10

I have been reading up on this particular area of concern and from what I'm reading, it sounds like the solution I've been creating for the past two weeks is going to be a nuisance to deploy from Sandbox to Production. Mainly:

A custom object with about 60 custom fields, each with specific permissions for specific profiles.

Everything I'm reading tells me that I will have to manually configure every permission on every profile, and every field's security, after I deploy to Production (many fields are meant only to be edited by certain Profiles, etc).

Is there another way? I don't use Force.com IDE. I simply use Sandbox and Production SF.

  • Have you tried adding Profile Permissions when deploying via a Change Set ? Alternatively Permissions Sets? – techtrekker Apr 18 '13 at 16:18
  • Profile Permissions: My understanding is that this would OVERWRITE ALL permissions on the profiles in Production. Since we (other people who have access, grr, but me too) alter permissions randomly directly in Production at times, that would mean they would "revert" when deploying them from Sandbox to the last SBox refresh, right? Permission Sets: You are implying creating a Permission Set relevant to this object and deploying it, so that I can simply "add that" to the Profiles once it's in Prod? (if so, interesting thought...) – AMM Apr 18 '13 at 16:22
  • Actually, if I'm not mistaken or missed an update, Permission Sets apply to users, not Profiles. Ugh. – AMM Apr 18 '13 at 16:27
  • 3
    Yes only to Users, but you can dataload PermissionSetAssignments to mass-assign, don't need to manually assign. blogs.salesforce.com/product/2011/12/… Also on Profile Permissions (not a 100%) but it doesnt overwrite everything, only permissions associated with the stuff being deployed. – techtrekker Apr 18 '13 at 16:31
4

When you add profiles to assign permissions in a change set, it only impacts the components of the change set. Change sets are never destructive, so they can't remove permissions you've assigned in production. You are safe to include the profiles during the change set deploy.

  • Thanks (including @techtrekker). I was NOT aware that the Profile deployment would only deploy settings related to anything being deployed at the same time. I'm obviously going to read up on that first, but it sounds like that would solve the issue. If a profile has permissions 1-50 and the items being deployed only affected permission 6-10, it would only touch permissions 6-10 (putting it simplistically) based on what I'm hearing. The research begins... thanks. – AMM Apr 18 '13 at 17:38
3

Daniel is right, just be aware some Profile settings are always transferred when you include the profile in the change set (e.g. Profile's system permissions). To avoid overwriting the production profile settings from sandbox, simple solution is to first send change set with anything (e.g. Account custom field) which is the same on prod and sandbox + all profiles from prod to sandbox - this will apply the production permissions to sandbox - and then you can send your change set from sandbox to prod. As sandbox has already been updated to prod status, you won't overwrite anything and only add new stuff to the profiles on prod.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.