Do CI deployments to a sandbox (Summer 21) that includes unit test code that mocks users and assigns them to a PermissionSetGroup. Unit test code has been working for months.

The user mock factory is effectively:

System.runAs(new User(Id = UserInfo.getUserId()) {
  // mock user
  User u = new User(UserName = ..., ...);
  insert u;

  // assign mockUser to PermissionSetGroup (not mocked, comes from Org)
  insert new PermissionSetAssignment(
      AssigneeId = u.Id,
      PermissionSetGroupId = [SELECT Id FROM PermissionSetGroup WHERE DeveloperName = 'MyPSG'][0].Id);
  • When I deploy any code to the sandbox and run all tests, I get the error on the insertion of the PermissionSetAssignment: INVALID_CROSS_REFERENCE_KEY, You can only assign users to permission set groups that have the "Updated" status
  • When I deploy any code to some other sandbox and run all tests, no errors

Some observations

  • If I login to the sandbox directly, and run all tests - they pass - no error
  • Go to Setup and check the status of the Permission Set Group MyPSG - it is Updated
  • I injected an assert into the User mock factory to check the value of PermissionSetGroup.Status just before I assign it to the PermissionSetAssignment.PermissionSetGroupId - The value is Updating ❗ (not Updated)

There's a tantalizing note in SFDC Permission Set Group doc

If done during the deployment phase, an update to a permission set group triggers a recalculation. To test assignments, exclude changes to permission set groups in the deploy phase. Instead, add permission sets and user assignments to permission set groups in your test phase, which does not trigger a recalculation.

Best as I could tell, I was not deploying any Permission Sets to Permission Set Groups - just apex code (and code unrelated to the User mocks). And, I've been deploying changes to this CI sandbox org for months without issue.


I refreshed the CI sandbox org from PROD. Error went away on a repeat of the failing deployment.


As the problem recurred; I opted for a different solution than just refreshing the org

Rather than mocking a PermissionSetAssignment that is associated to a PermissionSetGroup and User, I just used a PermissionSetAssignment associated to a PermissionSet and User

  • there were no changes to any permission set within a permissions set group (PSG)? Or were any PSG/PS included in the deployment through the CI (potentially by some diff specific to that org)? Jul 23 at 16:56
  • 1
    I suspected that might be the case (CI was via Gearset and I had excluded PSGs from the deploy filter, plus checked the comparison report which was just apex classes). What was odd was that after refreshing the CI sandbox, running the exact same deployment passed w/o error
    – cropredy
    Jul 23 at 17:32
  • aargh; this issue happened again. I'm going to need a different solution. Stay tuned
    – cropredy
    Aug 18 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.