UserAccessPolicy

Represents a user access policy.

This type extends Metadata and inherits its fields.

UserAccessPolicy components have the suffix .useraccesspolicy and are stored in the useraccesspolicies folder.

Introduced in API version 57.0.

To create or modify user access policies, users must have the Manage User Access Policies permission.

• Type: string
• Required: Yes
• Description: Required. The logic that determines how your user criteria filters are applied in the user access policy. For example, if you have two user access policy filters with the sortOrder equal to 1 and 2, respectively, the booleanFilter can be 1 AND 2 or 1 OR 2.

• Type: string
• Required: No
• Description: Description of the user access policy.

• Type: boolean
• Required: No
• Description: An auto-generated value that doesn’t impact the behavior of the metadata type. The default value is false.

• Type: string
• Required: Yes
• Description: Required. A user-friendly name for the user access policy, which is defined when the user access policy is created.

• Type: int
• Required: No
• Description: Indicates the order for which active policy is applied when a user meets the criteria for multiple policies. Must be an integer from 0 to 10,000. Only the active policy with the lowest order value is applied. This field is required only if the status field is set to Active.

• Type: UserAccessPolicyStatus (enumeration of type string)

• Required: Yes

• Description: Required. The status of the user access policy.

  Values are:

  If you deploy a policy with a status of Active, the status is changed to Design. A Salesforce admin can then set the status to Active by automating the policy in Setup.

• Possible values:

  • Active
  • Completed
  • Design
  • Failed
  • Migrate
  • Testing
  • Updating

• Type: UserAccessPolicyTriggerType (enumeration of type string)

• Required: No

• Description: The type of user record trigger for which this user access policy runs.

  Values are:

• Possible values:

  • Create — The user access policy runs when a user who matches the policy criteria is created.
  • CreateAndUpdate — The user access policy runs when a user who matches the policy criteria is either created or updated.
  • Update — The user access policy runs when a user who matches the policy criteria is updated.

• Type: UserAccessPolicyAction[]
• Required: No
• Description: The actions applied by the user access policy to grant access to or revoke access from an access mechanism.

• Type: UserAccessPolicyFilter[]
• Required: No
• Description: The filters used to define the users that the user access policy is applied to.

Represents an action applied by a user access policy.

• Type: UserAccessPolicyActionType (enumeration of type string)

• Required: Yes

• Description: Required. Indicates whether the user access policy grants or revokes the target access mechanism.

  Values are:

• Possible values:

  • Grant
  • Revoke

• Type: string
• Required: Yes
• Description: Required. Developer name of the access mechanism that the user access policy applies.

• Type: UserAccessPolicyActionTargetType (enumeration of type string)

• Required: Yes

• Description: Required. The type of access mechanism that the user access policy applies.

  Values are:

• Possible values:

  • Group
  • PackageLicense
  • PermissionSet
  • PermissionSetGroup
  • PermissionSetLicense
  • Queue

Represents a user criteria filter for a user access policy.

• Type: string
• Required: No
• Description: If type is set to User, this is the user field that your user criteria filter is based on. If you set type to any value other than User, then this field isn’t used.

• Type: UserAccessPolicyFilterOperation (enumeration of type string)

• Required: Yes

• Description: Required. The operator of the user criteria filter.

  Values are:

  Select in if you want to reference multiple profiles or roles in the same user criteria filter via the target field.

• Possible values:

  • equals
  • equalsIgnoreCase — Available in API version 59.0 and later.
  • in — Available in API version 58.0 and later.
  • includes — Available in API version 59.0 and later.
  • notEquals

• Type: int
• Required: Yes
• Description: Required. The numeric reference used to identify the specific user criteria filter.

• Type: string
• Required: Yes
• Description: Required. If type is set to User, then set this field to User as well. If type is set to any other value, then set this field to the developer name of the specific resource used in the user criteria filter.

• Type: UserAccessPolicyFilterTargetType (enumeration of type string)

• Required: Yes

• Description: Required. The type of resource that the user criteria filter is based on.

  Values are:

• Possible values:

  • Group
  • PackageLicense
  • PermissionSet
  • PermissionSetGroup
  • PermissionSetLicense
  • Profile
  • Queue
  • User
  • UserRole

• Type: string
• Required: No
• Description: If type is set to User, this field is the value of the user field specified in columnName that your user filter is operating on. If you set type to any value other than User, then this field isn’t used.

The following is an example of a UserAccessPolicy component.

1<?xml version="1.0" encoding="UTF-8"?>
2<UserAccessPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
3    <booleanFilter>1 AND 2</booleanFilter>
4    <description>Policy to assign Sales Rep PSG to active Sales Reps.</description>
5    <masterLabel>Sales Rep Migration</masterLabel>
6    <order>3</order>
7    <status>Design</status>
8    <triggerType>CreateAndUpdate</triggerType>
9    <userAccessPolicyActions>
10        <action>Grant</action>
11        <target>SalesRepPSG</target>
12        <type>PermissionSetGroup</type>
13    </userAccessPolicyActions>
14    <userAccessPolicyFilters>
15        <operation>equals</operation>
16        <sortOrder>1</sortOrder>
17        <target>SalesRepCustomProfile</target>
18        <type>Profile</type>
19    </userAccessPolicyFilters>
20    <userAccessPolicyFilters>
21        <columnName>IsActive</columnName>
22        <operation>equals</operation>
23        <sortOrder>2</sortOrder>
24        <target>User</target>
25        <type>User</type>
26        <value>true</value>
27    </userAccessPolicyFilters>
28</UserAccessPolicy>

To reference multiple profiles or roles, in UserAccessPolicyFilter, set the operator field to in. Then, reference the resources’ developer names in the target field, separated by commas.

1<?xml version="1.0" encoding="UTF-8"?>
2<UserAccessPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
3    <booleanFilter>1</booleanFilter>
4    <description>Policy to remove AMER Sales group from employees with one of two roles</description>
5    <masterLabel>Remove AMER Sales Group</masterLabel>
6    <status>Design</status>
7    <userAccessPolicyActions>
8        <action>Revoke</action>
9        <target>AMERSalesPublicGroup</target>
10        <type>Group</type>
11    </userAccessPolicyActions>
12    <userAccessPolicyFilters>
13        <operation>in</operation>
14        <sortOrder>1</sortOrder>
15        <target>SalesOps,InsideSalesRep</target>
16        <type>UserRole</type>
17    </userAccessPolicyFilters>
18</UserAccessPolicy>

The following is an example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>UserAccessPolicy</name>
6    </types>
7    <version>61.0</version>
8</Package>

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.