How to move newly created salesforce profile in sandbox to production with correct permissions?

Question

I have a pretty standard scenario that I have not been able to find a clear answer or great documentation on.

The scenario is, in Sandbox A, you clone Custom Profile 1 as Custom Profile 2. You create a custom field in Sandbox A, custom field A. Create and change set including Custom Profile 1 and custom field A and deploy it in Sandbox B.

What is currently happening is, the FLS for custom field A for Profile 2 is correct in Sandbox B, but all other permissions are not. They seem to be inheriting the standard user profile permissions for all objects and fields not included in the change set.

So, I'm wanting to confirm that this is the intended behavior and, if it is, how would you go about creating a new profile in a sandbox as part of new functionality and deploy that to production?

Thanks in advance for any clarity here.

Answer 1

Unfortunately, deploying of a profiles was always a bit tricky in Force.com platform. The main problem is that only System permissions and some other settings are deployed with profile alone. All the Objects/Tabs/Fields permissions are deployed with changeset if and only if there are given Objects/Tabs/Fields are part of the same changeset.

In case if given fields should not be deployed, then ANT + Metadata API can help. In order to retrieve a profile with all permissions, the package.xml for retrieval should contain all Objects/Tabs, probably page layouts (for page layout assignments) and so on, but after retrieval only profile can be deployed to the target environment.

Links below describes how to create package xml and what are the names of metadata types:

• https://developer.salesforce.com/docs/atlas.en-us.eclipse.meta/eclipse/ide_about_package.htm
• https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/manifest_samples.htm
• https://workbench.developerforce.com/login.php