Understand Permission Set Deployments

Permission Set deployments used to be quite tricky in the past. Fortunately, with the changes introduced since Salesforce API version 40.0, deploying permission sets has become much simpler.

What was changed in API 40.0

Let’s take a look the exact changes announced according to: https://help.salesforce.com/articleView?id=changesets_perm_sets_profiles.htm&type=5

In API version 40.0 and later, when you deploy the output of a retrieval to another org, the metadata in the deployment replaces the target org metadata. In API version 39.0 and earlier, when you deploy your retrieved permission set output to another org, the deployment contents are merged with your current org data.

What exactly does the above mean ?

Permission Set deployment using API version 39 or earlier

Permission Set deployment using API version 40 or later

The above changes yield a number of important points:

1. Since version 40.0, permission set metadata is self contained and independent. Permission set deployments become more predictable and deterministic.
2. Since version 40.0, you can deploy permission sets without worrying about including other components. This applies to metadata API as well as change sets.
3. You should always retrieve and deploy using the same version. Never retrieve using version 39 and deploying using version 40 as this might cause your permission sets to be wiped out.
4. If you store metadata in source control, do not simply update package.xml to version 40. Make sure you re-pull permission set files using version 40.0 and commit to source control first.
5. When you retrieve permission set files using api version 40.0, if you include other objects and fields in package.xml as part of the retrieval request, the permission set files will contain the full permission set plus the false/disabled permissions related to the fields included in package.xml. Since the default value is false, you can safely ignore these false/disabled permissions. To keep thing clean and consistent, you should retrieve permission sets standalone without including other components in the same retrieve request.

Deploying Permission Sets using ClickDeploy.io

ClickDeploy.io makes deploying permission set so simple that you shouldn’t even need to know about any of the above nuisances. Simply select the Permission Sets and click deploy.

Diff reviewing is an important step, especially now that Permission Set deployment is a complete overwrite. Make sure you spend some time reviewing the diff before clicking deploy.