I'm working on a project in Python, using simple_salesforce to talk to the Bulk and REST APIs. I'm testing this project via Salesforce DX, running in GitLab Pipelines.

I've encountered an odd recurring, but not constant, error. Some fraction of the time (perhaps 50%), my brand-new scratch org doesn't allow me to access the Campaign object, which several of my tests insert. In such situations, inspection (when the scratch org is spawned from the desktop) reveals that the scratch org's user does not have Marketing User set. Other times, it works fine immediately upon scratch org creation, and Marketing User is turned on as I would expect it to be.

The scratch org definition I'm using is 100% constant and ultra-simple:

    "orgName": "Ktema Systems",
    "edition": "Enterprise",
    "features": [],
    "orgPreferences" : {
        "enabled": []

I've literally never changed it since starting this project.

I am not using the prerelease SFDX:

sfdx-cli/6.44.0 (linux-x64) node-v10.14.2

and my Dev Hub is a Developer Edition that's been used for years.

I can reproduce the error, but not reliably, both in my CI pipeline and interacting with SFDX on the command line. The sequence of commands issued is the same on both CI and desktop (in slightly different form to account for CI variables):

sfdx force:org:create -v DevHub -s -f assets/project-scratch-def.json -a scratch
sfdx force:data:tree:import -p test_data/Account-Contact-plan.json -u scratch
USER_DETAIL=$(sfdx force:user:display --json)
export ACCESS_TOKEN=$(echo $USER_DETAIL | jq -r '.result.accessToken')
export INSTANCE_URL=$(echo $USER_DETAIL | jq -r '.result.instanceUrl')

The tests run by pytest are what causes the issue (multiple tests insert Campaigns), not the force:data:tree:import.

I tried to correct the issue by adding a record update against the scratch org user:

sfdx force:data:record:update -u scratch -s User -v "UserPermissionsMarketingUser=true" -i $(echo $USER_DETAIL | jq -r '.result.id')

but this produces the bizarre error

ERROR: This user is a portal administrator and must have a profile with the "Edit Self-Service Users" permission.: __MISSING_LABEL_FOR_common.udd.impl.UddInfoImpl@49bed3ea.

The Marketing User permission can be manually applied to the user in the cases I've attempted that.

I don't have the luxury of iterating to create scratch orgs until I get one that "works", because my Dev Hub is a Developer Edition with a daily scratch org limit of 6.


  • What do I need to do to reliably ensure that my scratch org user is a Marketing User?
  • Is this behavior expected due to some omission on my part or would it be characterized as a bug?
  • DO you just want it for Apex tests? Dec 31, 2018 at 16:39
  • 1
    Nope, there's no Apex at all. REST and Bulk APIs called from Python.
    – David Reed
    Dec 31, 2018 at 16:40
  • The ability to Manage Customer User permissions as been removed for all profiles as per Winter 19 docs Page 41. Can you can add a Permission Set, to User User, on Org creation, with the 'Manage Customer Users' setting checked off?
    – shmuels
    Dec 31, 2018 at 20:25
  • @shmuels I don't need to Manage Customer Users and I'm not using any portals or communities. That's why I find that error message baffling. I'm not pushing any metadata of any kind into my scratch orgs.
    – David Reed
    Dec 31, 2018 at 20:28
  • I found that I wasn't able to even manage the default scratch org user (User User) without this Permission Set. (I.E. couldn't update User User's Phone or Email.)
    – shmuels
    Dec 31, 2018 at 20:29

1 Answer 1


You mentioned that you are able to manually tick UserPermissionsMarketingUser via UI, So I believe this will also work with APEX.

Why not run execute Anon code after the scratch org is created using sfdx force:apex:execute

$ sfdx force:apex:execute -f ~/AssignMarketingUserPermission.apex

Src: https://developer.salesforce.com/docs/atlas.en-us.sfdx_cli_reference.meta/sfdx_cli_reference/cli_reference_force_apex.htm

  • I will try this. It did not work when I tried to set the permission through an SFDX record update, but I can't explain why I was able to set it through the UI. It's such an unreliable issue that it's hard to troubleshoot.
    – David Reed
    Dec 31, 2018 at 17:21
  • 1
    Pranay, I was finally able to test this (it's a hard problem to duplicate), and to my astonishment it worked. I don't have any explanation for why Anonymous Apex might work but a REST API update does not, but nice idea!
    – David Reed
    Jan 5, 2019 at 3:48
  • 1
    Inexplicably, the Apex does still fail sometimes (and throws the same weird error about portal administrators) but so far it's cured the Marketing User issue once and failed on a scratch org that didn't have the Marketing User issue, so I'll take it.
    – David Reed
    Jan 5, 2019 at 4:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .