User Access and Permission Set Assignment App

The User Access and Permission Set Assignment App was released in the Spring ‘22. I had a chance to review how it works and its functions within the Salesforce platform. Here is a brief breakdown of this new app and my thoughts on its usefulness for Salesforce Administrators. For information on how to install the app see my appendix at the end of this article.

There are 4 main components to the User Access and Permission Set Assignment App:

• Permissions Analyzer
• Converter
• Report
• Manage

PERMISSIONS ANALYZER

Function – This component allows you to see permissions based on 3 different criteria, depending on what you are trying to find. With this component, you can select a specific user and all the details of their access to the org’s objects area readily visible. You can also analyze by permission or ability and the app displays all the users with those permissions. Finally, you can analyze by Permission Set Groups which gives a view of all of the org’s Permission Set Groups.

Highlight – The most unique and helpful feature of this section is the ability to see every user with access to a specific object or field and what they are able to do with it.  For instance, if you want to know who has the ability to create accounts it is easy to find all the users with that function available to them.

CONVERTER

Function – This component converts any profile into a permission set.

Highlight – This could be very beneficial if you wanted to simplify and streamline the profiles used in your org. You could have a more basic profile appropriate for a variety of users and then apply one of these custom profile-based permission sets to the appropriate users. It would also give you the ability to adjust any of these profile-based permission sets to adapt to a specific user.

REPORT

Function – This component of the app allows you to create reports based on permission sets.

Highlight – This is a really nice feature because I don’t believe there is currently a way to achieve that without the app. It is helpful to be able to create reports on different aspects of permission sets. I do wish this function provided the ability to edit what fields are displayed on the report or filter results by other criteria. It would also be nice to type in a search box rather than scrolling through all available objects, permissions, etc. when choosing what to report on.

MANAGE

Function – This feature of the app actually allows you to create permission set groups using existing permission sets in the org. You can also assign and unassign permission set groups directly from the app using this feature.

Highlight – This is something that is easy to do already in basic setup but I can see it being helpful to make these changes within the app while already using it to investigate and address users’ accessibility to the org.

CONCLUSION

The User Access and Permission Set Assignment App accomplishes a much-needed task of being able to have a comprehensive overview of an org’s permission set usage. Once getting through the initial installation the app is very easy to use and understand. This app will be very helpful for Admins wanting to keep a close eye on their org’s security and I look forward to utilizing it further moving forward.

APPENDIX-Set UP

Before installing this app there are a few things that need to be set up in your org. First, I needed to create a connected app for the tooling API. I also created an authentication provider for the tooling API and a named credential. A permission set needed be created in order to use the named credential. Once all of that was set up, I installed the User Access and Permissions Assistant Package from the AppExchange and assigned a User Access and Permissions Assistant Access permission set to allow specific users access to this app. For any user who does not have system administrator permissions an additional permission set needs to be assigned to make sure they have the abilities needed to use the app. Finally, I set the user account to use the tooling API named credential for authentication. All the steps needed for the installation are well detailed in this article: https://help.salesforce.com/s/articleView?id=sf.perm_install_uapa.htm&type=5