function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
Varun17Varun17 

Restrict users to assign permission set to other users

Hi All 

Is there a way to restrict users say(System admin's) from assigning permission sets to other users ? We want to restrict users from assigning permission sets to other users from audit purpose by showing them a validation error when they attempt to assign a permision set to another user. We also need to allow few Admins to perform this activity(I was thinking of a hierarchy custom setting and then using it in apex)

It seems the user record doesnt get updated when we assign a permission set to a user record so the trigger on user wont work .
As far as I know we cannot write a trigger on permission set and permission set assignment.

Any workarounds ? any help is appreciated
Best Answer chosen by Varun17
Varun17Varun17
We were able to solve this issue by creating a seperate profile for Non-Admins and removing the mnager user permission so as to restrict them from assigning any permisison sets or any manage activity on user records.

All Answers

Prashant MaheshkumarPrashant Maheshkumar
Hi Varun,

May be invoke a flow at set inteval and check for changes in object PermissionSetAssignment and if they were assigned by restricted system admin to other users then remove the permissionset and also send a notification for tracking.

Thanks
Prashant
 
Varun17Varun17
Thanks Prashant I am looking more to show an error message to the end user so that they dont complete the process at all. 
Varun17Varun17
We were able to solve this issue by creating a seperate profile for Non-Admins and removing the mnager user permission so as to restrict them from assigning any permisison sets or any manage activity on user records.
This was selected as the best answer
jitendra singh 172jitendra singh 172

Hi All, 
 

I'm also looking for same solution, please let me know if anybody gets any solution.

 

Thanks 

Jitendra
Dan Ward 42Dan Ward 42
I agree there is a form of limititing which Permisison sets can be assigned via "Delegated Administration" but as soon as a user has the Manage Users permission they can assign any permission set which can cause a SECURITY RISK AS it can open access to restricted objects - I TRUST Salesforce are working on a resoloution to this?