# Profiles, permission sets, groups and muting

*Platform Administrator Study Guide · Configuration and Setup · Last updated September 26, 2026 · https://certifyforce.com/study-guide/platform-administrator/configuration-and-setup/profiles-permission-sets-and-permission-set-groups*

How to grant object, field and system permissions with the least effort and least privilege: what only a profile can do, why permission sets and permission set groups are the recommended model, how permissions combine, and how a muting permission set removes a permission from one group without touching the others.

- Certification: Salesforce Platform Administrator
- Exam section: Configuration and Setup
- Study guide: https://certifyforce.com/study-guide/platform-administrator

**Official exam objective:**

> Given a scenario, determine the appropriate use of a custom profile or permission set (using the various profile settings, permission set group, and muting).

## What the exam expects

- Decide whether a requirement belongs on a profile or in a permission set, knowing which settings only profiles hold.
- Grant a one-off permission to a single user without cloning a profile.
- Predict a user's effective permissions when a profile and several permission sets grant different levels on the same object.
- Remove a permission that a profile grants, and explain why a permission set can't do it.
- Bundle permission sets into permission set groups by job function, and use a muting permission set to withhold one permission from one group.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Profiles per user | Exactly one | [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5) |
| Permission sets per user | Many, depending on edition | [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5) |
| Profile-only settings | Login hours, IP ranges, page layout assignment, default app and record type | [Permission Set Guidelines](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5) |
| Combining permissions | Most permissive result across profile, permission sets and groups | [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5), [Revoke Permissions](https://help.salesforce.com/s/articleView?id=platform.permissions_revoking_access.htm&type=5) |
| Denying access | Not possible with profiles, permission sets or groups | [Revoke Permissions](https://help.salesforce.com/s/articleView?id=platform.permissions_revoking_access.htm&type=5) |
| Recommended baseline profile | Minimum Access - Salesforce, or a clone of it | [Permission Set Guidelines](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5) |
| Permission set group | Users get the combined permissions of its permission sets | [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5) |
| Permission set reuse | One permission set can be in many groups | [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5) |
| Muting permission sets per group | Only one | [Mute a Permission](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5) |
| Muting scope | Only permissions from that group's permission sets, only for that group's users | [Mute a Permission](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5) |
| Mute permission | Requires Manage Profiles and Permission Sets | [Mute a Permission](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5) |
| Assignment expiration | Permission set and group assignments can end on a set date | [Permission Set Guidelines](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5) |

## Check yourself

- Which settings can only be configured on a profile? → Login hours, login IP ranges, page layout assignment, and the default app and record type ([Permission Set Guidelines](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5))
- What access does a user have when the profile grants Read and a permission set grants Create and Edit on the same object? → Read, Create and Edit: permissions combine to the most permissive result ([Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5))
- When a shared profile grants a permission that most of its users must lose, how do you remove it while keeping it for a few? → Deselect it on the profile, then re-grant it by permission set to the few who need it ([Revoke Permissions](https://help.salesforce.com/s/articleView?id=platform.permissions_revoking_access.htm&type=5))
- Where does a muting permission set live, and which permissions can it mute? → Inside one permission set group; only permissions granted by that group's permission sets ([Mute a Permission](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5))
- Why are permission set groups easier to maintain than one profile per job function? → Each persona is one assignment, and a change to a permission set flows to every group that includes it ([Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5))

## Sources

- [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm&type=5)
- [Guidelines for Creating Permission Sets and Permission Set Groups](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5)
- [Permission Set Groups](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups.htm&type=5)
- [Mute a Permission in a Permission Set Group](https://help.salesforce.com/s/articleView?language=en_US&id=platform.perm_set_groups_create_mute.htm&type=5)
- [Revoke Permissions and Access](https://help.salesforce.com/s/articleView?id=platform.permissions_revoking_access.htm&type=5)
- [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator pack (USD $19): https://certifyforce.com/practice-exams