Question

An administrator has assigned a user two permission set groups. One group grants 'Modify All Data' as part of a bundled data-management role, but the security team requires that users assigned this permission set group must NOT receive 'Modify All Data' while still keeping every other permission the group grants. What is the most efficient way to meet this requirement?

Accepted Answer

Add a muting permission set to the permission set group and mute the 'Modify All Data' permission.

Answer

Remove the user from both permission set groups and manually recreate all needed permissions in a single new permission set.

Answer

Edit the user's profile and uncheck 'Modify All Data' so it overrides the permission set groups.

Answer

Create a sharing rule that excludes the user from records requiring 'Modify All Data'.