Remove installed package objects permission from Profile

Question

Is there any easy way to remove

Read, Create, Edit, Delete, View All, Modify All

permissions of objects related to installed packages from Profile?.

I have been doing this manually by going through each and every objects and removing the permissions.

One way we can do this by reinstalling the package. But this is not doable in production.

Answer 1

One of the approach could be to use good old metadata api with Workbench for simplicity. Idea is very simple - retrieve all the profiles with permissions, update and deploy them back.

Steps to resolve it would be following:

1. Create package.xml with mentioning of all of the objects, for which object permissions needs to be revoked and corresponding profiles. In that case, object names and profile names are case sensitive For example:

 <Package>
        <types>
         <members>Object1__c</members>
         <members>Object1__c</members>
         <name>CustomObject</name>
        </types> 
        <types>
         <members>ProfileName1</members>
         <name>Profile</name>
        </types>
        <version>47.0</version>
    </Package>

2. Use Workbench to retrieve given metadata.
3. Unzip given file into some folder, and change each entry of the object permission (text editor's search and replace could be handy) in files to false, so it looks like this:

<objectPermissions>
    <allowCreate>false</allowCreate>
    <allowDelete>false</allowDelete>
    <allowEdit>false</allowEdit>
    <allowRead>false</allowRead>
    <modifyAllRecords>false</modifyAllRecords>
    <object>Object1__c</object>
    <viewAllRecords>false</viewAllRecords>
</objectPermissions>

4. Compress corresponding folder back into zip file and deploy using workbench. Actually, it is only necessary to deploy profiles, and only the part which has object permissions in order to change it.

Given steps could be also done using Ant Migration tool, but that requires certain prerequisites.

Answer 2

I have developed package Bof Per Man and pushed it into AppExchange.

https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FtWcBUAV

It has separate tabs to mass add or mass remove permissions from selected profiles and permission sets to selected objects, fields and tabs.

Answer 3

Thank you very much Kurunve.

I would like to highlight some points here to help someone reduce their work.

1. If you need to get all the object names related to package to build package.xml file, use SELECT QualifiedApiName FROM EntityDefinition where QualifiedApiName LIKE 'sbaa__%' query.
2. If a package contains more than 200 objects, it will throw an error. Use OFFSET with LIMIT 200 to query.
3. The above query will fetch all the objects along with their standard definitions like __Tag, __ChangeEvent, __Share. You need to remove all these in package.xml and keep only the actual Object__c.
4. Note that retrieved Profile.profile xml file won't contain objectpermissions for an object that doesn't have any access permission in the profile. The particular object must have atlease one permission(Read).