Background: I have a requirement to make it so that an SFDC connected app defaults/is super easy to set to Admin Users are Pre-authorized instead of All users may self-authorize. This setting is important to make this app work and we have historically have had problems with admins not configuring this setting correctly.

Here is a quick history on what I have tried to do to get the isAdminApproved set to "true":

  1. Directly, via xml definition (doesn't get honored)
  2. Directly via apex code (doesn't get honored)
  3. Indirectly via an apex-triggered metadata API call (ended up being more pain than what it was worth and was told that it wouldn't work in prod because of security restrictions)
  4. Indirectly via a connected-app connected service to make a metadata API call: works in a scratch org but not in prod, which I assume is because it is a managed package. This would occur when an Admin clicks on a button, not from a post-install script.

Details on what I mean by it isn't working in prod: When I try to do a readMetadata call on my connectedApp objects that are in my managed package, the response comes back as [{\n 'fullName': None\n}] instead of with the metadata configuration of my connected app.

Here is a sequence diagram of what I am trying to do in #4 right now:

Flow that I got working in a scratch org

My question is this: Am I on a fool's errand, where this is impossible to do? ...Or is there a way to set a connected app (in a managed package that I publish) to Admin Users are Pre-authorized without making the admin just do it themselves directly in the settings?

  • 2
    When you say it doesn't work in Prod, could you be more precise? Is it a silent failure or a specific error message? Also in your other post you dump some code that you call a "post-install script"... but post install scripts run as a package specific automated user who has no Session ID so I don't understand how that code could work in any org at all as an InstallHandler. On the other hand it might work from a Visualforce button that the admin clicks during setup.
    – Charles T
    Commented Nov 28, 2019 at 1:32
  • 1
    @BrianMiller if you do figure out how to make it work in prod, I will be super interested in what you did, though! Commented Jan 29, 2020 at 0:20
  • 1
    If the only way in is via Setup UI, it can still be automated via Selenium or a similar framework.
    – identigral
    Commented Jan 31, 2020 at 19:11
  • 2
    @RobertHyatt So I actually gave this a try - I was able to configure and do a readMetadata on isAdminApproved within the packaging org itself, but then ran into the same issue in production - readMetadata doesn't return managed connected apps results, and interestingly enough, workbench also doesn't show managed connected apps (as mentioned in the retreiveConnectedApp() method in the MetadataServicesExamples file. I don't know if this is a deficiency in Metadata API or not Commented Feb 6, 2020 at 22:38
  • 2
    @RobertHyatt Yes - unfortunately I am trying to do the same exact thing from a managed package, and the true bottleneck is the fact that we can't read the metadata for managed package connected apps - not through MetadataService or workbench. It's amazing how such a seemingly insignificant read permission is causing all these issues for ISVs :-/ Commented Feb 19, 2020 at 8:50

1 Answer 1


In short, yes, you're on a fool's errand.

The general rule is that you can't package any settings that would allow granting 'system' permissions. That is, permissions that affect more than just the objects/schema that your package contains.

For example, you can't package CRUD/FLS on Standard Objects and you can't grant System Permissions like ModifyAllData via a Profile or Perm Set that you package. Similarly, any Remote Site Setting that you package can only be deployed into the org in an 'inactive' state via push upgrade or the user needs to explicitly agree to activate it if they do an interactive install.

To your question about Connected Apps -- yes, we had the same problem with a Connected App we package for a Canvas app -- and yes, the admin of the org manually needs to flip the Admin Users are Pre-authorized setting.

You are headed down the right path to try to use the Metadata API either externally or from Apex. If you're using it from Apex, it will only work if the org has a My Domain setup and you're using their My Domain as the SOAP endpoint domain. If the org doesn't have My Domain enabled, you'll need to have the org create a Remote Site Setting for their org's URL (ex. na5.salesforce.com) and you can see how convoluted this could become :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .