0

If I create a blank profile in DX (minimal info, no object/field level security) and deploy it, the resulting deployed profile still has some object and field level security.

How does Salesforce decide what permissions to grant when we don't give it specific guidance?

Improve this question

2 Answers 2

Reset to default
2

After significant testing, I can confirm Salesforce uses the Standard Profile corresponding to your custom profile's license type to fill in the gaps when you create a profile with "incomplete" metadata.

(updated with more complete info from @phil w's answer)

Improve this answer
3
  • I assume your profile was created based on the Standard User Profile through the UI rather than via sfdx push using an almost empty XML metadata file? (Though that isn't what your question said...)
    – Phil W
    May 11, 2021 at 21:25
  • 1
    @PhilW, nope, empty xml, via DX (Like my question said).
    – HartyeTech
    May 13, 2021 at 14:24
  • A very interesting find. I'll delete my incorrect answer once I have verified it for myself.
    – Phil W
    May 13, 2021 at 16:16
1

As @HartyeTech discovered, Salesforce fills in permissions based on an out-of-the-box profile.

However, it is not always the Standard User profile. I believe Salesforce selects a standard profile with a matching user license and applies that (with some specific selection of a given standard profile when there's more than one against the same license type, as is the case for Standard User).

For example, I have an "no CRUD/FLS" profile, i.e. one where the XML only defines accessible custom metadata types, custom settings, user permissions and layout assignments, based on the Customer Community license and the CRUD/FLS permissions given to this profile match those of the standard Customer Community User profile, not the Standard User.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .