we have a new permission set, we want to give the apexclass access to this permission set through ANT. we are able to retrieve the Unmanaged classes but we are not able to retrieve the permissions for Managed package classes.

For all the Managed Classes we Prepared the metadata for class access and tried to deploy the metadata in PRO,Still we are not able to do this.

Tried through Changesets also still facing the same issue. If we give manually it will take lot of time as we have 550 managed classes which need access.

Can some one please help us in Automation of permissions for managed Classes.


Use namespace__ApexClass as the apexClass format in PermissionSetApexClassAccess for Apex Classes belonging to a managed package or in a namespaced org. (Rather than namespace.ApexClass used in all other managed Apex references.)

The only documentation I can find regarding PermissionSetApexClassAccess says the following which isn't helpful.

apexClass: Required. The Apex class name.

I only discovered the correct format by installing a package in a scratch org, created a Permission Set in the UI with access to a managed Apex Class, then pulled the source down to inspect. It feels bizarre that PermissionSetApexClassAccess requires double underscore.


To add Apex class to a Permission Set:

  1. Get the permission set id
  2. Get the apex class id
  3. Login to workbench The "Workbench" tool noted above can be found here:


  1. Click on Data -> Insert
  2. Choose SetupEntityAccess as the object
  3. Click on the Single Record radio button
  4. Click Next
  5. Paste the permission set id into the ParentId field
  6. Paste the apex class id into the SetupEntityId field
  7. Click on confirm insert .

11.For Bulk Insertion create a csv file with the class and permission set ids and do it in a batch. You could create a csv file from a SOQL query getting the ids for the classes You want to add, and then add the id of the permission set to each row.


While I do not use ant, I did some work a year ago that required deploying permissions for objects in a managed package via package.xml file and it should be similar to handling permissions for managed apex classes. I did all my work using workbench.developerforce.com.

I found that if you specify the object names including namespace prefix, you can retrieve permissions for the objects using the standard format as found in metadata api docs on permission set object

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">

You cannot use wildcards for object names - you must specify the full api name for each object, including namespace prefix. I beleive wildcard would work for permission set name but presume you would want to specify which one to use.

When deploying these components to production, as long as you check the box "allow missing files", the object permissions will deploy.

I'm not sure how that option translates to ant, but hopefully it does. You can see it on workbench if you go to migration > deploy.

While my work was focused on deploying field permissions for managed objects, I believe the same approach would work for the PermissionSetApexClassAccess component, which controls apex class access.

  • We are able to give permissions for all the components except managed Apex Classes Through ANT. We nee the solution for Managed Classes ... – srini Jun 20 '16 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.