UserAccessPolicy (Beta) | Metadata API Developer Guide

Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations.

Important

Parent Type

This type extends the Metadata metadata type and inherits its fullName field.

File Suffix and Directory Location

UserAccessPolicy components have the suffix .useraccesspolicy and are stored in the useraccesspolicies folder.

Version

UserAccessPolicy components are available in API version 57.0 and later.

Special Access Rules

To create or modify user access policies, users must have the Manage User Access Policies permission.

This feature is a Beta Service. Customer may opt to try such Beta Service in its sole discretion. Any use of the Beta Service is subject to the applicable Beta Services Terms provided at Agreements and Terms.

Note

Fields

Field Name	Description
booleanFilter	Field Type string Description Required. The logic that determines how your user criteria filters are applied in the user access policy. For example, if you have two user access policy filters with the sortOrder equal to `1` and `2`, respectively, the booleanFilter can be `1 AND 2` or `1 OR 2`.
description	Field Type string Description Description of the user access policy.
isProtected	Field Type boolean Description An auto-generated value that doesn’t impact the behavior of the metadata type. The default value is `false`.
masterLabel	Field Type string Description Required. A user-friendly name for the user access policy, which is defined when the user access policy is created.
status	Field Type UserAccessPolicyStatus (enumeration of type string) Description Required. The status of the user access policy. Values are: `Active` `Completed` `Design` `Failed` `Migrate` `Testing` `Updating`
triggerType	Field Type UserAccessPolicyTriggerType (enumeration of type string) Description The type of user record trigger for which this user access policy runs. Values are: `Create`—The user access policy runs when a user who matches the policy criteria is created. `CreateAndUpdate`—The user access policy runs when a user who matches the policy criteria is either created or updated. `Update`—The user access policy runs when a user who matches the policy criteria is updated.
userAccessPolicyActions	Field Type UserAccessPolicyAction[] Description The actions applied by the user access policy to grant access to or revoke access from an access mechanism.
userAccessPolicyFilters	Field Type UserAccessPolicyFilter[] Description The filters used to define the users that the user access policy is applied to.

UserAccessPolicyAction

Represents an action applied by a user access policy.

Field Name	Description
action	Field Type UserAccessPolicyActionType (enumeration of type string) Description Required. Indicates whether the user access policy grants or revokes the target access mechanism. Values are: `Grant` `Revoke`
target	Field Type string Description Required. Developer name of the access mechanism that the user access policy applies.
type	Field Type UserAccessPolicyActionTargetType (enumeration of type string) Description Required. The type of access mechanism that the user access policy applies. Values are: `Group` `PackageLicense` `PermissionSet` `PermissionSetGroup` `PermissionSetLicense` `Queue`

UserAccessPolicyFilter

Represents a user criteria filter for a user access policy.

Field Name	Description
columnName	Field Type string Description If type is set to `User`, this is the user field that your user criteria filter is based on. If you set type to any value other than `User`, then this field isn’t used.
operation	Field Type UserAccessPolicyFilterOperation (enumeration of type string) Description Required. The operator of the user criteria filter. Values are: `equals` `in`— Available in API version 58.0 and later. `not equal` Select `in` if you want to reference multiple profiles or roles in the same user criteria filter via the target field.
sortOrder	Field Type int Description Required. The numeric reference used to identify the specific user criteria filter.
target	Field Type string Description Required. If type is set to `User`, then set this field to `User` as well. If type is set to any other value, then set this field to the developer name of the specific resource used in the user criteria filter.
type	Field Type UserAccessPolicyFilterTargetType (enumeration of type string) Description Required. The type of resource that the user criteria filter is based on. Values are: `PackageLicense` `PermissionSet` `PermissionSetGroup` `PermissionSetLicense` `Profile` `User` `UserRole`
value	Field Type string Description If type is set to `User`, this field is the value of the user field specified in columnName that your user filter is operating on. If you set type to any value other than `User`, then this field isn’t used.

Declarative Metadata Sample Definition

The following is an example of a UserAccessPolicy component.

1<?xml version="1.0" encoding="UTF-8"?>
2<UserAccessPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
3    <booleanFilter>1 AND 2</booleanFilter>
4    <description>Policy to assign Sales Rep PSG to active Sales Reps.</description>
5    <masterLabel>Sales Rep Migration</masterLabel>
6    <status>Active</status>
7    <triggerType>CreateAndUpdate</triggerType>
8    <userAccessPolicyActions>
9        <action>Grant</action>
10        <target>SalesRepPSG</target>
11        <type>PermissionSetGroup</type>
12    </userAccessPolicyActions>
13    <userAccessPolicyFilters>
14        <operation>equals</operation>
15        <sortOrder>1</sortOrder>
16        <target>SalesRepCustomProfile</target>
17        <type>Profile</type>
18    </userAccessPolicyFilters>
19    <userAccessPolicyFilters>
20        <columnName>IsActive</columnName>
21        <operation>equals</operation>
22        <sortOrder>2</sortOrder>
23        <target>User</target>
24        <type>User</type>
25        <value>true</value>
26    </userAccessPolicyFilters>
27</UserAccessPolicy>

To reference multiple profiles or roles, in UserAccessPolicyFilter, set the operator field to in. Then, reference the resources’ developer names in the target field, separated by commas.

1<?xml version="1.0" encoding="UTF-8"?>
2<UserAccessPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
3    <booleanFilter>1</booleanFilter>
4    <description>Policy to remove AMER Sales group from employees with one of two roles</description>
5    <masterLabel>Remove AMER Sales Group</masterLabel>
6    <status>Active</status>
7    <userAccessPolicyActions>
8        <action>Revoke</action>
9        <target>AMERSalesPublicGroup</target>
10        <type>Group</type>
11    </userAccessPolicyActions>
12    <userAccessPolicyFilters>
13        <operation>in</operation>
14        <sortOrder>1</sortOrder>
15        <target>SalesOps,InsideSalesRep</target>
16        <type>UserRole</type>
17    </userAccessPolicyFilters>
18</UserAccessPolicy>

The following is an example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>UserAccessPolicy</name>
6    </types>
7    <version>58.0</version>
8</Package>

Wildcard Support in the Manifest File

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.