I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go?

Let's suppose that our clients are using our MP v.1 (not published on AE). Then we create v.2 and submit it for security review (the app is going to be free of charge).

  1. Security review is successful. Will our already existing clients be able to upgrade their v.1 to v.2? Will they be visible in LMA?
  2. Security review fails. This article states that in this case:

"You cannot publish your application on the AppExchange or distribute it to any customers until all findings have been addressed and a follow-up review has been conducted."

Will v.1 keep working?

Thanks in advance

1 Answer 1


Managed packages are automatically upgradeable by nature. As far as I'm aware, there's no technological constraint that would prevent v2 from being installed by customers, or upgradeable by your v1 customers. However, without a successful security review, you will be restricted from making your package public on the AppExchange, which is your ultimate goal. Technically, your package is installable without a security review.

For example, if you had a single client that you built a custom package for, but wasn't meant for the public, you could give them a package that you could maintain for them. The upgrade process works normally, as does LMA.

However, without a successful security review, it won't be a no-limit app (each field, object, etc will count against that org's limit). It also won't be able to use the API for free like a security-reviewed app can, nor will you have access to subscriber login access.

  • Brian, thanks a lot for your answer. I've created managed packages before, but I am totally new to making them publically available. So, do I understand correctly, that v1 users will be able to update to v2 and will become visible in LMA (or wherever it is I see the list of subscribers) after that?
    – bananka
    May 21, 2015 at 14:49
  • P.S. will metadata API calls from Apex become unlimited as well? (mass layout update hits the limits pretty quickly :)
    – bananka
    May 21, 2015 at 14:52
  • 1
    Yes, they can always upgrade from one non-beta package to another non-beta package, without the blessing of a security review. ISV apps that use their "client id" get their own separate API limit. It's not unlimited, but it provides at least as many API calls as the client has at no cost.
    – sfdcfox
    May 21, 2015 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.