Managing Future Updates to Permission Sets and Permission Set Groups

Note:

Permissions and the FinancialForce security model are being redesigned to provide you with a robust and focused approach to managing user security. A set of functional permissions is being delivered in Spring 2021 and will be present in your org. As this work is being delivered over multiple releases and is not complete, you must not implement the new functional permissions until the work is finished.

In future releases, FinancialForce will make changes to permission sets and permission set groups for PSA.

If you deploy unamended FinancialForce permission set groups and unamended FinancialForce permission sets, these will be automatically upgraded in future releases. This approach requires the least manual intervention at each release.

If you deploy cloned or custom permission set groups that contain unamended FinancialForce permission sets, the permission sets will be automatically upgraded in future releases. This approach reduces the need to manually update permission set groups following each release.

Note:

If, in a future release, a new permission set is added to a permission set group, this will not be reflected in cloned or custom permission set groups. An administrator must add the permission set manually.

If you have cloned and amended a FinancialForce permission set, the permission set will not be upgraded. An administrator must make the changes manually.

We recommend you do not clone or amend the FinancialForce permission sets. You can use permission set groups to amend the access as needed.

Best Practice

We recommend the following:

  1. Use the permission sets provided by FinancialForce rather than cloning and customizing them yourself. By doing this, you will not be required to make changes to your cloned permission sets when amended versions of permission sets are released by FinancialForce.
  2. Avoid the following to make permission sets easier to reuse, modify or delete in the future:
    1. Avoid combining managed FinancialForce and unmanaged resources in the same permission set. You can include managed and unmanaged permission sets in the same permission set group.
    2. Avoid combining permissions for multiple Salesforce packages into the same permission set or permission set group.