How to enable Apex Class access to the `System` user

Question

The recent enforced update Require User Access to Apex Classes Invoked by Flow enforces that all users, including the hidden System user must have Apex Classes assigned to their profile or permission set.

But the System user does not have a profile and you cannot assign a permission set through the Salesforce administrative interface.

Answer 1

In order to get around this problem, you must first create a Permission Set that has access to the Apex Classes that are required for your Flow to function properly. After this is done, record the Permission Set Id (it's in the URL).

After that, retrieve the System User Id, this is unique per org, but the easiest way to find it is to copy the User Id that is in the Flow error email.

Once you have the System User Id and the Permission Set Id, open up Developer Console and use Execute Annmous and paste in the following code, replacing it with the Ids:

PermissionSetAssignment permissionSetAssignment = new PermissionSetAssignment(
    AssigneeId = '<System User Id>',
    PermissionSetId = '<Permission Set Id>'
);
insert permissionSetAssignment;

This will assign the permission set to the System user profile and allow the Flow to function properly again

Answer 2

It's possible to assign Apex Classes to the profile of the System user using URL hacks.

You'll need the profile ID of the System user. You can get this by making the following SOQL query, and replacing {SystemUserID} with the ID of your system user (which can be found in the Flow error email).

SELECT ProfileId FROM User WHERE Id = '{SystemUserID}'

Once you have this, you can build the URL, replacing the parts in curly braces with the correct values for your org: {OrgAddress}/_ui/system/user/ProfileApexClassPermissionEdit/e?profile_id={SystemProfileID}

My org address used the format like https://myorgname.my.salesforce.com

You'll then see the familiar UI to assign Apex Class permissions to the profile.