How to Deploy Salesforce Profiles Safely?

Question

What is the best way to deploy profiles in Salesforce, especially the System Admin profile, when working with multiple sandboxes and objects?

Answer

When managing deployments in Salesforce, particularly for the System Admin profile, there are common challenges related to how object and field-level permissions are handled across sandboxes and production environments. The concern typically arises when deploying profiles from one sandbox to another or from a sandbox to production. Many people fear that copying a profile will overwrite all permissions, including object and field access, but that’s not entirely true.

To understand how to handle this more effectively, it’s important to differentiate between the metadata API and change sets, which allow more precise control over profile deployments. While it’s often assumed that when you deploy a profile, you are overwriting every permission related to that profile, Salesforce’s mechanisms ensure that you can deploy only the specific settings that need to be changed.

Understanding Profile Deployments in Salesforce

Metadata API and Change Sets Are Not Destructive by Nature: A common misconception is that when you deploy a profile, all associated permissions (including object and field-level permissions) are copied, meaning they get overwritten. However, Salesforce treats object and field permissions separately from other profile settings, allowing you to deploy only the necessary permissions without disturbing the rest of the profile settings. For instance, if you have a profile with access to 1,000 fields and you only want to deploy a new field’s permissions, you can do so without affecting the rest of the field-level security settings.

Why You Should Avoid Profiles in Eclipse IDE: In the Eclipse IDE, the plugin attempts to deploy only changes, which can be problematic when dealing with field-level security items. If you need to update a field’s permissions, you must modify both the profile and the custom field, which can be cumbersome. This process can often be more trouble than it’s worth, and for this reason, deploying profiles via Eclipse is typically discouraged for field-level security changes.

Selective Deployment with Change Sets and Metadata Toolkit: The change sets feature and the metadata toolkit offer a much more precise way to deploy specific permissions. With change sets, Salesforce only updates the settings that are relevant to the specific combination of profiles, fields, and objects, and leaves the rest intact. This allows you to deploy specific field-level security settings without affecting other parts of the profile.

The metadata toolkit provides even more control. It allows you to edit the raw XML files that define the profile settings. This means you can deploy only the specific permissions you want to deploy. You can even select a particular field and assign different field-level security settings to various profiles, ensuring that only the intended permissions are modified.

Example of Deploying Field-Level Security Using Metadata Toolkit

Let’s say you want to deploy the field-level security for the Lead.CurrentGenerators__c field for the System Admin profile. Here’s an example of how to set this up in your package.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Lead.CurrentGenerators__c</members>
        <name>CustomField</name>
    </types>
    <types>
        <members>Admin</members>
        <name>Profile</name>
    </types>
    <version>29.0</version>
</Package>

This XML file specifies that you want to deploy the Lead.CurrentGenerators__c custom field and the Admin profile. When you deploy this using the metadata toolkit, the only change that occurs will be the update to the field-level security for that specific field in the profile. All other profile settings, including object permissions and field-level access to other fields, will remain unchanged.

Fine-Grained Control with the Metadata Toolkit

One of the great advantages of using the metadata toolkit is the ability to make very granular changes to your profile deployments. For example, if you only want to update one or two fields’ permissions and leave others untouched, you can manually edit the XML files before deployment. You can create a deployment that specifies different permissions for different profiles in a way that doesn’t overwrite everything. For example, if you have multiple fields, you can adjust their permissions like this:

<FieldPermissions>
    <editable>true</editable>
    <field>Lead.Field1__c</field>
    <readable>true</readable>
</FieldPermissions>
<FieldPermissions>
    <editable>false</editable>
    <field>Lead.Field2__c</field>
    <readable>true</readable>
</FieldPermissions>

This flexibility allows you to avoid affecting fields that are not part of the current deployment while still applying the necessary changes for the fields you want to update. It ensures you don’t risk breaking existing settings or overwriting permissions that are already in place for other fields.

The best way to deploy profiles in Salesforce, especially the System Admin profile, is to use change sets or the metadata toolkit for selective deployment of field and object permissions. These tools allow you to deploy only the necessary changes, without overwriting other permissions in the profile. While Eclipse might seem like a convenient option, it’s better to avoid it for field-level security deployments due to the complexity involved. By using change sets and metadata toolkit, you can preserve the integrity of your profile settings and ensure that field access is updated without disturbing existing configurations for other applications and sandboxes.

Job-Oriented Salesforce Training with 100% Money Back Assurance

Our Salesforce Course is designed to provide a comprehensive understanding of the Salesforce platform, empowering you with the key skills needed to excel in the CRM industry. The program includes vital modules such as Salesforce Admin, Developer, and AI, combining theoretical learning with hands-on practice. By engaging in real-world projects and practical assignments, you’ll build the expertise required to solve complex business challenges using Salesforce solutions. Our experienced trainers ensure you develop both technical expertise and industry knowledge to succeed in the Salesforce ecosystem.

Beyond technical skills, our Salesforce Training in Toronto offers tailored mentorship, certification guidance, and interview preparation to enhance your career prospects. You’ll have access to extensive study resources, live project experience, and continuous support throughout your training. By the end of the program, you’ll be fully prepared for certification exams and equipped with the practical problem-solving skills employers value. Begin your Salesforce journey with us and unlock endless career opportunities. Join us for a Free Demo today!