Salesforce permission set expiration dates: a guide

What happens at expiry

The user stays assigned but “can't access the permissions”. Anything the same permissions get from a profile or another set that does not expire still applies, so expiry only removes access granted by that one assignment. Expired assignments are soft-deleted: ordinary SOQL does not return them.

Set an expiry date

1. Turn on “Permission Set & Permission Set Group Assignments with Expiration Dates” in User Management Settings.
2. Open the permission set or group, Manage Assignments, Add Assignment, choose the users.
3. Specify the expiration date (for example 30 days, or a custom date) and the time zone, then Assign.

Through the API, set PermissionSetAssignment.ExpirationDate (API 52.0 or later). Assignments never expire unless you set a date.

List upcoming expirations

SELECT Assignee.Name, PermissionSet.Name,
       PermissionSetGroup.DeveloperName, ExpirationDate
FROM PermissionSetAssignment
WHERE ExpirationDate = NEXT_N_DAYS:30

To audit what already expired, add ALL ROWS. A report on a custom report type for Permission Set Assignments works too, but covers custom permission sets and groups only.

Limits

• A set or group that contains Assign Permission Sets, Manage Profiles and Permission Sets, or Manage Users cannot have an expiration date.
• The feature arrived in beta in Summer '21, became generally available in Summer '22 and was enforced as a release update in Winter '23.

Common mistakes

1. Choosing My Local Time Zone, which expires the assignment at 11:59 PM in the admin's time zone, not the user's.
2. Expecting expiry to remove access that a profile or another set also grants.
3. Auditing with plain SOQL, which hides expired rows.
4. Relying on the report for standard permission sets, which it excludes.