[SalesForce] SOQL query for all user profiles in permission sets

You might take a look at SOQL polymorphism.

Since the parent object referenced by UserOrGroupId could be either a User or a Group, normal SOQL won't let you reference any parent fields, similar to attempting to reference fields via WhatId on an Event. SOQL's TYPEOF keyword should allow you to perform the query you want.

REVISED The TYPEOF keyword would still give you the query you want, but I apologize for overlooking it's general unavailability. Without this being a widely available feature, I do not think there is another way to create the single query on GroupMember.

...

Map<Id, Group> groupMap = new Map<Id, Group>([
    Select Id, Name
    From Group
    Where Type = 'Queue'
]);

List<GroupMember> groupMembers = [
    Select GroupId, UserOrGroupId
    From GroupMember
    Where GroupId In :groupMap.keySet()
];

Set<Id> userOrGroupIds = new Set<Id>();
for (GroupMember member : groupMembers) {
    userOrGroupIds.add(member.UserOrGroupId);
}

Map<Id, User> userMap = new Map<Id, User>([
    Select Id, LastName
    From User
    Where Id In :userOrGroupIds
]);

Map<Id, List<User>> groupIdToUsers = new Map<Id, List<User>>();
for (Id groupId : groupMap.keySet()) {
    groupIdToUsers.put(groupId, new List<User>());
}

for (GroupMember member : groupMembers) {
    if (userMap.containsKey(member.UserOrGroupId)) {
        groupIdToUsersMap.get(member.GroupId).add(userMap.get(member.UserOrGroupId));
    }
}

...

With this, you can loop over the values of groupMap and pull the list of Users from groupIdToUsers.

You can alter your filters and limits in the queries as you see fit, especially if you are expecting a large number of Users. There are also certainly other ways you could write this.

If you want to track which Groups are also members of other Groups, you would need to maintain a separate Group map that gets processed similarly to User map.

It is not possible to edit PermissionSet's that are owned by Profiles, so unfortunately, no you cannot update the ProfileId field on PermissionSet to assign it to a new profile. As per the docs...

In API version 25.0 and later, every profile is associated with a permission set that stores the profile’s user, object, and field permissions, as well as setup entity access settings. Permission sets that are owned by profiles can be queried but not modified.

What you can do is write Apex code to query the respective PermissionSet objects for a profile to create a new PermissionSet (not associated with any profile) that you can you assign to one or more users, including users with the originating profile (once you assign them a lesser profile).