, Add Assignments. Select the users. Save.
- Verify
Log in as one assigned user (or impersonate via Login As). Confirm the capability is now available; the action that was previously blocked now works.
- Audit
Document the assignment in your access-review log. The Setup Audit Trail captures the change; your access-review process records why.
Baseline grant on the user's single Profile. Hard to change without affecting other users on the same Profile.
Additive grant assignable to individual users. The preferred mechanism for elevation.
Bundled set of Permission Sets assignable as a single unit.
Gates a permission behind IP range or re-authentication requirements.
- Profile changes affect every user on that Profile. Editing the shared Profile to grant one user a new capability gives every other user on it the same capability.
- View All Data and Modify All Data bypass the sharing model. Grant them only to system administrators and audited integration users.
- Permission Sets can grant permissions Profiles deny, but cannot revoke them. To revoke a permission, edit the Profile.
- Some user permissions require a Permission Set License. Granting the permission without the license has no effect; check the License Required column in the catalog.