Loading

Deploy 'Profile Permission set' with Workbench

Publish Date: May 3, 2026
Description

Salesforce has multiple options to deploy profiles from one org to another. Changesets (come with limitations). Standard Objects are not supported with Change Sets.  So if the user is trying to migrate Profiles that have standard object permissions, Change Sets is not an option and would have to select one of the Metadata API deployment options (Workbench, Salesforce CLI, ANT Migration tool, and Visual Studio Code ).  Salesforce CLI, ANT, Visual Studio Code will need additional setup and configuration before you get started on deployment. This article details the steps that are specific to deploy 'Profile Permission set' using the Workbench tool.

**IMPORTANT: In order to deploy the profiles from one org to other via the available deployment tools, please work with your Admin or, Developer who is familiar with the deployment tools and best practices to avoid any disruptive changes.

Notes: Please refer to the Usage section in the document to learn about considerations for profile metadata. 

  • For example only user permissions, IP address ranges, and login hours are retrieved when you only include profiles in the package.xml.  For all the security settings to be included you have to refer the other metadata types in the retrieve request. 
  • Also the wildcard '*' on CustomObject does not match standard objects and aren't retrieved. We designed Profile metadata deployment to overlay the existing Profile settings in a target org. For example, if you disable permissions for a profile, the newly disabled permission information isn't exported. To force all Profile changes to deploy through metadata, including permission disablement, add code that explicitly indicates disabled permissions. For example, add the following code to the Profile metadata.xml file before deploying into a target org: <value>false</value>.

A walkthrough Video: Using Workbench to Get and Update Organization Metadata is available in the Additional Resources section. The video demonstrates how to navigate Workbench to retrieve and deploy org metadata.

Resolution

Step 1: Create a Package.xml Manifest

A package.xml manifest file tells Workbench which metadata components to retrieve. The following sample package.xml file retrieves profile permissions for the Account object, a specific Permission Set, and a named Profile. Replace PermissionSetName, ProfileName, and the API version (xx.0) with your actual values before using this file:          

<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
     <members>Account</members>
     <name>CustomObject</name>
    </types> 
     <members>PermissionSetName</members>
     <name>PermissionSet</name>
    </types>     
    <types>
     <members>ProfileName</members>
     <name>Profile</name>
    </types>
    <version>xx.0</version>
</Package>


To include multiple objects, add additional member elements under the CustomObject type as shown below:

<types>
     <members>Account</members>
     <members>Case</members>
     <name>CustomObject</name>
</types> 

Note: The above package.xml is a sample only. The Salesforce package.xml Builder can help automate this process, but it is a publicly available tool and is not a Salesforce-approved tool.
To retrieve an existing package.xml manifest for all components in your org using Workbench: log in to your source org, select Environment (Prod/SBX), click Login to Salesforce with OAuth, and select All Components.

 

Step 2: Retrieve Metadata from the Source OrgRetrieve the metadata using Workbench:

  1. Log in to your source org from which you want to retrieve metadata.
  2. In a browser, go to https://workbench.developerforce.com/login.php.
  3. Select the latest API version and click Login with Salesforce.
  4. Navigate to Migration | Retrieve.
  5. Click Choose File and navigate to the package.xml file you created in Step 1.
  6. Select the Single Package checkbox.
  7. Click Next.
  8. Click Retrieve.
  9. After retrieval is complete, click the Download ZIP File link to save the metadata ZIP file.

 

Step 3: Deploy Metadata to the Target Org

  1. Log in to your target org where you want to deploy metadata.
  2. Use the 'Workbench' tool by entering the following URL in the browser: https://workbench.developerforce.com/login.php
  3. Navigate to Migration | Deploy.
  4. Select Choose File and find the ZIP file you just downloaded.
  5. Select the Allow Missing Files, Check Only and Single Package checkboxes. Note: 'Check Only' will do a Validation to see, if there are any Errors. If you see any errors, please fix them accordingly.
  6. Click Next.
  7. Click Deploy.
  8. If there are no errors in the Validation, then follow the steps from [3] to [5] again and this time DO NOT select Check Only check box. 
  9. Click Next.
  10. Click Deploy.
  11. When the deployment is finished, you can expand any of the nodes to find and resolve any errors and check your target org to ensure that the deployment was successful. 
Additional Resources

References:
Profile Metadata reference (with package.xml examples towards end)
mdapi commands

Knowledge Article Number

000384061

 
Loading
Salesforce Help | Article