Salesforce Certified Platform Administrator free question 2 / 10 · Domain 1: Configuration and Setup
In an Enterprise Edition org, you want a few users with different jobs and different departments to be able to delete and transfer leads. What permission approach does Help recommend?
- A permission that is disabled in the profile cannot be enabled in a permission set, so first enable the permission in each user's profile and add to it with the permission set
- Create a permission set that contains the lead delete and transfer permissions and assign it to those users. Profiles stay as they are
- New permissions are added through permission set groups, so create a permission set group that contains the permission and assign it to the users
- Permission sets are made for each job title, so add the permission to the permission set for each user's own job title and assign those
Show the answer and explanation
Answer: B
Why this is correct
The Help article describes a permission set as a collection of settings and permissions that extends users' access to features without changing their profiles, and it is the recommended way to manage permissions. You can create a permission set for a particular task, regardless of job or title, and the article's own example is users who delete and transfer leads. A permission that is disabled in the profile but enabled in a permission set is held by the user.
Why the other options are wrong
"A permission that is disabled in the profile cannot be enabled in a permission set, so first enable the permission in each user's profile and add to it with the permission set" … The article says that even if a permission is disabled in a profile, a user has it when a permission set enables it, and it gives Manage Password Policies as an example. You do not have to enable it in the profile first.
"New permissions are added through permission set groups, so create a permission set group that contains the permission and assign it to the users" … A permission set group bundles permission sets, typically by job function or persona, to make assignment easier. The permissions themselves are held in permission sets, and a permission set alone is enough to add a new permission.
"Permission sets are made for each job title, so add the permission to the permission set for each user's own job title and assign those" … The article says permission sets are created for particular tasks, regardless of the job or title of the people they are assigned to, and the profiles article also recommends assigning permission sets by task, not by title. Adding the permission to each title's set would scatter the same permission across many sets.
Key point
The profiles article recommends assigning the Minimum Access - Salesforce profile, or a clone of it, wherever possible and granting only the required permissions with permission sets and permission set groups. Name permission sets for the task, not the job title, so that they are small parts you can reuse. View Summary on the permission set overview page shows the enabled permissions and the groups that include the set.