We are seeing some deployment-behaviour that we don't understand (nor expect / want).

If we create a deployset using the Salesforce UI with just one field (Test__c on Case) and add all Profiles to that deployset, we would expect that only those parts of the profile are deployed that actually have to do with the Test__c field, and nothing else.

However, if we deploy the deployset, then we see that the "View all Data" tickbox is also being deployed!

I.e. if a selected Profile had "View all Data" in the sandbox, it will carry that permission over to Production. The same if we uncheck the "View all Data" in the sandbox, it will consequently uncheck it in Production.

Has anybody a clue what is going on? Is this expected behaviour?

PS: we tested this from sandbox to sandbox as well and we have the very same issue there.

1 Answer 1


Yes, this is the expected behavior. I'm not sure if there's a document that explicitly, because Profile doesn't seem to explain it very well, and that I would assume is the most authoritative document on the matter, but it is indeed the way it works.

Whenever you include Profile in a Metadata API retrieve request (and, for consistency, this is how Change Sets also work), you always get all of the basic profile permissions, including Custom Permissions, Login Hour Restrictions, Login IP Restrictions, and all User Permissions (like API Enabled, Modify All Data, Customize Application, etc).

Whenever you deploy profiles, all of these settings are also deployed. The only permissions that are not retrieved or deployed by default are those that are related to customizable objects that you can deploy. This includes pages, classes, fields, objects, and record types. To explicitly retrieve those settings, you have to also include the related metadata items, such as adding the class, page, field, or object to the change set or package.xml file.

If you don't want to copy the standard permissions, you have to explicitly strip them out of the related XML files. There's no way to do this with a change set, because salesforce.com implicitly builds a package.xml for you in the background when you upload your change set. However, when you're using the Metadata API, you can always retrieve profiles, strip out the permissions you're not interested in modifying, and then deploying the XML file.

Permissions that are not explicitly listed in the ProfileName.profile file will not be modified, with two exceptions. Stripping out the Login IP Ranges has the effect of deleting all existing Login IP Ranges for the profile, and stripping out the Login Hours has the effect of deleting all Login Hours for the profile.

  • Wonderful answer; thanks a lot! Perfectly clear now. Commented Oct 27, 2016 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .