Specifically, how might one get an org portable Apex Unit Test User that DOES NOT have READ access to Accounts?

Creating a Test Permission Set that DOES NOT have READ access to ACCOUNTS and assigning it to a Test User is straight forward.

Keep in mind that Permission Sets are Additive. Therefore, we need a Profile that DOES NOT have READ access to Accounts to attach to our Test User.

It doesn't seem to be possible to insert a new Test Profile via DML or update the Object(CRUD)/Field(FLS) of an existing Profile. Therefore, one must Test with an existing Standard Profile that is likely to be available in most, if not every, Org.

I cannot find any existing Standard Profile that DOES NOT have READ access to Accounts.

  • Please be more specific with your question. You might consider rephrasing the subject, as well as add info on the question body itself.
    – Saariko
    Commented Sep 12, 2012 at 7:45
  • 1
    Maybe a stupid question, but if you're getting your apex ported to different organisations, can't you include a profiel with that code, and than make a user in your test code, having that profile assigned ? Commented Oct 9, 2012 at 14:17

2 Answers 2


Unless you can create a special Profile, I don't think this is possible. You might be able to use the metadata API to create a Profile that fits your qualifications, but that would need to be done outside of a test scenario, and sounds like it would violate your use case.

  • that is my understanding too, hoping someone can prove us wrong :)
    – mjgallag
    Commented Sep 12, 2012 at 15:03


I found this query to be about as org portable as you can get at this point, since it doesn't rely on hardcoding a Profile Name. If there is a Profile in the org that doesn't have Read Access to Accounts it will find it. Note, that setting Profile User Type to Standard eliminates things like Portal Profiles, which have a dependency on having an active Portal, and Chatter Only Profiles, which you aren't able to add Account Read Access to.

SELECT Profile.Id
FROM PermissionSet
WHERE IsOwnedByProfile = true
AND Profile.UserType = 'Standard'
               FROM ObjectPermissions
               WHERE SObjectType = 'Account'
               AND PermissionsRead = true)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .