Ok...So I feel like this is somewhat an answer I should know considering I have been an Admin for over 10 years now.
But.....
Back in the day, when installing an app from the AppExchange, most of the time I would just install for all Profiles/users. In the last couple of years. It did depend, of course, flow components and some apps, I just installed for the System Admin Profile. So far, no problem with that model.
Where I am getting stuck or a bit confused is around the new model of Permissions being driven by Permission Sets and not profiles. So in the future, or even now, if I install an app, I still have to select a profile or profiles. Even if I choose the "Specific Profiles" option the main System Admin Profile get's full access, even if the App does have Permission sets and so on.
The Profile still get's access to the Visualforce pages, Classes, etc, even though we are supposed to move those permissions to a Permission Set(s). It's confusing to me.
So in this "new" model of Permission Sets, what is the role of Profiles when it comes to installing apps? Do you still just install for System Admin only? And if the app has Permission Sets use that for the rest of the users, etc? I am just stuck on how installing Apps from the AppExchange fit in this new Permissions Model...
#Nonprofit #Systems Administrator #Permissionset
The Current Best Practice
Install for System Administrators only, then use Permission Sets (or Permission Set Groups) to grant access to other users. This is the right approach, and here's why:
Why This Model Makes Sense
- Profiles are becoming baseline containers – They define the minimum floor of access (object CRUD, app visibility, page layouts, record types). The System Administrator profile remains special because Salesforce pushes critical updates to it (like the recent "Manage Connected Apps" permission).
- Permission Sets layer on top – All incremental access—including app-specific permissions, Apex classes, Visualforce pages, and custom permissions—should be granted via Permission Sets or Permission Set Groups.
- Admins still need Permission Sets sometimes – As Judi correctly noted, even after installing for Admins, some apps require you to assign their Permission Set(s) to actually use the app. This is intentional: the app may include custom permissions, connected app policies, or field-level security that aren't automatically granted just because you're a System Admin.
What Happens During Installation
When you install an AppExchange package and select "Install for Admins Only":
- Profile-level grants (Apex classes, Visualforce pages, custom tabs) go to the System Administrator profile
- The app's Permission Sets are created but not automatically assigned—you must assign them manually, even to yourself
- Other profiles get nothing unless you explicitly choose them during install
Recommended Pattern
For System Administrators
- Do not clone the standard "System Administrator" profile. Salesforce deploys critical updates only to the standard profile.
- Create a custom Permission Set (e.g., "Acme System Administrator") to grant any additional permissions your admins need beyond the standard profile—new field access, integrations, etc.
- Assign app-specific Permission Sets to admins when needed.
For End Users
- Install apps for Admins only.
- After installation, assign the app's Permission Sets (or build Permission Set Groups) to the appropriate users based on role/function.
- Use Permission Set Groups to bundle related permissions (app access + object permissions + field access) for easier assignment.
Why Profiles Still Exist in the Install Flow
Salesforce hasn't fully deprecated profiles—they're still the required baseline for every user. The install wizard asks for profiles because:
- It needs to grant access to Apex classes, VF pages, and other package components
- Not all packages include Permission Sets (especially older ones)
- The System Administrator profile is the safest default for initial installation
Over time, expect Salesforce to evolve this (possibly auto-creating Permission Sets during install or allowing install without profile selection), but for now, "Install for Admins Only" + Permission Sets is the cleanest, most future-proof approach.
Bottom Line
You're on the right track. The confusion is normal—Salesforce is mid-transition, and the install experience hasn't fully caught up to the permission set model. Stick with:
✅ Install for System Administrator profile only
✅ Leave the standard System Administrator profile untouched
✅ Use a custom "System Administrator" Permission Set for any add-on admin permissions
✅ Assign app Permission Sets manually after install
✅ Use Permission Set Groups to bundle access for end users
This keeps your org clean, maintainable, and aligned with Salesforce's direction.
