2

Is there any easy way to remove

Read, Create, Edit, Delete, View All, Modify All

permissions of objects related to installed packages from Profile?.

I have been doing this manually by going through each and every objects and removing the permissions.

One way we can do this by reinstalling the package. But this is not doable in production.

1

One of the approach could be to use good old metadata api with Workbench for simplicity. Idea is very simple - retrieve all the profiles with permissions, update and deploy them back.

Steps to resolve it would be following:

  1. Create package.xml with mentioning of all of the objects, for which object permissions needs to be revoked and corresponding profiles. In that case, object names and profile names are case sensitive For example:
 <Package>
        <types>
         <members>Object1__c</members>
         <members>Object1__c</members>
         <name>CustomObject</name>
        </types> 
        <types>
         <members>ProfileName1</members>
         <name>Profile</name>
        </types>
        <version>47.0</version>
    </Package>
  1. Use Workbench to retrieve given metadata.
  2. Unzip given file into some folder, and change each entry of the object permission (text editor's search and replace could be handy) in files to false, so it looks like this:
<objectPermissions>
    <allowCreate>false</allowCreate>
    <allowDelete>false</allowDelete>
    <allowEdit>false</allowEdit>
    <allowRead>false</allowRead>
    <modifyAllRecords>false</modifyAllRecords>
    <object>Object1__c</object>
    <viewAllRecords>false</viewAllRecords>
</objectPermissions>
  1. Compress corresponding folder back into zip file and deploy using workbench. Actually, it is only necessary to deploy profiles, and only the part which has object permissions in order to change it.

Given steps could be also done using Ant Migration tool, but that requires certain prerequisites.

| improve this answer | |
  • Thank you Kurunve. I posted another answer since my comment is too long. – mohammed azarudeen Dec 16 '19 at 10:20
-1

Thank you very much Kurunve.

I would like to highlight some points here to help someone reduce their work.

  1. If you need to get all the object names related to package to build package.xml file, use SELECT QualifiedApiName FROM EntityDefinition where QualifiedApiName LIKE 'sbaa__%' query.
  2. If a package contains more than 200 objects, it will throw an error. Use OFFSET with LIMIT 200 to query.
  3. The above query will fetch all the objects along with their standard definitions like __Tag, __ChangeEvent, __Share. You need to remove all these in package.xml and keep only the actual Object__c.
  4. Note that retrieved Profile.profile xml file won't contain objectpermissions for an object that doesn't have any access permission in the profile. The particular object must have atlease one permission(Read).
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.