Until today I believed that you need to provide at least TWO users to Salesforce to test your app in the Test Environment you submit for Security Review.

I tried to find that rule in an official document but I couldn't find anything. Did they change that? All I could find was this Partner video by Salesforce, where it states that there needs to be one user per Profile.

enter image description here

My questions are:

  • Do they mean per Packaged Profile?
  • Can, do and should we Package Profiles at all?
  • Is there a agreed on Best Practice for packaging a User and Admin Permission Set instead?
  • How many and what users should I add to this org?

1 Answer 1


Do they mean per Packaged Profile?

Yes. If you're not packaging profiles, you only need to have the bare minimum users. These will typically be Admin and Standard User. Your code should run just fine in both configurations.

Can, do and should we Package Profiles at all?

Yes, no, and no. We can package profiles, but we shouldn't. Salesforce.com has been hard at work reducing/eliminating the need for profiles, and there is a planned deprecation of profiles at some point in the future (Safe Harbor and all that).

Is there a agreed on Best Practice for packaging a User and Admin Permission Set instead?

Yes. Using Permission Sets and/or Permission Set Groups is the intended forward path for all apps, as the basic principle is that permissions may eventually disappear from profiles completely, leaving only things like page layout assignments and other things that would be hard to emulate with only Permission Sets.

I don't want to copy the entire article, but Introducing The Next Generation of User Management: Permission Set Groups from 2019 introduced the concept that salesforce.com is actively working on making Permission Sets and Permission Set Groups the standard for most features.

Here's a graphic of what salesforce.com is recommending for moving to Permission Sets.

Permission Set Migration

They've also noted things that they'd like to do to make the process easier to use Permission Sets:

  • Allow assignment of FLS to perm set when creating a field
  • Tools to identify where profile is referenced, locating profile names in code and configurations
  • Migration path for profile reference in custom settings
  • Allow permission sets or permission set groups mapping when installing managed package

So, we should focus on moving away from profiles. They are still "necessary" today, but modern packages should focus on Permission Set-based access policies in order to future-proof our products.

  • So can we still say there must be at least TWO users in that org for Salesforce. A SysAdmin and a StandardUser? Mar 20, 2023 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .