Use case

Source org: V42, deterministic platform encryption enabled and set for these fields:

  • Contact.MailingAddress
  • Contact.Phone

enter image description here

By using Force.com IDE, ant, or other deployment tool (e.g. Gearset), if you deploy to the target org, also at V42, also with Deterministic Encryption enabled, the deployment results are of type Probabilistic encryption

enter image description here


At least as of V42, you are out-of-luck.

The V42 Metadata API does not provide any support for the distinction between probabilistic encryption (introduced in V34) and deterministic encryption (introduced in V42 - beta)

Inspecting the CustomField metadata API object, we have:

encrypted boolean

Note This page is about Shield Platform Encryption, not Classic Encryption. What's the difference?

Indicates whether this field is encrypted (true) or not (false). This field is available in API version 34.0 and later.

Clearly, a boolean isn't good enough to distinguish between three values: none, probabilistic, and deterministic.

Changesets aren't even an option as standard fields can't be included in Changesets.

Incomplete Workaround A:

  1. Manually make the change to Deterministic encryption in the target org

This is very unsatisfying for several reasons

  • You can't use a CI/CD pipeline
  • If you change some other aspect of the metadata file containing a deterministically-encrypted field at some later point in time, and you deploy those changes via a CI/CD process, you will smash the deterministic encryption and reset back to (at best) probabilistic encryption. You may discover that encryption in the target org is turned off because the SFDC preconditions within your Apex/configuration for supporting deterministic encryption are looser than for supporting probabilistic encryption and, when the deployment is done, SFDC may be forced to automatically disable encryption. This is so serious as to be a blocker as it prevents you from changing any field/listview on any object that has a deterministic encrypted field. Support ticket filed.

I can only hope that the GA version of this feature includes deployment support. Otherwise, the feature doesn't pass the straight-face test. See Idea

Workaround B

  • Don't use deterministic encryption. This may mean making more changes to your code/ configuration in order to support the default (probabilistic) encryption.

UPDATE: SFDC Dev Support states: ...this functionality is on priority list but there is no timeline for it yet.

UPDATE: SFDC Dev Support states: ...API deployment support...this will NOT be part of Summer 18 but is planned for 2018 (safe harbor). More definite statement in May 2018. In queue to be Known Issue.

UPDATE: Known Issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.