0

I use query like below to find what Profiles and Permission Sets give what kind of permissions to a specific field:

SELECT Parent.ProfileId, Parent.IsOwnedByProfile, ParentId, Parent.Label, Parent.Profile.Name, Field, PermissionsEdit, PermissionsRead FROM FieldPermissions WHERE Field IN ('Account.Active__c') AND SobjectType = 'Account'

When field is not marked as Required: The above query is returning rows.

When field is marked as Required: The above query is returning 0 rows.

Additional Info: I have seen this same behavior in more than one org and same result whether I run this query from developer console, SFDX CLI or Workbench.

Why this query is not returning any data when field is marked as Required?

EDIT: If I don't grant access to a field for any profile and then make that field as required, System is automatically granting access to that field to all profiles. That means, If a field is marked as required, all profiles get access to that field but why FieldPermissions table don't have entry for that?

2

a few reasons: see #3

  1. some fields dont support field-level security such as StageName so those would yield zero results.

  2. iirc if the FLS is hidden (no read grants, no write grants) then your fieldpermissions query will return no rows, even if youre a system admin

  3. Per sfdc docs: The following field types don’t return a FieldPermissions record because they are assumed to always be readable and writable:

OwnerId

Master-detail custom (relationship) fields

Universally required custom fields

7
  • 1) I use this query only against custom fields and custom fields support FLS. 2) What do you mean by hidden? As I mentioned in my question, If field is not marked as required, then query is returning rows. How can FLS become hidden once field is marked as hidden? – javanoob Jan 6 at 15:29
  • See #3 from the updated answer – Peter Noges Jan 6 at 16:17
  • Can you answer one simple question: why the query is returning rows before I make the field as required and not after I make the field as required? – javanoob Jan 6 at 16:55
  • Its how sfdc is designed. For example if you make a field required (at the field/schema level, not the layout level) then it means you cannot change its FLS therefore zero rows returns in FieldPermissions because salesforce’s definition of #3 – Peter Noges Jan 6 at 17:02
  • 1
    i believe so because you wont be able to adjust fls when the field is universally-required at the schema level (of course testing this also depends on other access/security constraints/ grants like object access, owd, etc any others). Its worth testing but thats what i recall from memory.Btw sfdc doc says “ Edit pages always display universally required fields, regardless of field-level security.” – Peter Noges Jan 6 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.