When using salesforce dx to deploy an app we get the unknown user permission

unknown user permission :workcalibrationuser unknown user permission :sandexternalemailAvailable unknown user permission :fieldserviceacess unknown user permission :enablecommunityApplauncher

once I removed these permissions from the outputmdapi/profile/admin.profile

I could deploy successfully from my local repo to the sandbox. Any idea why this is happening or how to fix it besides writing custom scripts to remove these lines for CI/CD.

2 Answers 2


Moving standard assets and profiles between different types of Salesforce accounts can be problematic. There can be different User Permissions in each org. This can be because the orgs are different types (developer vs. professional vs. unlimited) or because there are different Salesforce product features enabled.

Unlike custom assets, you can’t add a standard asset to a deployment. You can’t create a standard asset on the destination, either. Any reference to a standard asset on the source will break the deployment because of missing dependencies. Since User Permissions are an inherent part of the Profile or Permission Set, they must be removed in order for the deployment to go through.

I wrote about this issue on the Salesforce Blog "Forbidden Secrets of the Metadata API." Hope that helps.

  • Yes, but I'd expect that using SFDX to create a scratch org would make the org containing the same User Permissions as the source off which the scratch org got created? After alleviating the above messages in the same manner [deleting them from the profile-meta.xml] I was still getting a "You may not modify the permission Create Libraries while editing a Standard Profile" -- permission TRUE for both orgs -- so I tried putting 'CreateLibraries' in manually around 'CreateWorkspaces' in the file, but then got Unknown user permission: CreateLibraries --- sooo, any thoughts on all that?
    – CRT
    Commented Apr 23, 2019 at 18:52
  • 1
    You can't change Standard Profiles. Taking a step back, can you get your work done without deploying Profiles at all? If you deploy Apex Classes and Custom Objects etc. then the Profiles will often take care of themselves. Working with a Scratch Org, one strategy is to Push your developer assets and then Pull everything including the Profile changes. Hope that helps. Commented Apr 24, 2019 at 23:30

Manual deleting from any of xmls is pretty error-prone. So as you trying to deploy, I assume the problem lays in your package.xml. Use in-file-search to make sure there are no such permissions

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .