Our company is using AppExchange PackageA and AppExchange PackageB that provides similar functionalities and we have signed up MSA with both companies for enhancements. So, developers from PackageA company and PackageB company are working in sandboxes and we would like to restrict the developers from PackageA to not to see any data/metadata related to PackageB and the same is true for developers from PackageB company. i.e., developers from PackageB company should not be able to see any data/metadata related to PackageA. This is not a problem in Production since both are licensed products. But for sandboxes this is an issue.

I am thinking of the below approach.

  1. Clone the System administrator profile as "Basic Administrator" and remove access to Package A and Package B.
  2. Create a permission set "PackageA Permissionset" and add access to PackageA.
  3. Create a permission set "PackageB Permissionset" and add access to PackageB.
  4. Assign Developers from PackageA and PackageB with the Profile "Basic Administrator"
  5. Assign Developers from PackageA with the permissionset "PackageA Permissionset".
  6. Assign Developers from PackageB with the Permissionset "PackageB Permissionset".

Is this enough or do I need to restrict the access to Objects, Fields, Apex Classes, Visual Force Pages etc?

  • Use a developer sandbox, then no need to hide data. I realize it is overly simplistic and requires you to create example data (although the developer should be able to do so) but it is a potential solution. No need to hide Package A or B since each person could install it in their own orgs and thus see what it is all about, unless the package is super secret in which case, have them develop in a Full Developer Edition org outside of your org and only install each app as appropriate. Oh, and metadata will not be visible on the packages in all cases unless the person is the ISV – Eric Apr 1 '17 at 16:36
  • Thanks for the response. However, hiding data is only part of the problem. We have a QA sandbox which is a full copy sandbox and all changes (from PackageA and PackageB) must go thru the QA sandbox before going live into production. Currently, we have given access to both developers and hence they will get to see other's data. More over, PackageA company does not know that we are using PackageB and we want to keep that way. PackageB company knows that we are using PackageA also. – Balaji Pooruli Apr 1 '17 at 17:28
  • Then use two Dev sandboxes and uninstall one of the packages from each and have them work in their specific sandbox. They should not need access to QA. Its the only way I see you being able to do this. The permissions needed to restrict them from knowing you are using the other package would cause them to not be able to do any development. Then again, does it really matter that they know? Seems petty to me but there may be a backstory that is pretty interesting :) – Eric Apr 1 '17 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.