what is the best practice of packing your custom app with custom permission, so that an administrator who install the app doesn't have to do too much work on the security end and all user have access the App Directly

2 Answers 2


Ideally, you would just include permissions sets, and all would be well. But it depends on whether you are trying to include permissions for standard objects, or just custom objects, tabs etc. If you have a self contained app with no references to standard objects, a permission set SHOULD work. But if you have references to standard objects, be careful with permission sets - they have been known to cause internal server errors when installing a package. I would suggest adding some permission sets, and then creating a beta package to check a) the package installs b) the permission set is maintained in the target org (I have seen it where the permission set is there, but nothing is checked in the target org)

You can certainly include a Profile, but permission sets make more sense for most apps. If you can't include one, I would at least document what it should contains so an admin can build one in their org.

  • i have only 2 custom objects not any standard object . include a permission set in managed package and create a beta version , and successful deploy in install org but when i apply the permission set to specific user and login with the user i have no access of my app or my object .
    – Faisal
    Commented Dec 31, 2013 at 19:13
  • If you add the user to the app via their profile, does the rest of the perm set work? I have seen issues with App level permission, but the other permissions work once the user gets the intiial access Commented Dec 31, 2013 at 19:28
  • yes i have issue with assign app not give the permission to the specific user
    – Faisal
    Commented Jan 2, 2014 at 12:00
  • @Faisal it's a big issue for many of us. Please vote on the idea! Commented Nov 3, 2014 at 19:41

Its important you include a specific custom profiles and permission sets in your package if that's important .

When designing your app for AppExchange, create custom profiles for the various users of your app. Give each custom profile the appropriate level of access to your app, such as tab visibility or field-level security settings for approval fields on custom objects.

When you package an app, you can include your custom profiles. Profile settings are applied to existing profiles in the subscriber's organization on install or upgrade.

Only permissions related to new components created as part of the install or upgrade are applied. The security settings associated with standard objects and existing custom objects in an installer's organization are unaffected.

Alternatively, you can use permission sets to avoid overwriting permissions in subscriber profiles and to maintain control of permission settings through the upgrade process. Permission sets contain a subset of profile access settings, including object permissions, field permissions, Apex class access, and Visualforce page access. These are the same permissions that are available on profiles. You can add a permission set as a component in a package.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .