Updating profiles with Managed Package update

Question

We have several profiles in our managed package that specify access levels to different users. We continuously build new customer fields and objects and want to be able to update the profile with the most recent security settings of our profiles as opposed to having to update the profiles in customer orgs every time. I have read a few threads similar to this that say profiles are editable but not upgradable.

One way that I think may work is that when updating a managed package, we are asked which profiles should have access to the package and we can select the last option to map profiles in the package to profiles created in the org for this purpose. However, I have tried using that and it didn't update the profile settings, specifically custom object/field access.

Do you have any ideas on what we can do to achieve this? I am aware that potential changes our customer would make might be lost but we can assume that the customers will not change the profiles.

Answer 1

An approach a colleague uses is to include in the managed package a small number of permission sets corresponding to major pieces of managed package functionality. (No profiles are included.) When new fields or objects are added they are added to these permission sets and upgrades do propagate the changes. The down-side is that they have to be assigned to each user which if the number of users is large creates work. However, it is possible to add them programmatically (e.g. based on a custom picklist added to User.)

The benefit of this approach is that the number of profiles and their purpose is usually influenced by many factors. The small number of permission sets can be "mixed in" as needed either following the profile assignment or based on other factors.

(In my experience despite our best efforts to get customers to only use two or three profiles, more profiles usually get created to align with job titles or job functions. So profiles included in a managed package rarely get used.)