What determines the permissions for a profile deployed with change sets?

Question

Question

For a new profile created in a sandbox and deployed with a change set it'll carry with it the settings for all other metadata in the change set plus all settings that aren't specifically metadata related, and everything else turned off. However most of them are already set up in some form or another. What determines the values for the rest of the settings?

• Tab Settings
• App Settings
• Connected App Access
• Custom Object Permissions
• Article Type Permissions
• Desktop Integration Client
• Enabled Apex Classes
• Enabled VisualForce Pages
• Login IP Ranges

Discussion

I'd tested this by deploying a new object along with a new profile. When deployed it carried over the following:

• Name
• Description
• System Permissions (General and Administrative)
• Settings for Custom Object

I would have expected everything else would be in some form of "off" status as appropriate for the permissions, but strangely it had a lot of other permissions enabled with no apparent logic, specifically:

• Standard and Custom Tabs are randomly default off/default on/tab hidden
• Custom Object Permissions mostly off, but randomly on for misc objects
• Standard Object Permissions mostly on, but not all
• Enabled Apex Classes, randomly enabled about half
• Enabled Visualforce Pages, randomly enabled about half
• Login IP Ranges, random set
• Desktop Integration Clients all "On, updates w/o alerts"

Answer 1

On the backend, a profile is deployed with the settings from the standard profile if not explicitly identified in your change set.

If the deployed profile doesn’t specify any permissions or settings, the resulting profile consists of all the permissions and settings in the Standard Profile.

Special behavior in deployments article

It's really confusing. There is now the "Minimum Access - Salesforce" profile that you can leverage by cloning in your target environment and then deploying your profile over it.

Profiles from sandboxes can generally be tricky to manage if you have multiple environments that may not have been recently refreshed. This can cause issues upstream if you're not careful.