9

Can including a profile in a changeset remove a permission/FLS?

This is one thing I have always been hazy on, but I believe when we include a profile in a change set it only makes changes to the profile based upon what is in the changset - is that correct?

I ask because I am moving a changeset over from a relatively old sandbox, it's quite possible changes have been made to profiles within live that are not in this sandbox.

Update As crude/simple test I created a small change set with a new field (field 1) on a custom object and a profile from the old sandbox to a brand new sandbox (to replicate live). However I removed the read permission on a different field (field 2) on a different object for the same profile before adding it to the changeset. Checking the profile after it was applied shows that the profile still had access to field 2, only field 1 and it's FLS was added.

Improve this question

4 Answers 4

Reset to default
3

Yes, including a profile in a change set will move over all profile settings for the components that were added to it.

Improve this answer
3

Moving profile depends on difference of profile in Sandbox and the production.

If you are doing with continuous integration process then you can move profile by changeset.

To move profile with changeset you must have source profile same as target organisation and added new permissions and modified permissions. If there is some permission which is missing in source profile then there can be chances of unexpected behaviour. Login IP ranges, FLS can be reset by doing this. So, carefully examine permissions then deploy.

It is always preferred to make those changes live manually in production instead of changeset. It is difficult to know which access changed.

Improve this answer
2
  • 1
    This has been my approach in the past, mostly to paranoia, but Salesforce support have told me that it is for only for the components added but couldn't provide documentation explicitly stating this. The closest is help.salesforce.com/apex/…
    – Girbot
    Sep 25, 2014 at 9:56
  • Review of profiles should be done. But in case of full sandbox there are negligible chances of unexpected behaviour. Full sandbox is mirror of production. @girbot
    – Ashwani
    Sep 25, 2014 at 10:07
0

I believe that the answer given by Robin and Ashwani holds good even for the permission set meaning including a permission set in a change set will move over all permission set settings for the components that were added to it. Am I correct?

Improve this answer
2
  • Mani, did you want to comment on an answer or post a new question ? Currently you've posted this as an answer while you aren't really providing more information.
    – Samuel De Rycke
    Nov 3, 2015 at 10:40
  • I want to comment on an answer Samuel, sorry for posting my earlier comments as an answer and since I don't have enough reputations, I am unable to do so!
    – Mani
    Nov 4, 2015 at 0:14
0

Another review point, when you load via changeset, in the destination org you can click on the profile in the changeset and you'll see the XML with specific changes it's pushing for that profile.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .