Our setup has integrations that access Salesforce through service users. This users profiles have IP whitelists. Now a new system has Internet-facing IP ranges that depend on the environment (production, staging, dev etc.). For good security, only the staging environment should communicate with the staging sandbox, production with production etc.

We try to automate as much as possible when refreshing sandboxes, using the SandboxPostCopy Apex interface. We also handle environment-specific changes with this class.

What would be a good way to automatically change the IP restrictions on the profile when a sandbox is refreshed?

  • Probably possible, but a rather heavy approach, would be calling the Metadata API from Apex, as described here.

  • The Apex Metadata API does not support updating profiles.

Any other ideas?

  • Have a "baseline" profile with additional "features" such as IP restriction being layered on by one or more Permission Sets. – identigral Oct 20 '20 at 15:59
  • 1
    @identigral As far as I know, it is not possible to define IP restrictions with permission sets. See this idea: trailblazer.salesforce.com/ideaView?id=08730000000ksd2AAA – georg w. Oct 20 '20 at 16:42
  • Ugh, you're right. Another option might be a custom Login Flow. Here's an example that shows how you can conditionally take action based on IP – identigral Oct 20 '20 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.