Error while deploying new Public Group using ANT

Question

I'm getting the following error while deploying into my Sandboxes using ANT:

2019-09-19T15:15:28.4944305Z All Component Failures:
2019-09-19T15:15:28.4945450Z 1.  groups/Service_Desk_Users.group -- Error: insufficient access rights on cross-reference id
2019-09-19T15:15:28.4945779Z 
2019-09-19T15:15:28.4946017Z *********** DEPLOYMENT FAILED ***********

The Group API Documentation found here states that wildcard is supported!

In my package.xml I have the following:

<types>
    <members>*</members>
    <name>Group</name>
</types>

I know the target sb on my deployment currently doesn't contain the "Service Desk Users" group.

I was under the impression that the group would be created as it doesn't exists, but the group members would need to be added manually using dataloader/workbench as per this question.

Any idea why I'm getting the error, as this is a new group I'm trying to deploy and I'm not worried about the members just yet?

Thanks.

Answer 1

Error: insufficient access rights on cross-reference id

Usually this error occurs when the Id does not exist in the target org you are deploying to. Look at the Service_Desk_Users group metadata to see if there is a user reference in there. If there is I think Salesforce tries to match up associated user with the email by removing the sandbox affix, so if the email is different apart from the affix it won't find a match.

Answer 2

I found the solution:

As per this post, this error could occur due to the API user not having the right permission(s).

As per Salesforce documentation on how to "Create and Edit Groups", the user needs the "Manage Users" permission.

The oob "API Only" profile doesn't have this permission enabled by default. Upon enabling this permission it worked as expected, and the group was created as expected.