Prevent users from logging in during production delivery

Question

We will delivery in our production org and we want to avoid users to log while the time of reconfiguration and delivery.

It is recommended to modify Login Hours but we have a lot of profile to modify if we do it in that way, and I would like to automate that process. It's not possible to modify profile in APEX as DML is dissable on profile.

Is there a good practice to apply here?

Answer 1

You can run a quick Apex script on either UserLogin or PermissionSetAssignment.

WARNING: If you modify these scripts, be careful not to lock out your own login. Support would be required to fix the problem.

Example #1

UserLogin[] logins = [SELECT UserId FROM UserLogin WHERE UserId <> :UserInfo.getUserId()];
for(UserLogin login: logins) {
    login.IsFrozen = true;
}
update logins;

Example #2

PermissionSet lockoutPerms = [SELECT Id FROM PermissionSet WHERE Name = 'LockOutUsers'];
PermissionSetAssignment[] assignments = new PermissionSetAssignment[0];
for(User userRecord: [SELECT Id FROM User WHERE IsActive = true AND Id <> :UserInfo.getUserId()]) {
  assigments.add(
    new PermissionSetAssignment(
      AssigneeId = userRecord.Id,
      PermissionSetId = lockoutPerms.Id
    )
  );
}
insert assignments;

You can use the Apex Data Loader as well, or any other API-enabled tool to create/modify these records. To reverse this when you're done, simply update the UserLogin records, or delete the PermissionSetAssignment records.

Answer 2

To complete the answer, we finally we decide to use loginFLow. The advantage of this is not to freeze or unfreeze users who have been in a different context than the setting in production. more details