Licenses, Delegation, and Seeing a User's Access

Module 6 of 7 in the chapter Profiles, Permission Sets and Permission Set Groups, chapter 3 of Securing Salesforce: Sharing and Visibility. Each module stands on its own.

The question this module answers: What limits what a permission set can give, who else can hand out access, and where do you look to see everything one user can do?

Here’s a question to end the chapter with. You’ve built the profile, the permission sets, the groups and the policies. A user calls and says, “I can’t see it.” Where do you look first?

Before we get there, there’s one more thing that decides what a user can do, and it’s the one people forget because it’s on a contract, not in Setup. The license.

Locks and rings of keys

Salesforce explains licenses with a picture I like: “Think of permissions as locks and of licenses as rings of keys. Before you can assign users a specific permission, they must have a license that includes the key to unlock that permission” (Licenses Overview (opens in a new tab), Salesforce Help, checked 2026-11-01).

So a permission set says which doors to open. The license decides whether the user holds the key. Salesforce’s example: the Salesforce user license includes the key to Read on contracts; the Chatter Free license doesn’t, so if you try to give that permission to a Chatter Free user, you get an error (same page).

Two rules come with the picture:

• Exactly one user license. “Every user must have exactly one user license.” That’s the ring. It’s why every profile belongs to one user license type, from module 1.
• Any number of add-ons. You “can assign one or more permission set licenses or feature licenses to incrementally unlock more permissions” (same page). Those are extra keys on the ring. I describe permission set licenses as a way to supercharge people with additional buy-ups.

Click to enlarge

The user licenses you’ll meet

A student who had just passed the exam told my class that license types are all over it. Here are the standard internal ones, from Standard User Licenses (opens in a new tab) (Salesforce Help, checked 2026-11-01):

• Salesforce. For users who need “full access to standard CRM and AppExchange apps.”
• Salesforce Platform. For users who need custom apps “but not to standard CRM functionality.” They can use accounts, contacts, reports, dashboards, documents and custom tabs, but not some standard objects, “such as forecasts, leads, campaigns, and opportunities.” There’s also a Salesforce Platform Login license, available from October 15, 2024, with the same features but paid per login for occasional users.
• Salesforce Integration. “Grants access to Salesforce data and features only through the API.” It’s for system-to-system integrations and “can’t be used for human users.” Enterprise, Unlimited and Performance Edition orgs include five. This is the license for chapter 2’s one integration, one identity.
• Identity Only and External Identity. For people who only need identity services such as single sign-on: your employees, or your customers and partners.
• Unified Employee. “Designed for every employee user at your company,” with access to employee agents in Slack and Experience Cloud sites.

External users, such as partners and customers on Experience Cloud sites, have their own licenses, and chapter 14 covers them.

Two practical things from the same page. What you buy is a SKU, which can contain more than one license: Salesforce’s example is a Platform Login SKU that includes both the Salesforce Platform Login user license and a Salesforce Platform permission set license. And after you buy, the license names, not the SKU names, appear in Setup, Company Information.

Click to enlarge

Licenses and permission sets together

Module 2 asked whether a permission set should carry a license. This is why the question exists. A permission set tied to a license can only include what that license entitles. A permission set with no license can be given to anyone, but each user still needs a license that holds the keys for what’s inside.

And one change to know, dated. Since Winter ‘26, “Related permission set license assignments are now automatically removed after you unassign a permission set or permission set group from a user.” Before that, you removed them by hand. Read the exceptions, because module 5’s policies are one of them: automatic removal doesn’t happen “when updates are made via user access policies,” nor when the user still needs the license through another permission set, when a licensed permission set is removed from a group, or when 50 or more are unassigned at once (Winter ‘26 release notes: Permissions and Sharing (opens in a new tab), checked 2026-11-01). So if a policy revokes access, check the licenses too, or you’ll pay for keys nobody uses.

Sharing the work: delegated administration

In a big org, one admin team can’t do every assignment. Delegated administration gives “limited admin privileges to users in your org who aren’t administrators.” Salesforce’s example is a Customer Support manager who manages the users in the Support Manager role and every role below it (Delegate Administrative Duties (opens in a new tab), Salesforce Help, checked 2026-11-01).

A delegated admin can, for the users in their delegated groups: create and edit users in the chosen roles and the roles below them, reset passwords, unlock users, assign the profiles you choose, assign or remove permission sets and permission set groups, and manage membership in the public groups you choose (same page).

The limits are the point. A delegated admin “Can’t assign profiles or permission sets with the Modify All Data permission,” “Can’t modify permission sets,” and can’t activate or deactivate users who have Modify All Data (same page). So the design stays with the central team, and the giving out of it is shared. That’s a good split.

One warning, in Salesforce’s words: delegated admins “Retain all privileges from their assigned user permissions, as permissions are additive and being a delegated administrator doesn’t restrict access granted elsewhere.” If you also give a delegated admin Manage Users, they can act well outside their groups. Delegation doesn’t fence anyone in. It only adds.

There’s an external version too. Partner users with the Delegated External User Administrator permission can create and edit the members of their own account, reset their passwords, and activate or deactivate them (Delegate Account Management to an External User (opens in a new tab), Salesforce Help, checked 2026-11-01). Chapter 14 covers external users.

Click to enlarge

Seeing a user’s access

Back to the phone call. “I can’t see it.” Here’s where I look, in order.

• The user. On the user’s record, View Summary opens the User Access Summary: “a consolidated view of a user’s key details and assigned permissions and tabs,” where you can also manage their permission sets, permission set groups, public groups and queues (View and Manage Users (opens in a new tab), Salesforce Help, checked 2026-11-01).
• The bundle. On a permission set or permission set group, View Summary shows “all object, user, field, and custom permissions that are enabled.” It also shows which groups a permission set is in. Know its limit: the permission set “can be referenced in other features not listed in this summary” (Manage Permissions in the Permission Set and Permission Set Group Access Summaries (opens in a new tab), Salesforce Help, checked 2026-11-01). For a group, module 3’s combined view is the same idea.
• The object. In Object Manager, Object Access shows “the permission sets, permission set groups, and profiles that grant access to an object, and the level of access granted” (Manage Object Access in Object Manager (opens in a new tab), Salesforce Help, checked 2026-11-01).
• The field. Since Summer ‘26, the Field Access Summary in Object Manager shows field-level security for one field “in all profiles, permission sets, and permission set groups,” in one place (Summer ‘26 release notes: Permissions (opens in a new tab), checked 2026-11-01). Chapter 4 covers field-level security.

And before you change a permission set, look at one more number. Its Permission Set Groups Added To field shows how many groups it’s in, which “can help you to estimate the potential impact on your users before making a change” (See the Count of Permission Set Groups a Permission Set Is Added To (opens in a new tab), Salesforce Help, checked 2026-11-01). A block in twelve groups is a block in twelve jobs.

For a whole org, Salesforce’s User Access and Permissions Assistant, from module 1, can analyze assignments across users.

Click to enlarge

Where the people end

Everything in this chapter is what I call structural security: can you see this object, this field, this tab, or not? If the answer is yes and the user still can’t see the record, the problem isn’t here. It’s in the file cabinets: who can see which records. Chapter 4 finishes the structural side with fields and the screen, and then the course turns to sharing records.

Two kinds of users get their own chapters later. Guest users, the people who reach your sites without logging in, come with external users in chapter 14. Integration users and agent users come next, in module 7: the same grant, a different way in. The rules from this chapter hold for all of them: a light profile for the door, and only the permission sets the job needs.

What an architect decides here

• Which user license each kind of user gets, and which permission set licenses add to it, before anyone builds a permission set.
• That integrations use the Salesforce Integration license, never a person’s license.
• Who checks for unused permission set licenses, especially after access is removed by a user access policy.
• Whether to use delegated administration, for which roles, and which profiles, permission sets and groups each delegated group can assign.
• That no delegated admin also holds broad permissions that undo the fence.
• How support answers “I can’t see it”: the order of places to look, from the user down to the field.

Beyond the exam: what AI changes. The license now reaches the agents. Salesforce’s Unified Employee license is described as being for every employee, with access to employee agents in Slack and Experience Cloud sites. So the same three questions apply to an agent and the people who use it: which license holds the keys, which permission sets ask for which locks, and where you look to see what it can do. Chapter 20 goes further.

Explore

• Licenses Overview (opens in a new tab), Salesforce Help (checked 2026-11-01)
• Standard User Licenses (opens in a new tab), Salesforce Help (checked 2026-11-01)
• Delegate Administrative Duties (opens in a new tab), Salesforce Help (checked 2026-11-01)
• Delegate Account Management to an External User (opens in a new tab), Salesforce Help (checked 2026-11-01)
• View and Manage Users (opens in a new tab), Salesforce Help (checked 2026-11-01)
• Manage Permissions in the Permission Set and Permission Set Group Access Summaries (opens in a new tab), Salesforce Help (checked 2026-11-01)
• Manage Object Access in Object Manager (opens in a new tab), Salesforce Help (checked 2026-11-01)
• See the Count of Permission Set Groups a Permission Set Is Added To (opens in a new tab), Salesforce Help (checked 2026-11-01)
• Winter ‘26 release notes: Permissions and Sharing (opens in a new tab), Salesforce (checked 2026-11-01)
• Summer ‘26 release notes: Permissions (opens in a new tab), Salesforce (checked 2026-11-01)