I've created a permission set and included it in a 2nd generation managed package. However, when I install or upgrade the package some of the permissions I've assigned remain unchecked. These include:

  • Object Settings > Contacts > Read
  • Object Settings > Contacts > Email > Read Access
  • System Permissions > API Enabled

I've also given the same permission set full access to a bunch of custom objects which are being added correctly.

When I push to a scratch Org the permissions are all enabled and I can see the settings in the permission set metadata.

Any ideas why these 3 permissions aren't being included when packaged?

  • Hello Jonny, is this a 2nd package or first? Aug 11, 2021 at 14:49
  • 2nd generation. I'll add to the post Aug 11, 2021 at 14:52

1 Answer 1


You cannot package those types of permissions. See About Permission Sets and Profile Settings in the ISVforce Guide:

Do they include standard object permissions? No

Do they include user permissions? No.

In general you cannot package changes that have impact on access outside the scope of your application.

  • Sounds fair but David, is not it "API Enabled" considered "System Permissions"? Maybe that is under the same bucket but it made me wonder. Aug 11, 2021 at 15:59
  • Worth noting that unlocked packages don't appear to suffer the same "restrictions" with packaged permission sets.
    – Phil W
    Aug 11, 2021 at 18:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .