I've created a permission set and included it in a 2nd generation managed package. However, when I install or upgrade the package some of the permissions I've assigned remain unchecked. These include:

  • Object Settings > Contacts > Read
  • Object Settings > Contacts > Email > Read Access
  • System Permissions > API Enabled

I've also given the same permission set full access to a bunch of custom objects which are being added correctly.

When I push to a scratch Org the permissions are all enabled and I can see the settings in the permission set metadata.

Any ideas why these 3 permissions aren't being included when packaged?

  • Hello Jonny, is this a 2nd package or first? Aug 11, 2021 at 14:49
  • 2nd generation. I'll add to the post Aug 11, 2021 at 14:52

1 Answer 1


You cannot package those types of permissions. See About Permission Sets and Profile Settings in the ISVforce Guide:

Do they include standard object permissions? No

Do they include user permissions? No.

In general you cannot package changes that have impact on access outside the scope of your application.

  • Sounds fair but David, is not it "API Enabled" considered "System Permissions"? Maybe that is under the same bucket but it made me wonder. Aug 11, 2021 at 15:59
  • Worth noting that unlocked packages don't appear to suffer the same "restrictions" with packaged permission sets.
    – Phil W
    Aug 11, 2021 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.