In Eclipse Force.com IDE I created a Force.com project that was configured to pull the Permission Set folder only. The Permission Sets have been pulled, but in what appeared to be a trimmed form - all had about 373 lines of code.

When I have deployed those Permission Sets to a SI environment is when I noticed that they were incomplete - what could be called skeletons of them have been deployed, but most of the configuration was not there.

Then I have chose to pull all Project Contents in Eclipse from Production. Those Permission Sets grew to nearly 4000 lines of code. I presume they must be a more complete version of them. I'm not sure as I haven't committed them to the repo and deployed yet.

Items that have been added are:

<classAccesses>, <fieldPermissions>, <objectPermissions>, <pageAccesses>, <tabSettings>

Can someone please explain to me why pulling Permission Sets only pulls them in trimmed form as opposed to pulling them with all other Project Contents?

Many thanks.

3 Answers 3


The Force.com IDE (eclipse plugin) is built on top of the Metadata API and uses it to populate the various files. The contents of a Permission Set or Profile depend directly on all of the other content requested. So, when you have a project that has close to no other metadata component types other than the Permission Set, the retrieved Permission Set will likely have close to nothing in it. When you have a project with all metadata component types in it, you will likely have a larger Permission Set file.

From the common migration issues documentation:

The contents of a Permission Set or Profile returned by Metadata API depends on the content requested in the RetrieveRequest message. For example, profiles only include field-level security for fields included in custom objects returned in the same RetrieveRequest as the profiles.

There are more examples in the Profile documentation in the Metadata API docs as well and here is a good article on the Force.com IDE and Metadata.


There are a number of idiosyncrasies working with both profiles and permission sets in the Metadata API (MdAPI) as well as various clients that use this API like Force.com IDE and Change Sets.

While Peter is dead on with his answer, I also recommend reading the following blog posting for more detailed information than what the docs currently provide on migrating permissions with the MdAPI: http://www.salesforcehacker.com/2013/05/dude-wheres-my-permission.html


You should try https://securityzen.net/ for managing security. It lets you easily see Profiles and Permission Sets, and deploy them from one environment to another environment. Yes, I am affiliated with this product, but it directly addresses this issue and you can try it for free.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .