Users, profiles, and permission sets

Every user has one license and one profile. Salesforce now recommends a lean profile plus permission sets and permission set groups for everything else. Login controls such as login hours, IP ranges, and multi-factor authentication decide when and from where people can get in.

Managing users

• Creating users: Each user needs a unique username in email format (it doesn't have to be a real mailbox), an email address, a user license, and a profile.
• Deactivating users: Users can't be deleted, only deactivated. Deactivation frees the license and keeps the records they own and the history they created.
• Freezing users: Stops a user from logging in right away, without deactivating. Useful while you reassign their records or when deactivation is blocked, for example because they are a default owner somewhere.
• Resetting passwords and login as: Admins can reset a password, and with "Login as" access granted (or allowed org-wide), log in as a user to see what they see.
• Before deactivating someone, transfer the records they own and check whether they are named in assignment rules, as a queue member, or as a default owner (for example for web-to-lead or cases).

Profiles

• What a profile does: Sets a user's baseline: object permissions, field-level security, app and tab visibility, page layout assignments, record type access, login hours, and login IP ranges.
• One per user: Each user has exactly one profile, and a profile belongs to one user license type.
• Standard vs custom profiles: Standard profiles can't have most permissions edited, so clone one to make a custom profile you can change.
• Minimum-access approach: Keep profiles minimal and add access with permission sets. A profile per job role leads to dozens of near-identical profiles.

Permission sets and groups

• Permission set: A bundle of permissions you can assign to many users, on top of their profile. A user can have many permission sets. Permission sets only add access; they never remove it.
• Permission set group: Combines several permission sets into one assignment, for example everything a sales manager needs.
• Muting permission set: Lives inside a permission set group and turns off selected permissions for that group only, without changing the underlying sets.
• Permission set licenses: Some features need a permission set license assigned to the user before the matching permission set can be assigned.
• Expiration dates can be set on permission set and group assignments, which suits temporary access such as a project or a cover period.

Login controls

• Login hours: Set on the profile. Users can't log in outside the hours. Anyone still logged in when the window closes is logged out at their next action.
• Login IP ranges (profile): Users with the profile can log in only from the listed ranges. Logins from anywhere else are refused.
• Trusted IP ranges (Network Access): Org-wide. Logins from these ranges skip the identity verification challenge; logins from other addresses are still allowed but get verified.
• Multi-factor authentication (MFA): Required for logins to Salesforce's user interface. Users verify with something like an authenticator app or a security key in addition to their password.
• Session and password policies: Org-wide settings for session timeout, password length and complexity, and lockout after failed attempts. Profiles can override password policies.