What are the best practices for migrating from Profiles to Permission Sets?

All answers to this question.

The best approach is to stop thinking about "User Roles" and start thinking about "Job Functions." Use the User Access Policy tool (currently in GA) to help automate the assignments. I recommend starting with a "Security Audit" using a tool like Configero or the native Salesforce Optimizer to see which profile permissions are actually being used. Create a base "Minimum Access" profile for everyone, then layer on Permission Set Groups that mirror your actual business processes. We did this for a 500-user org last year, and the "Muting Permission Set" feature was a lifesaver for handling those weird edge-case exceptions without creating ten different groups.

   Answered 2025-07-20 by Deborah Higgins

Have you considered using the "Permission Set Helper" app from the AppExchange to visualize the differences between your current profiles before you start the manual work?

   Answered 2025-08-05 by Kevin Foster

• Kevin, I looked at that app, but I’m actually leaning toward using a custom script via the Metadata API to extract the permissions. My main concern is how to handle the "Default Record Type" settings that are still tied to the Profile level. It feels like Salesforce hasn't completely decoupled everything yet, so I’m worried that a 100% Permission Set approach might still leave us with some "Profile bloat" for things like Page Layout assignments.

     Commented 2025-08-12 by Robert Sullivan

Definitely use Permission Set Groups. They allow you to bundle multiple sets together, making the "User" record look much cleaner and easier to manage for the helpdesk.

   Answered 2025-09-25 by Melissa Carter

• Totally agree with Melissa. We also started naming our Permission Sets with a strict prefix like 'PS_Sales_Export' so they are easy to search for in the setup menu.

     Commented 2025-09-30 by Deborah Higgins