I have a production org that is the Devhub. I have a full copy sandbox. I want that the developers that are working on their respective scratch orgs, don't deploy their changes to production directly. I only want them to push the changes to the sandbox. Is there anything I can do in the SFDX process that can prevent someone from deploying directly to production/devhub?

1 Answer 1


Make them a "Read-Only" or "Minimum Access - Salesforce" user, and then grant additional permissions for them as you need to (via a Permission Set). You can follow the Add Salesforce DX Users instructions in the Salesforce DX Developer Guide. A properly configured Developer Permission Set can include just the permissions needed to create new Scratch Orgs, new Sandboxes, etc, without any rights to create, read, write, or delete any other objects in the system, and have no System Administrator capabilities in the Dev Hub org.

  • Is there a way to prevent a dev from accidently pushing to Dev-hub. Given that now devs will be authorized with Dev-hub. If they have the devhub set as default (accidently) and hit push
    – KLab
    Feb 15, 2023 at 21:23
  • @KLab You cannot push or pull from a Developer Edition or Production Org, as they are not Source Tracking enabled orgs, so it is impossible to push/pull to a Dev Hub, accidentally or on purpose. To prevent accidental deployments, on the other hand, create them as a Developer or Standard User, then give them a permission set as described in the link in my answer. They will not have Author Apex, etc, so they will not be able to accidentally, or on purpose, deploy to production directly.
    – sfdcfox
    Feb 15, 2023 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .