I'm trying to build a "no permissions" baseline profile in a sandbox I just spun up from my production org before playing with a new integration (so I can assign permissions in a "least privilege" way).
I got all the object-level CRUD turned off for every object, but when I go into the field-level permissions for each object with that new profile -- be it in the web-based Setup panel or within Welkin Suite -- there are fields that are editable or readable.
Cool, cool ... I want to blast those all away, too, as a "belt and suspenders" kind of thing.
Editing them in web or Welkin propagates the change to the other, but I'm getting sick of going object by object.
In theory, these are all just
fieldPermissions tags in the NewProfile.profile XML file that should be on my hard drive (thanks to having all profiles in my package.xml). I should be able to open Notepad++, erase them all, and deploy it back to Salesforce ... done.
In practice, there're no such tags in that file.
In fact, I did a file search on my hard drive in the entire folder I downloaded all the XML files into for an unusually named custom field that was showing up editable for a custom object (yes, the object itself is "None" access), and there's nothing on my hard drive mentioning that field at all.
- Where are they, if not in the Profile XML file? They're somewhere if Welkin can see that this new profile has the ability to view all fields on Contact, for example...
- How do I get around this problem and turn off all those field-by-field viewability issues in one fell swoop?
Note: No SFDX or anything going on here, just classic org-based development.