Last Updated on May 30, 2022 by Rakesh Gupta

Big Idea or Enduring Question:

• How to auto-remove the permission set or permission set group assignment from the users after a specific date of assignment? 

Objectives:

After reading this blog, you’ll be able to:

• Understand the differences between permission set and permission set group
• Set permission set and permission set group assignments with an expiration date
• Auto remove the permission set from the users after X days of assignment 
• Auto remove the permission set group from the users after X days of assignment 
• and much more 

Business Use case

Anita Smith is working as a Salesforce Consultant at Gurukul On Cloud (GoC). She has received a requirement from her management team to assign Sales Manager Permission Set Group and auto-remove after a week of assignment.

Anita doesn’t want to create a flow and invest her time in finding other declarative options. 

Guided Practice (We-do): 

Permission Sets are helpful for providing a particular set of functionalities to a user in addition to the permissions provided by their Profile.  For example, you may want to allow only a few of your sales users to convert leads. In this case, rather than having a special sales profile with the convert lead permission, you can create a permission set and assign it to a specific user.

Permission Set Groups comprises multiple permission sets a user needs. Wait, this is not it! One can add and remove individual permissions from a Permission Set Group – using the permission muting feature – to ensure that users do not get permissions that are not relevant to his/her job functions! 

What if you only want a permission set or permission set group assigned for a designated time and don’t want to forget to remove it later.

• Remove permission set from the user on 31-May-2022, i.e., future date.
• Remove permission set from the user after 30 days of assignment. 
• Remove permission set group from the user on 15-June-2022, i.e., future date.
• Remove permission set group from the user after one week of assignment. 

I have written a few articles on automating Permission Set and Permission Set Group automation. Why not check them out while you are at it?! 

1. Automatically Assign Permission Sets to New User
2. Auto Assign or Remove Permission Set to Multiple Users
3. Profile? So Yesterday! – Auto Assign Permission Set Group to a User

After enabling Permission Set & Permission Set Group Assignments with Expiration Dates feature, you can assign an expiration date to each permission set or permission set group. Users can be assigned to permission sets or permission set groups with or without an expiration date. When a permission set or permission set group has an expiration date, users can lose access to functionality after the expiration date. By default, permission set and permission set group assignments don’t expire.

Perform the steps below to set up an expiration date for the Permission Set Group:

1. Enable Permission Set & Permission Set Group Assignments with Expiration Dates 
2. Creating a Permission Set Group – Sales Manager

Step 1: Enable Permission Set & Permission Set Group Assignments with Expiration Dates 

After enabling Permission Set & Permission Set Group Assignments with Expiration Dates setting, you can set up assignment expiration dates to permission sets and permission set groups assignment. Assigned users receive access to all aggregate permissions until the expiration date. 

1. Click Setup. 
2. In the Quick Find, type User Management Settings and select User Management Settings. 
3. Enable Permission Set & Permission Set Group Assignments with Expiration Dates. 

Step 2: Create a Permission Set Group

1. Click Setup.
2. In the Quick Find box, type Permission Set Groups.
3. Select Permission Set Groups, then click New Permission Set Group.
4. Label the Permission Set Groups then press the tab key, the API Name will auto-populate. 
5. Click Save.

Proof of Concept

Next time, when a System Administrator Assign the Permission Set or Permission Set Group to a user, they see an option to set an Expiration Date.

1. Click Setup.
2. In the Quick Find box, type Permission Set Groups.
3. Select Permission Set Groups, then click on Sales Manager permission set group. 
4. Click Manage Assignment.
5. On the Current Assignments page, click Add Assignment.
6. Select the users that you want to assign, and click Next.
7. Select an assignment expiration option for the users you selected.
   1. To choose an expiration date and time zone, select Specify the expiration date.
   2. Click a time frame, i.e. 1 Week, or to enter a custom date, click Custom Date.
   3. Select a time zone. Assignments expire at 12:59 PM on the date and in the time zone that you specify.
      1. If you select My Local Time Zone, expiration occurs at 12:59 PM in your time zone. For example, if you have a user with an assigned expiration who uses Japan Standard Time. You use Pacific Daylight Time as your time zone. If you select My Local Time Zone as the time zone expiration option, the user’s assignment expires at 12:59 PM Pacific Daylight Time.
         
8. Click Assign.
9. Click Done.

Remove User Assignments in Permission Set and Permission Set Group

1. Click Setup.
2. In the Quick Find box, type Permission Set Groups.
3. Select Permission Set Groups, then click on Sales Manager permission set group. 
4. Click Manage Assignment.
5. Select the assignments to remove.
6. To remove the selected assignments, click Remove Assignment.
7. Click Remove.

Set Expiration Date When Using Flow 

When assigning permission set or permission set group via Flow use ExpirationDate field. The date that the assignment of the permission set expires for the specified user. 

Formative Assessment:

I want to hear from you!

What is one thing you learned from this post? How do you envision applying this new knowledge in the real world? Feel free to share in the comments below.