A compliance audit at a healthcare company requires that users with the 'Patient Support Representative' role adhere to a 15-minute inactivity session timeout and a 30-day password expiration policy. The default organization-wide settings are configured for a 2-hour session timeout and a 90-day password expiration. An administrator attempts to enforce these restrictive security limits by creating a new Permission Set to avoid proliferating custom profiles, but discovers that session timeout and password policy configurations are unavailable within the Permission Set interface. How should the administrator properly enforce these specific security requirements for the Patient Support team?
- Configure the 15-minute session timeout and 30-day password expiration policies directly within the custom Profile assigned to the Patient Support team.Answer
- BCreate a Permission Set containing the 15-minute session timeout and 30-day password expiration, then assign it to all Patient Support team members.
- CAdd the Patient Support team's network IP ranges to the Organization-Wide Network Access settings to enforce restrictive session and password policies.
- DBundle custom security extension rules inside a Permission Set Group and assign it to the Patient Support team to override global organization defaults.
Answer
Configure the 15-minute session timeout and 30-day password expiration policies directly within the custom Profile assigned to the Patient Support team.
In Salesforce, Password Policies and Session Settings are established at the Organization-Wide level and can be selectively overridden on individual Profiles. Because Permission Sets and Permission Set Groups cannot store or enforce session inactivity timeouts or password expiration rules, modifying the custom Profile assigned to the user group is the correct and only way to enforce stricter requirements for specific users.
Step-by-Step Solution
Key Concept
Profile-Level Overrides for Session Settings and Password Policies