Fix Missing FLS Permissions for Backup

Ensure your Salesforce Backup service can access all necessary data by fixing missing field-level security (FLS) permissions. Identify inaccessible data for your backup service's authenticated user and then update the user's permission set with the missing field permissions.

1. View the permission report in the application to see the field list and download the data as a Salesforce-compatible package.
   If the package download has failed, click on Analyze Permissions. This will run a Permission Report job. Once the job is complete, try to download the package again.
   • The downloaded package may include fields that are marked as excluded. You can remove these fields from the package by opening the package and removing them manually from the permission set file.
   • Read and Write permission will be assigned to all fields (for Backup and Restore).
2. Optional. Edit the Default Permission Sets when merging to an existing permission set is not required. If you want to continue with the default permissions, continue to Step 4.
   We use IntegrationUserMissingFields as the default name for the permission set. If you prefer a different name for the permission set, follow the instructions below.
   1. Download the SFDC Compatible Package from the permission report for the affected backup.
   2. Use a text editor to open the package.xml file within the downloads package.
   3. Replace the name: IntegrationUserMissingFields with the name you prefer for the permission set.
   4. In the permissionsets folder, rename the file IntegrationUserMissingFields.permissionset to the name that you prefer.
   5. Open the .permissionset file and replace the name IntegrationUserMissingFields with the permission set name that you prefer, within the 2 tags <label> ... </label>.
3. Optional. Edit the Default Permission Sets when merging to an existing permission set is required. If you want to continue with the default permissions, continue to Step 4.
   1. Complete Step 2.
   2. Select the Metadata backup for the specific service you wish to update.
   3. Access the most recent backup, then download the XML for permission sets by selecting the highlighted number next to permission sets.
   4. Open the downloaded zip file, and navigate to the permission sets folder.
   5. Open the .permissionset with the name you set in Step 2.
   6. Copy all <fieldPermissions> … </fieldPermissions> tags.
   7. Paste it to the .permissionset file from Step 2 at the end of the file, before <hasActivationRequired>false</hasActivationRequired><label>IntegrationUserMissingFields</label>
4. Compress the updated package.
5. Deploy with WorkBench.
   1. Login to your target organization.
   2. Click Migration Menu.
   3. Select Deploy.
   4. Choose the package zip file and select the following options:
      • Allow Missing Files
      • Single Package
6. Click Next and then Deploy.
   • When deploying to production, Rollback On Error must be selected. And the test level should be Run Specified test.
   • In order for the permission set to deploy to production, a test class that will run successfully must be used.
   • Further reading about adding a test class in Salesforce, see here.
   • The test class specified to run when deploying to production must run successfully. It is advised to select a class with a small size and to avoid test classes from managed packages.
   A success message will appear under the 'Results' when the package has been successfully deployed.
7. Assign the Permission Set to the Authenticated User. In Salesforce, assign the permission set to the authenticated user.
   1. Log in to Salesforce.
   2. Select Setup > Permission Set.
   3. Click the permission IntegrationUserMissingFields, then click Manage Assignments.
   4. Add the authenticated user to this permission set.
   5. After assigning the permission, validate the permissions worked by re-running the analyze permission job via Backup Services → Options → Analyze Profile Permissions.