Profile Retirement Cancelled: What Does Salesforce Recommend?

Introduction

Managing user access is an important part of keeping a Salesforce environment secure. As the business grows, there come to be various needs for access levels according to different roles that the users play. Maintaining these distinctions becomes challenging when the number of users increases.  

Salesforce has been making changes to the way organizations manage access to address these challenges. One of those changes was the planned retirement of permissions in Profiles as part of Salesforce's move toward a permission set–led security model. However, this retirement of permissions in Profiles was cancelled by Salesforce, which leaves many administrators asking the following question:  what does this mean for Profiles, and why are Permission Sets still recommended?

This blog will discuss what was announced by Salesforce, the reason behind the cancellation of retirement, and recommendations from Salesforce on managing user access through Profiles, Permission Sets, and Permission Set Groups.

Permissions in Profiles Retirement

User Profiles have conventionally been used both for user settings and permissions in Salesforce. Permission Sets have also allowed the granting of permissions without any change to Profile settings.

In Spring '26 release, Salesforce announced the retirement of permissions in Profiles. This was meant to allow companies to adopt permission set-centric security models where Profiles are used only for baseline configuration and Permission Sets are used to control permissions.

Salesforce had also endorsed the use of Permission Sets/Permission Set Groups for permissions management through this transition.

Cancellation of Permissions in Profiles Retirement

However, the retirement was changed later. On June 6, 2026, Salesforce cancelled the enforcement of the retirement of permissions in Profiles on the basis of customers feedback and remaining feature gaps. Customers raised concerns about the complexity of migrating existing Profile-based security models. In addition, Profiles continue to provide certain baseline settings such as login hours, login IP ranges, default apps, record types, and page layouts that are not simply replaced by Permission Sets.

This implies that permissions in Profiles will continue being supported. At the same time, Salesforce did not revoke their recommendation for a transition to a permission set-based security approach.

Salesforce Recommended Access Model

Given that Profiles continue to support permissions, it is logical to consider how these two should be employed. The suggested way by Salesforce assigns specific roles to each instead of treating them as equivalent ways to grant access.

Profiles: Profiles are used for the default  user settings.

• Default assigned apps
• Default record types and page layouts
• Login hours
• Login IP ranges
• Password policies
• Session settings

Best Practice: Salesforce recommends assigning users the Minimum Access – Salesforce profile (or a clone) and avoiding adding permissions directly to Profiles where possible.

Permission Sets: Permission Sets and Permission Set Groups are used to manage access and permissions

• Object permissions
• Field-level security
• User permissions (system and app)
• Custom permissions
• Tab settings
• Record types (non-default)
• Visualforce page access
• Apex class access
• Connected App access
• Assigned apps (non-default)

Permission Set Groups: The Permission Set Groups are useful when the users require a number of Permission Sets at once. A number of Permission Sets that relate to each other may be grouped and assigned based on the role or the job performed by the user.

Why Salesforce Continues to Recommend Permission Sets

With the withdrawal of the retirement of permissions in Profiles, a clear question arises for administrators on Salesforce : "If permissions can continue to be managed through Profiles, why does Salesforce still recommend a permission set–led security model?"

A practical example makes this easier to understand. Imagine an organization with three categories of users. The login hours, login IP ranges, password policies, and session configurations for all of them are identical. The only difference is their Salesforce access needs for their job tasks. One group may need access to Accounts and Contacts, another may need access to Cases, while a third group may need access to Opportunities. The permission set-based configuration approach takes a different route altogether. The attributes that the users share in common can stay in the Profile, whereas their permissions can be handled using Permission Sets. This becomes especially useful when a user's responsibilities change.

For example, when a user does not require any access that a particular Permission Set grants him/her, then that Permission Set can be deleted without needing to make any changes to the Profile of the user. Conversely, in case the user gets an additional responsibility, there would not be any need for developing another Profile. The required Permission Set can simply be assigned to the user. In case several Permission Sets are required for performing the duties associated with a job position, then those Permission Sets can be grouped under a single Permission Set Group.

Thus, the permission set-based approach becomes practical because, instead of developing Profiles for every combination of permissions, companies will continue using common configurations and separate management of changing access. That distinction is important when looking at Salesforce's continued recommendation. Profile permissions will still be supported by Salesforce, although Permission Sets and Permission Set Groups are recommended as preferable approaches to managing permissions and access. In cases where an organization already uses Profile based permissions, it is not necessary for everything to be replaced. This can continue to exist in tandem with Permission Sets and Permission Set Groups depending on access requirements.

Conclusion

The decision of Salesforce to cancel the enforcement of the retirement of Profiles does not mean that Profiles will be deleted from the platform nor that companies will be forced to update their current configuration. What changes is the way that access can be configured in the future. Profiles will remain useful for the provision of user settings, and Permission Sets and Permission Set Groups will take care of the variable permissions depending on the user and the duties of the user. Profiles set the foundation. Permission Sets define the flexibility!