Title says it all.

Can a released managed package be installed in production orgs without it being listed in AppExchange (or without going through security review)?

1 Answer 1


Yes, it can. Please note that apps which have not passed a Security Review will count against normal limits. For example, if the package has a custom Account field, then that field will count against the 5/25/100/500/800 field per object limit, and Apex Code character counts will be assessed against the 3,000,000 characters of code per org limit. Also, not being security reviewed means that you can't install it in places where any required permissions are missing. As an example of this, if your package contains Apex Code, you cannot install it in a Professional Edition org. However, you can install the package, upgrade it, and so on, without being publicly listed or reviewed. In fact, some organizations even do this in order to make managing their customizations easier.

  • Thanks. How does that make customizations easier? Did you mean to say, org develops a managed package, to be shared with itself?
    – metasync
    Commented Sep 11, 2017 at 3:41
  • 1
    @datasert It's rare, but I do know that some organizations have done this. The idea is that it makes upgrading easier, because packages, unlike change sets, can't "miss" dependencies. This means that you're less likely to need to do repeated create/upload/deploy change set cycles. Of course, other things can still go wrong, but it's less likely to do so.
    – sfdcfox
    Commented Sep 11, 2017 at 3:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .