Can I Mass Modify Object Settings > Tab Settings for All Profiles? (Default On/Default Off/Hidden)

Question

I am in the process of my first Salesforce deployment to Production (my company has been working with an implementation team for 7 months or so, and we are going live on Monday).

We had some security problems with a few Profiles and it was suggested to me from the third party who's objects I couldn't access that I create a new profile with higher access and gradually take away access as was necessary. Which - of course - worked, but now those profiles have access to a lot of objects that I want to be hidden.

Is there any way that I can massively update Object Settings for a Profile rather than going to each object one by one and editing it to change it to Hidden? This process is tedious and time consuming and I have 10 custom profiles - I'd love to hear options on a better way.

I am familiar with Data Loader and standard SQL so I'm sure I could leverage SOQL in some way if that's possible, but I can't find the right starting point.

Any help is appreciated.

Answer 1

There are several objects that you can utilize for mass updates of profiles and permission sets.

The objects are as follows:

• ObjectPermissions - Controls Object Level Create, Read, Edit, Delete, View All and Modify All permissions
• FieldPermissions - Controls field level security
• SetupEntityAccess - A special table that allows for controlling Visualforce Page, Apex Class, Connected Application and Application (Tab Set) access.

Unfortunately, at this time, RecordType access is not available in these objects.

For all of the above objects, you must use the PermissionSet ID for the parent ID field. You can use the below query for this (standard profiles are excluded since they aren't updateable for Object Level and FLS security - but can be used with SetupEntityAccess):

SELECT ID, Name, Profile.Name FROM PermissionSet WHERE IsCustom = true

If the permissions are existing on the objects, you can simply query the records that exist today using a tool like workbench to query / update (dataloader is an option too). If you use dataloader, you must check the box that says "View all objects" to see the above objects for query.

For SetupEntityAccess, you must first get the SetupEntityId of the record before you are able to perform an insert, e.x for visualforce pages:

SELECT Id FROM ApexPage

You may then map this to the SetupEntityId Field. You can then insert the records and you will have access to the record. If the record already exists and has access you will get a duplicate error from the system. If you are not familiar with the process, I would first suggest that you perform this activity in a sandbox and test all corresponding processes.

Answer 2

There is a sObject called PermissionSet which has a field IsOwnedByProfile which signified if the permission set is having the access settings for a profile or not. Every Profile has a permission set to define object accesses. Plus there is ObjectPermission sObject as well which holds the actual permissions for each Permission Sets.

So you can do something like this.

SELECT SObjectType, PermissionsRead, PermissionsCreate, PermissionsEdit,  FROM ObjectPermissions WHERE parentid in (select id from PermissionSet where PermissionSet.IsOwnedByProfile = true)

And form the update query accordingly.

Answer 3

SELECT Id,Name,ParentId,SystemModstamp,Visibility FROM PermissionSetTabSetting where Parent.Profileid='00000000000'

You can only manipulate the tab as long as it is Default On or Default Off. Download the results. Delete the rows that you want to keep.You will have list of records that you wanna remove. All you have to do is delete that record by Id.