Field-Level Security (FLS) is a cornerstone of Salesforce permissions, giving you the ability to control which users can view or edit specific fields on objects. But as many Salesforce professionals know, deploying FLS permissions can be a daunting process. In this post, we’ll walk you through what FLS is, the challenges of managing and deploying these permissions, and how Salto can simplify the process with its unique approach to permission management.

Field-Level Security (FLS) and Field Permissions

Salesforce is pushing to shift users from managing permissions on Profiles to managing them through Permission Sets and Permission Set Groups. This article shows how to manage FLS permissions using Salto. The same concepts and capabilities apply when you manage Filed Permissions through Salto.

Why deploying FLS permissions is challenging

Salesforce admins often face several challenges when managing and deploying FLS permissions:

• Complexity of permissions metadata: Managing Profiles and Permission Sets is cumbersome whether you work in the Salesforce UI or in XMLs. Scrolling to locate individual FLS changes is time-consuming and prone to error.
• Risk of overwriting changes: When deploying FLS permissions, you often end up moving entire Profiles or Permission Sets, which can inadvertently overwrite unrelated changes.
• Lack of granularity in native tools: Native deployment tools like Change Sets don’t let you isolate and deploy specific permissions, forcing admins to include everything in the package.

How Salto makes deploying FLS permissions easier

Salto’s approach to permission management brings unparalleled granularity, visibility and control to the process, transforming how Salesforce admins handle FLS and other permissions.

1. Explore fields and isolate their Field-Level Security permissions

Salto lets admins find fields (standard and custom) and see their specific FLS permissions. This allows admins to explore the field’s permissions and ensure they are configured correctly before deploying them.

2. Compare permissions across or within orgs

With Salto, you can compare FLS permissions across orgs (e.g., QA and production) or within a single org. This comparison view highlights:

• New, changed, or deleted FLS permissions
• Differences between Profiles and Permission Sets for the same field

By surfacing granular changes, Salto enables you to focus on specific updates without unintentionally deploying unrelated permissions.

3. Cherry-pick and deploy only what you need

Salto allows you to deploy individual FLS permissions as separate metadata components, avoiding the need to move entire Profiles or Permission Sets. Here’s how it works:

• When you add new Fields, Salto will identify its relevant Field Permissions, and will suggest you deploy them - and only them - as well. 
• When you change Field Permissions and want to deploy them to other orgs, you can select the specific FLS to include in the deployment while leaving other permissions unchanged.
• If you are deploying new Profiles or Permission Sets between un-aligned orgs, Salto will help you do that, without deployment failures or forcing you to align other misalignments in that deployment.

This granularity ensures your deployment is precise and avoids overwriting or missing critical permissions.

Step-by-Step: Deploying FLS Permissions with Salto

Here’s how Salto helps you deploy relevant Field Permissions when you add new Fields:

Step 1: Choose the Field you want to deploy

Start by choosing the Field you want to add, and only that. 

Salto will show you the Profiles that will be updated by adding that Field. Within these Profiles you can see that Salto treats different permissions as separate, standalone metadata components. This allows Salto to help you deploy all relevant Permissions, and only those.

Step 2: Validate your deployment package

Salto runs pre-deployment validations to identify any issues, such as missing dependencies or conflicts, ensuring your deployment is error-free. You can check that only the Fields and Permissions you want will be deployed.

Step 3: Deploy and confirm

Once validated, deploy your changes. Salto provides a deployment summary, so you can review what was updated and confirm the changes.

If you want to deploy changes you made to your Permissions to another org:

Step 1: Compare your orgs

Start by comparing your source and target environments and pick the element you changed. Salto highlights permissions differences in both Profiles/Permission Sets, allowing you to select the specific changes that need to be deployed.

Step 2: Select specific FLS changes

Use Salto’s no-cpde comparison to select the exact FLS permissions you want to deploy.

Step 3 and 4: Validate your deployment package and Deploy and confirm

Salto’s granular approach to permissions management solves key pain points for Salesforce admins:

• Precision: Deploy individual FLS permissions without moving unrelated changes.
• Clarity: Visualize all FLS dependencies and understand their impact.
• Efficiency: Save hours by isolating and deploying only the permissions you need.

If you want to try managing Salesforce permissions through Salto, you can check out the free trial here.