2

My requirement : I want DX User to be able to access only Dev-Hub/Scratch Org and Name Space registry. On the Dev-Hub, this user should NOT have ability to create records on any standard/custom object. If DX user uses Standard User profile, the user will still be able to create Standard Object records which I do not want.

I can achieve this my creating a new profile directly in production org restricting access to standard objects. But I wanted to do it through Meta-data deployment that goes through CICD pipeline. Since Dev-Hub is not present in lower environment sand boxes, I may not be able to do it through metadata deployment.

Can someone help me to achieve the functionality in first paragraph in a better way?

3
  • Just curious what you mean by "Dev Hub is not present in lower environment sandboxes".
    – pchittum
    Apr 3, 2018 at 8:48
  • Salesforce DX dev-Hub is only available in salesforce production org. Apr 3, 2018 at 11:30
  • There's really no reason for dev hub to exist in a sandbox. Sandboxes are one of the "managed" org environments. Dev hub is the thing that "manages" your org environments. This seems to be a common misconception: what is the purpose of the dev hub?
    – pchittum
    Apr 5, 2018 at 9:05

1 Answer 1

2

You'll need a custom profile either way, so you may as well create your custom DX-only profile and leave it in production. The only alternative is to have a null profile (a profile with no object/field permissions) and then create a custom Permission Set, but that's only shifting the permissions from one undeployable object to another. DX development can't include Dev Hub permissions, because it's not possible to replicate a Dev Hub org in scratch orgs, developer orgs, or sandboxes, and so must exist outside of CICD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .