Based on the Troubleshooting in Subscriber Organizations guide, it seems that when a subscriber has granted you access to their Salesforce organization, you should be able to see obfuscated code and debug logs for your own managed package installed in their organization:

When logged in as a user in a subscriber’s org, you have access that the subscriber doesn’t have. You can view the obfuscated code in your Managed - Released packages, view logs that the subscriber can’t see, and initiate ISV Customer Debugger sessions (Source).

However, when the subscriber grants me access to their organization where the Managed (Released) package is installed, the code appears obfuscated in the Developer Console and the debug logs also appear to obfuscate logs originating from the managed package. The user granting access has the System Administrator profile.

Is there something further that needs to be configured in order to see this information from the managed package? Have I misinterpreted the documentation?

  • Are you by chance trying to see Kong’s ran in a batch context? If so that has been going on for over a year now. It works if you execute the exuecte method directly. We have started to design our batch classes to support for this specific reason.
    – Eric
    Commented Mar 12, 2018 at 4:08
  • Did you start the transaction of interest from the user logged in via the LMA black tab? Commented Mar 12, 2018 at 6:06
  • I'm viewing non-batch transactions initiated by myself logged in via the LMA. However, even if I can't see the logs, I should presumably still be able to see the managed package code and protected settings. I cannot. Commented Mar 12, 2018 at 11:30
  • Is it just this specific org, or any org that your package is installed into? Commented Mar 13, 2018 at 7:33
  • 1
    This is occurring in any org in which the application is installed. Commented Mar 14, 2018 at 17:04

2 Answers 2


Here is a copy of some of our internal notes on this subject:

Salesforce allows ISV (Independent Software Vendors) such as XXX to view debug logs generated by our Managed Packages in case the Customer grant login access to XXX and in case the person perform the support log through the LMA org and impersonate the user that granted access (this remove the need to open a case with Salesforce to turn debug logs on).

Note: this only available to "Managed - Released" packages.

  1. Grant Login Access to XXX Support. Reference: https://help.salesforce.com/articleView?id=granting_login_access.htm&type=0
  2. Go to Setup > Company Profile > Company information and then copy the Organization ID from Sandbox Org.
  3. Log-out from Customer Org in case you are logged in
  4. Log-in to LMA org
  5. Navigate to Subscribers
  6. Paste the Organization ID on text field for search
  7. Click on Organization Name
  8. Click on user that granted the access
  9. You can see the debug logs from Managed Package if you create a new Trace Flag. Reference: https://help.salesforce.com/articleView?id=code_add_users_debug_log.htm&type=0

Reference: https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/apex_debugging_sub_org.htm

Important points are to login via the LMA org and also to create a new "User Trace Flag".


I would try adding the "View and Debug Managed Apex" system permission to your user in the LMO.

You can create a permission set with this permission or add it to an existing perm set if there's one that already makes sense to use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .