Anyone know if it's possible to deploy profiles/permission sets via Eclipse or an Unmanaged Package that contain object & field permissions for 3rd party managed objects?

I'm trying to deploy a profile from one org that contains object/field permissions for objects that are part of a managed package (not a package that I have access to, but that is from a 3rd party vendor).

The problem that I'm running into is that the profile/permission set XML files in eclipse don't even contain the object/field permissions for these managed objects, they only contain the object/field permissions for standard Salesforce objects & custom unmanaged objects.

I'm able to deploy the profiles/permissions sets to another org but only the premissions for standard & custom unmanaged objects get migrated... none of the permissions for the 3rd party managed objects move.

2 Answers 2


This is possible, provided your package.xml is configured correctly. From the directions at http://boards.developerforce.com/t5/AppExchange-Directory-Packaging/Reading-complete-profiles-using-the-Metadata-API-or-sf-retrieve/td-p/213903

Using Field Trip as an example, in my package.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">

In the profile XML retrieved I see:

  • Mike, were you able to change the package.xml file in the Eclipse IDE, and then use the 'Deploy to Server' wizard in Eclipse? Or did you have to use Ant for what you showed above? Commented Nov 29, 2012 at 21:37
  • I used Ant to produce this.
    – Mike Chale
    Commented Nov 30, 2012 at 1:02
  • Great, thanks Mike. I'll do some testing and let you know if I hit any snags, appreciate your help! Commented Nov 30, 2012 at 4:52

This is absolutely possible. What is not possible is to retrieve or deploy managed components like a managed permission set. These components are considered protected and immutable.

However, by retrieving the managed CustomObject member metadata along with your own custom profile/permission set metadata, as in @Mike Chale's example, you will have access to set permissions on your custom profile/permission set metadata.

Just go into your .Profile settings file in eclipse and modify the permissions. There should be no reason why this isn't possible deploying by eclipse but if you want to test this, try it out deploying using the http://workbench.developerforce.com utility - just go to migration >> deploy to deploy your custom zip file.

One way to think of it is: managed components are owned by the ISV/package publisher, but since custom profiles and permission sets in your org are owned by you, you can always modify them (as long as you include the publisher namespace prefix in your deployment) including managed component permissions.

  • Thanks Adam, that's really helpful. Will do some testing and post back if I run into issues. Commented Nov 30, 2012 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .