A Script to Create a Modify All Data Permission Set

 If you follow the principle of least permissions -- and you should -- then it should make you cringe a bit to grant someone admin permission in production.

System Administrator allows anyone with that permission to pretty much do whatever they want. That cuts both ways, where it removes obstacles to people's day to day, but also creates risks for honest mistakes and even bad-actor behavior.

We're working on how to structure permission for our admins and devs so that they can do their day job, but remove permission to change metadata since that needs to go through DevOps.

Cloning the System Administrator Profile and removing "Customize Application" is a start. But as your org changes, you have to make sure that permissions are added to the cloned Profile as fields are created. Basically, we need a way to ensure "Modify All Data" includes permissions to all objects, fields, tabs, etc.

To facilitate this, as a little side project I've created an Apex class that will grant access to a given Permission Set to:

  • All objects (read or read/write)
  • All fields (read or read/write)
  • Apex classes
  • Apex pages (Visualforce)
  • Custom Apps
  • Record Types
  • Tabs

I designed it to be standalone so you can drop it in your sandbox and run it. You can run it on a new Permission Set or an existing one and it will add the missing permissions.

For more information, check it out on Github:

Click Here for the Github Project

Comments

Popular posts from this blog

Setting a DateTime to a Weekday in a Formula

"Disjunctions not supported" - Why Custom Metadata and Flow Don't Mix

Update Knowledge Articles in Bulk