I am getting:

"FATAL_ERROR|System.TypeException: DML operation INSERT not allowed on Group" error on an apex trigger (line 43)

when I am logging in as any other user except System Admin. I am not really sure how to handle CRUD permissions on Group.

trigger CAP_AG_ProjectShare on CAP_AG_Project__c(after insert,after update) {
Set<Group> allGroups = new Set<Group>();
Set<ID> deleteProjectSharesIdSet = new Set<ID>();
List<CAP_AG_Project__share> projectShares = New List<CAP_AG_Project__share>(); 
List<CAP_AG_Project__share> deleteprojectShares = New List<CAP_AG_Project__share>();
map<String,List<Id>> groupToProjectMembers = new map<String,List<Id>>();
map<String,List<Id>> groupToProjectToDelete = new map<String,List<Id>>();
LIST<ID> ownerIdsSet = new LIST<ID>();

for(CAP_AG_Project__c project: trigger.new){
    if(project.CAP_AG_Country__c != Null && project.CAP_AG_Private_Project__c != true){ 
            String cleanCountryName = project.CAP_AG_Country__c.trim().left(40);
            String namePrefixedCountryName = ('CTRY_' + cleanCountryName.replace('.','_').replace(' ','_').replace('-','').replace('(','').replace(')','').replace('\'','').replace(',','').replace('__','_')).left(40);
            allGroups.add(new Group(DeveloperName=namePrefixedCountryName,Name=('Country - ' + cleanCountryName).left(40)));
                groupToProjectMembers.put(namePrefixedCountryName,new List<Id>());
    if((Trigger.IsInsert && project.CAP_AG_Private_Project__c == true)
        || (Trigger.IsUpdate && project.CAP_AG_Private_Project__c == true)
        || (Trigger.IsUpdate && !(trigger.oldmap).isEmpty() && trigger.oldmap.get(project.id) != null && trigger.oldmap.get(project.id).CAP_AG_Country__c != null && 
            trigger.oldmap.get(project.id).CAP_AG_Country__c != project.CAP_AG_Country__c)

for(CAP_AG_Project__share projShare: [Select id,UserOrGroupID,ParentId,AccessLevel from CAP_AG_Project__share where ParentId IN: deleteProjectSharesIdSet and UserOrGroupID NOT IN :ownerIdsSet and RowCause = 'Manual'])

***database.upsert(new List<Group>(allGroups),Schema.Group.Name);***
for(Group g:allGroups){
        For(Id projectId : groupToProjectMembers.get(g.DeveloperName)){
            projectShares.add(new CAP_AG_Project__share(UserOrGroupID=g.id, ParentId=projectId,AccessLevel='Read'));

Please help me understand where I am going wrong.


Groups are a type of setup object in salesforce with special behavior. Can you try moving the group dml to a future method and see if that does the trick?

I think the issue is that you're doing a delete on line 40, and then doing the insert.

According to the documentation here's what they say about groups:

You can only insert and update a group in a transaction with other sObjects. Other DML operations aren’t allowed.

To read more about setup objects go here

  • thank you so much for your response. The actual issue turned out to be a class on Opportunity which was triggering this trigger on Project on update. The method in this class had a future annotation (as it is required to update groups) but it was getting called multiple times resulting in multiple transactions. Fixed it and now the trigger works perfectly. – Nishi May 29 '19 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.