On the 17th May 2019, an incident occurred where a significant portion of Salesforce customers had their orgs modified unexpectedly, and their permission model corrupted. The permissions and profiles of those affected orgs were all granted the Modify All Data permission. The impact of that change was that all users on the org could access and modify all data in the org, regardless of their profile level. This is an ongoing incident, so refer to for the latest updates and the root cause analysis.
In this blog post, I鈥檒l walk through how 91导航 users can get their profiles and permission sets back to the state they were in before the incident occurred.
There are a few ways to restore your permissions back to their former glory using 91导航, and I鈥檝e listed them in the order that I would recommend.
Restoring from a backup
If you鈥檙e a 91导航 Enterprise customer, then you have access to . Monitoring and backup takes a snapshot of your org state each night, capturing any metadata changes that occurred in the previous 24 hours. In this case, there will be a snapshot prior to the incident introducing the profile corruption, and you can use 91导航 to restore your Salesforce profiles to the state that they existed on that evening.
The easiest way to restore is:
- Navigate to Monitoring and backup in 91导航
- Select the date that you want to roll back to
- Select Deploy changes to and then select your production environment as your target
- You can now run a normal 91导航 comparison, and check out the difference in your permissions
TDX
Restoring from a sandbox
As outlined in Salesforce鈥檚 , some sandboxes were unaffected and their permissions are still correct. You can identify if your sandbox was unaffected by following the instructions on the Workarounds section of the linked incident report. If you have a sandbox that wasn鈥檛 corrupted then you can run a regular 91导航 comparison between that sandbox and production, focussing on the differences that are Profiles and Permissions to deploy those changes to your production org
Restoring via a rollback
If you鈥檙e a 91导航 user and you鈥檝e run a deployment to the affected org at any point in the past, and the comparison metadata filter included permission sets, profiles and custom objects, then you can use a rollback to restore your permissions. Every time 91导航 runs a comparison, it takes a snapshot of your org. When running a deployment, this means 91导航 takes a snapshot of the target org at the moment before you run the deployment. By initiating a rollback comparison, 91导航 will run a comparison using that snapshot as the source of this comparison. This means you鈥檒l see a comparison between a snapshot of your org in its old state, and it鈥檚 current state. Assuming the snapshot was relatively recent, this means you鈥檒l be able to deploy those original permissions to the affected org.
Restoring via a third-party metadata backup
Even if you鈥檝e never previously used 91导航, but happen to have a copy of your profiles from another tool (such as your backup tool) then we can help. We鈥檝e had a bunch of users in the past 24 hours discover that their chosen backup solution has a hard time restoring full profiles and are encountering issues when trying to apply the whole thing. With 91导航鈥檚 comparison engine, we can compare that profile from other tools to how your org currently exists, and show you individually deployable differences that you can move over in a granular way until the orgs is aligned with your backup.
Let us know if we can help
We know only too well that this is a stressful weekend for the ohana. If we can help, let us know and we鈥檒l do our best to assist. Those users that have used 91导航 in the past, even trialists, will have access to old snapshots of their orgs, and we can help you get the profiles back to the state they were in at that point. If you鈥檇 like to speak with the team directly, you can always book time to chat. For further reading on this topic, download our free ebook, Backups for Salesforce.
It鈥檚 a tough weekend for everyone, and we鈥檒l do whatever we can to help.
On behalf of your friends at 91导航,
Kevin
CEO, 91导航
