The problem is that I cannot set the role for the scratch org user. I get the following error:

Unable to Finish Processing Request

An error has occurred while processing your request. The salesforce.com support team has been notified of the problem. If you believe you have additional information that may be of help in reproducing or correcting the error, please contact [email protected]. Please indicate the URL of the page you were requesting as well as any other related information. We apologize for the inconvenience.

Thank you again for your patience and assistance. And thanks for using salesforce.com!

Error ID: 1017403518-10359 (91723303)

I've used the SFDX CLI to create a scratch org using the following JSON definition (though with a real namespace linked to the dev hub):

  "orgName": "Demo",
  "edition": "Developer",
  "namespace": "example",
  "features": [
        "networksEnabled": true,
        "chatterEnabled": true,
        "enhancedEmailEnabled": true
        "enableMiddleName": true

The command itself was:

sfdx force:org:create -f the-above-file.json -asomealias -d7 --setdefaultusername country=GB language=en_US

This appears to work fine and I can access the org using the CLI command:

sfdx force:org:open -u somealias

I then pushed my code to the org and tried to run all my tests. Some tests failed. These were consistently those that tried to use System.runAs.

The specific error message either:

Internal Salesforce Error: 196804881-4926 (650451209) (650451209)

Or, more enlighteningly:

System.DmlException: Insert failed. First exception on row 0; first error: UNKNOWN_EXCEPTION, portal account owner must have a role: []

It was the latter that took me to the scratch org user's configuration where I spotted that no role was set.

Using the standard Salesforce UI I attempted to set this user's role to CEO, but on clicking Save I got the error shown at the start of this question.

Anyone got any ideas as to how to resolve this problem?

  • 1
    Try creating a new role in scratch org and assign to user, for some odd reason we get internal server error with existing role. Had this annoying issue for quite sometime, this was the only workaround for us.
    – Raul
    Apr 10, 2019 at 19:08
  • Thanks @Raul. Did you raise this as a bug with Salesforce? We don't have the necessary support arrangement, but I raised it on a couple of SF forums...
    – Phil W
    Apr 10, 2019 at 21:35
  • No haven't yet, good point I can log a case today.
    – Raul
    Apr 11, 2019 at 5:55
  • Tried changing role for an existing/new user in a new scratch org, its allowing me to change the role. Salesforce support won't be able to help as I am not able to provide steps to replicate.
    – Raul
    Apr 11, 2019 at 8:26
  • This is specifically trying to set the role for the initial scratch org user after creating a scratch org. Reproduction steps are basically: 1. create scratch org. 2. access the scratch org 3. go to user management and select the scratch org user. 4. See it has no role. 5. edit the user to set the role. 6. save. At step 6 you get the error.
    – Phil W
    Apr 11, 2019 at 14:15

3 Answers 3


After what @Raul said in the comments, and with this known issue, it can be seen that there is a general issue with Salesforce SFDX scratch orgs and "Out of the Box" roles. The workaround I have used is to:

  1. pre-define a custom role as part of our meta data called "Automation"
  2. execute some Anonymous Apex from our Ant build

The Ant script target for point #2 is:

<target name="init-scratch-org-user" depends="sfdx, get-existing-alias">
    <echo output="${anon.apex.file}"><![CDATA[
        // Give the user the required permission set and role
        List<PermissionSet> sets = [SELECT Id FROM PermissionSet WHERE Name = 'Scratch_Org_User'];
        List<User> users = [SELECT Id FROM User WHERE Alias = 'UUser'];
        List<UserRole> roles = [SELECT Id FROM UserRole WHERE Name = 'Automation'];

        if (!sets.isEmpty() && !users.isEmpty() && !roles.isEmpty()) {
            PermissionSetAssignment assignment = new PermissionSetAssignment(
                    PermissionSetId = sets[0].Id,
                    AssigneeId = users[0].Id);
            users[0].UserRoleId = roles[0].Id;

            insert assignment;
            update users[0];

    <exec executable="${sfdx}">
        <arg value="force:apex:execute"/>
        <arg value="-u${sfdx.alias}"/>
        <arg value="-f${anon.apex.file}"/>

Note that property "anon.apex.file" is generated from a tempfile, the sfdx target determines the CLI tool name as property "sfdx" and the get-existing-alias target obtains the target scratch org's alias in the "sfdx.alias" property.

This snippet of Anon Apex also happens to set a permission set assignment for the same user so we can have all the necessary CRUD and FLS settings initialized for that user as well.

UPDATE: I have subsequently discovered the SFDX CLI command that simplifies this setting up of the permission set assignment:

sfdx force:user:permset:assign -u alias -n PermissionSetName

I was encountering the same issue - mainly as I could not test any of my community functionality without creating a Partner account User successfully.

Seems like it's not possible just to give your user an existing role inside scratch org. you must create a new one.

Been creating new users in my scratch org using sfdx as a prior step :

sfdx force:user:create --setalias qa-user --definitionfile config/user-def.json

Then inside the org manually add new Role (Setup > Roles) and assign it to a new User. seems like no way to select existing roles.

Now its possible to have a User with role meaning that in my unit test I can create a partner User (where account has an Owner with Role)

  • Can you provide a listing of the content of the user-def.json file as well (replacing any sensitive values with placeholders, of course)?
    – Phil W
    May 29, 2019 at 10:27
  • sure - it's documented here - have not changed much - the Role was added manually inside the org after user was created - developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/…
    – sfdx bomb
    May 29, 2019 at 10:32
  • Thanks. NB: you can automate the creation of the role (just add the meta data file to your source tree), and you can automate the assignment of the role to the user(s) as I have shown in my answer by running anon apex.
    – Phil W
    May 29, 2019 at 10:35

I also ran into same issue. want to create a community portal user from a Contact. I just created a custom new role by going to Setup -> Roles and created one and it worked. Now I am able to enable portal user from a Contact. enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .