CRT-101 · Question #221
An administrator installed a managed package that contains a permission set group. The permission set group that was installed includes Delete access on several objects, and the administrator needs…
The correct answer is A. Use a muting permission set with a permission set group to mute selected permissions. Muting permission sets within a permission set group allow administrators to suppress specific permissions granted by a managed package's permission set group without editing the package itself.
Question
An administrator installed a managed package that contains a permission set group. The permission set group that was installed includes Delete access on several objects, and the administrator needs to prevent users in the permission set group from being able to delete records. What should the administrator do to control Delete access?
Options
- AUse a muting permission set with a permission set group to mute selected permissions.
- BCreate a new permission set that has Delete access deselected for the objects.
- CCreate a new role that prevents Delete permissions from rolling up to the users.
- DEdit the profile for the users to remove Delete access from the objects.
How the community answered
(32 responses)- A81% (26)
- B3% (1)
- C13% (4)
- D3% (1)
Why each option
Muting permission sets within a permission set group allow administrators to suppress specific permissions granted by a managed package's permission set group without editing the package itself.
A muting permission set is a special type of permission set that can be included in a permission set group to explicitly block selected permissions granted by other permission sets in that group. Because managed package permission sets cannot be edited directly, adding a muting permission set to the group to remove Delete access is the only supported method for restricting those permissions.
Creating a new permission set can only add permissions on top of existing ones - permission sets cannot remove or override permissions already granted by another permission set in the same group.
Roles control record visibility through the sharing hierarchy and do not affect object-level CRUD permissions such as Delete access.
If the permission set group grants Delete access, editing the profile to remove Delete will not override the elevated permissions coming from the permission set group, since permission set groups can grant access beyond what the profile allows.
Concept tested: Muting permission sets to suppress managed package permissions
Source: https://help.salesforce.com/s/articleView?id=sf.perm_set_groups_muting.htm&type=5
Topics
Community Discussion
No community discussion yet for this question.