1

The goal: A profile that has zero object access, zero field access, etc. I want all object and field access to be controlled by permission sets.

The Attempt:

Via the SF UI: You're in for a world of hurt. You have to create new profiles by cloning from existing, so there's no choice to start with an empty profile. You'd then need to click through literally hundreds of objects, one by one, with painful page load times, to then uncheck dozens of CRUD and FLS checkboxes on each object page. We're talking about painful busywork that would take hours. No thank you.

Via SFDX: I had hoped that working directly with metadata in SFDX would fix this problem. After all, a profile deployed by itself wouldn't bring over any object permissions, since they have to be included in the deployment, right?

Try this:

  1. Pick a random profile in your SFDX metadata repo
  2. Copy the file, change the filename to your new profile name, and delete everything from the XML except for the top level tags, so it looks like this:
    <?xml version="1.0" encoding="UTF-8"?>
    <Profile xmlns="http://soap.sforce.com/2006/04/metadata">
        <custom>true</custom>
        <userLicense>Salesforce</userLicense>
    </Profile>
  1. Use SFDX to deploy profile to an org.

I would have expected a completely empty profile. No object settings, no system permissions, no nothing. That's what I'm clearly asking for given what's in the XML file, after all.

NOPE What I got instead was basically a 'default' profile. A whole bunch of system permissions checked that I wouldn't want these users to have. All standard objects given full access.

I cannot fathom Salesforce's reasoning behind this limitation. It seems poorly designed, but, like, at a profound level.

Is there any better solution for my goal than having to manually uncheck boxes in the UI for the next 3 hours? Please god.

8
  • 3
    Clone the Minimum Access profile: help.salesforce.com/s/…
    – identigral
    Feb 25, 2022 at 15:43
  • lifesaver! Thank you
    – smohyee
    Feb 25, 2022 at 16:51
  • 1
    @identigral - you should post this as the answer
    – cropredy
    Feb 25, 2022 at 17:22
  • Relevant help document and its known issue to explain the behavior noted Feb 28, 2022 at 18:24
  • I'm finding currently that cloning this profile and then making ANY change - even just populating the description field - results in object permissions changing; similar to the known issue listed above, but through the UI, not the CLI
    – ministe
    Oct 14, 2022 at 9:23

1 Answer 1

1

There are several solutions to this known issue: https://issues.salesforce.com/issue/a028c00000gAwEpAAK/md-api--objectpermissions-of-newly-deployed-profile-showing-additional-permissions-which-are-not-even-part-of-profile-metadata

  1. Manually clone a new profile from Minimal Access
  2. Or build a full profile metadata with all false values for all standard objects and standard fields and standard tabs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .