Muting a permission in a Permission Set Group

As you know security is the prime focus of salesforce which we control in different ways. Salesforce keeps enhancing the way to provide a better solution in terms of maintainability. Let’s talk about an organization where we have different types of users with different responsibilities. Initially, Salesforce uses profiles to distinguish their different permission so if you have 10 uses for different access, you should have 10 separate profiles which were kind of a nightmare, and hence later salesforce introduces permission sets and you can use permission sets to provide different access within the same profile. That was a great relief however, you still have to assign each permission set to different users separately. Let's say if you have some users that need the same kind of permissions and if there are 20 different permission sets, you need to assign each of the 20 permission to every user which is kind of time-consuming, so Salesforce brings the approach of the Permission Set Group. Now you can add all 20 permission to a permission Set Group and then assign permission set group (PSG) to the user. Super easy!

Mute a permission in a Permission Set Group

Salesforce is not stopping here, they always look to provide more creative out-of-box solutions, and here we called this “Mute a permission Set”. Now let’s suppose you have a Permission set group, which has different permission to provide different access to Sales Rep users. Now, if a business wants to remove “Account Delete” access from this group. This can be covered in two different ways:

1. Remove delete Account permission sets within the Permission Set group or

2. Create a new permission set that doesn't have delete account permission however, it has other respective permission and remove all permission sets from the group and add a new one.

Both the approach has some drawback, if you go with 1st approach, other users outside the permission set group can be impacted which are using individual permission set or if you go with 2nd approach, you are creating a new permission set and make permission set maintainability more complex so mute a permission set can help you here.  

“You can mute single permission or several permissions in a permission set group. If you mute permission in a permission set group, only the permission in the group is muted. Permissions within the permission sets are not affected.”

Advantage of Muting permission

Muting permission set with a permission set group to mute certain permissions. You can reuse the same permission set in several groups and adapt the permission to different situations. Any mute permission is not included in the permission set group.

Example

The Sales Staff Users permission set group contains three permission sets and a muting permission set. The muting permission set mutes Delete on Accounts and Opportunities.

When you mute Delete on an object, Modify All is automatically muted (even if you didn’t enable it for that object). Modify All becomes disabled because it depends on full object access, which is no longer available when you mute Delete.

How to enable Mute in Permission Set Group

• From Setup, enter Permission Set Groups in the Quick Find box, then select Permission Set Groups.

• Under API Name, select the permission set group in which you want to mute permissions.

• Click Muting Permission Set in Group and then click New.

• Only one muting permission set is allowed per group.

• Give your muting permission set a label and API name and click Save.

• Click the link for your new muting permission set.

• In Find Settings..., type the name of the object or permission you want to update and click Edit.

• Select Muted for the permission that you want to mute and click Save.

Reference:

https://help.salesforce.com/articleView?id=sf.perm_set_groups_muting_dependencies.htm&type=5