SFDX: Use Scratch Org without PROD Org Access. Possible?

Question

We are planning to use SFDX Org Development Model along with CI using scratch orgs (as we have limitations on going directly to Package Development model). The plan is to use scratch orgs only for using CI.

In our Production Org, we have enabled Dev HUB. Let's say we have 3 sandboxes (DEV, SIT and UAT).

Whenever developer do a commit to DEV branch in our Git repository, we would like to execute the following using pipelines (Azure),

1. Create scratch org
2. Push the DEV branch (force-app/main/default) as source to the scratch org 3).
3. Run test classes
4. If all the test classes passed, then deploy the code to SIT org.

In order to do the above, the first step is to authorize DevHub org in this case my Production Org.

In this case, the SFDX user used in the pipeline needs to have access to my Production Org and a connected app (for JWT based authorization) has to be created in Production Org? Is it possible to do all the above without any access to Production Org?

Answer 1

Short answer is you will need an integration user for your CI .You cannot connect to your Salesforce devhub in your PROD org without that user .

Note on the connected app (like a managed package app in developer orgs), you can create a connected app in any org but that app needs to be installed in the PROD org and access needs to be provided. I recommend you keep your connected app in PROD environment.

The user used for this purpose need not have any other access and can have a permission set to create only scratch org which gives them access to only create scratch orgs .

If you need it to deploy to it then there is a permission to manage metadata .

Also Salesforce offers free licenses for this purpose if you are running out of license. Reach to your Salesforce AE or Salesforce support .

Learn more about the limited free licenses here (https://developer.salesforce.com/docs/atlas.en-us.sfdx_setup.meta/sfdx_setup/sfdx_setup_add_users.htm)