Our managed package adds a trigger on Contact and Lead insert/update. After an organization installs the package, the trigger is executed whenever a Contact or Lead is inserted/updated, even if the user does not have a license to use the managed package. Following apex development best practices, I created a separate class that holds the trigger's logic. How can I make sure this class can always be executed since sometimes the trigger could be executed by some users who do not have a license?


I believe those triggers are always going to run and you don't have to make any other adjustments.

If you're concerned about custom fields and visibility / field level security (FLS) issues that might prevent your triggers from doing what they need to do, consider either:

  1. Applying a managed package permission set to all org users that has all the FLS / CRUD permissions set for your custom fields / custom objects within the package.

  2. You could add without sharing to the Apex class definition.

Option 2 is definitely less of a best practice than option 1 and should be used with great caution, especially if this managed package is trying to make it's way to the AppExchange and has to pass Security Review

  • Yeah I noticed that for some reason I don't seem to have permission problems with those triggers, maybe it is because they are run in a permission-less environment or something like that? I do already apply a permission set to all users – Perennialista Dec 20 '19 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.