0

I am running SOQL queries to compare object permissions, but get duplicate permission for the same profile. For example, the "System Administrator" profile has two identical object permissions for the "Account" object. But why would there be two records? On the other hand, the same profile has two permission records for the object "Pricebook2" or "Product2", but one record has "ModifyAll" = true and the other record has "ModifyAll" = false

Could anybody explain the reason behind this?

Here is the SOQL-query I used for the profile "System Administrator":

SELECT Id, PermissionsCreate, PermissionsDelete, PermissionsEdit, PermissionsModifyAllRecords, PermissionsRead, PermissionsViewAllRecords, SobjectType, Parent.Profile.Name

FROM ObjectPermissions

WHERE Parent.Profile.Name = 'System Administrator'

2
  • Did you consider looking at what the Parent is in each case to help distinguish what these are?
    – Phil W
    Jun 21 at 7:58
  • Yes, they all share the same "ParentId" which is part of the "System Administrator" PermissionSet.
    – yassin0
    Jun 21 at 8:16
1

You see pattern in the ID. 110 is the actual prefix for the Object Permission object, you can see that here - http://www.fishofprey.com/2011/09/obscure-salesforce-object-key-prefixes.html

The other one is for internal use, with prefix 000. You can read more on the same here - http://www.fishofprey.com/2011/06/salesforce-empty-key-id.html

And the official document also says -

Determining Object Access with “Modify All Data” When using SOQL to query object permissions, be aware that some object permissions > are enabled because a user permission requires them. The exception to this rule is when “Modify All Data” is enabled. While it enables all object permissions, it doesn’t physically store any object permission records in the database. As a result, unlike object permissions that are required by a user permission—such as “View All Data” or “Import Leads”—the query still returns permission sets with “Modify All Data,” but the object permission record will contain an invalid ID that begins with “000”. This ID indicates that the object has full access due to “Modify All Data” and the object permission record can’t be updated or deleted. To remove full access from these objects, disable “Modify All Data” and then delete the resulting object permission record. This ensures that when using SOQL to find all the objects that have full access, it returns all objects that have this access regardless of whether it’s due to “Modify All Data” or because an administrator set full access.

1
  • Thank you for the explanation! @ysr-shk
    – yassin0
    Jun 21 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.