--- schema_version: "1" id: 1bbbe929f8554b37d3f94d1841d7c4cfc0da9942a54a8806496f4a3ef04a9eef title: UserAccessPolicy collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/api_meta/meta_useraccesspolicy.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_useraccesspolicy.htm source_site: developer.salesforce.com content_type: documentation content_hash: 8c6ec283556cfc116c977380fb4b775eb05067c1b9cb709a7c535a444062a95e description: Represents a user access policy. --- # UserAccessPolicy Represents a user access policy. ![Important](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/images/icon_note_important.png) #### Important Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations. ## Parent Type This type extends the [Metadata](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/metadata.htm "The base class for all metadata types. You can’t edit this object. A component is an instance of a metadata type.") metadata type and inherits its fullName field. ## File Suffix and Directory Location UserAccessPolicy components have the suffix .useraccesspolicy and are stored in the useraccesspolicies folder. ## Version UserAccessPolicy components are available in API version 57.0 and later. ## Special Access Rules To create or modify user access policies, users must have the Manage User Access Policies permission. ## Fields | Field Name | Description | | --- | --- | | booleanFilter | Field Type string Description Required. The logic that determines how your user criteria filters are applied in the user access policy. For example, if you have two user access policy filters with the sortOrder equal to 1 and 2, respectively, the booleanFilter can be 1 AND 2 or 1 OR 2. | | description | Field Type string Description Description of the user access policy. | | isProtected | Field Type boolean Description An auto-generated value that doesn’t impact the behavior of the metadata type. The default value is false. | | masterLabel | Field Type string Description Required. A user-friendly name for the user access policy, which is defined when the user access policy is created. | | order | Field Type int Description Indicates the order for which active policy is applied when a user meets the criteria for multiple policies. Must be an integer from 0 to 10,000. Only the active policy with the lowest order value is applied. This field is required only if the status field is set to Active. Available in API version 61.0 and later. | | status | Field Type UserAccessPolicyStatus (enumeration of type string) Description Required. The status of the user access policy. Values are: - Active - Completed - Design - Failed - Migrate - Testing - Updating If you deploy a policy with a status of Active, the status is changed to Design. A Salesforce admin can then set the status to Active by automating the policy in Setup. | | triggerType | Field Type UserAccessPolicyTriggerType (enumeration of type string) Description The type of user record trigger for which this user access policy runs. Values are: - Create—The user access policy runs when a user who matches the policy criteria is created. - CreateAndUpdate—The user access policy runs when a user who matches the policy criteria is either created or updated. - Update—The user access policy runs when a user who matches the policy criteria is updated. | | userAccessPolicyActions | Field Type [UserAccessPolicyAction\[\]](#UserAccessPolicyAction) Description The actions applied by the user access policy to grant access to or revoke access from an access mechanism. | | userAccessPolicyFilters | Field Type [UserAccessPolicyFilter\[\]](#UserAccessPolicyFilter) Description The filters used to define the users that the user access policy is applied to. | ## UserAccessPolicyAction Represents an action applied by a user access policy. | Field Name | Description | | --- | --- | | action | Field Type UserAccessPolicyActionType (enumeration of type string) Description Required. Indicates whether the user access policy grants or revokes the target access mechanism. Values are: - Grant - Revoke | | target | Field Type string Description Required. Developer name of the access mechanism that the user access policy applies. | | type | Field Type UserAccessPolicyActionTargetType (enumeration of type string) Description Required. The type of access mechanism that the user access policy applies. Values are: - Group - PackageLicense - PermissionSet - PermissionSetGroup - PermissionSetLicense - Queue | ## UserAccessPolicyFilter Represents a user criteria filter for a user access policy. | Field Name | Description | | --- | --- | | columnName | Field Type string Description If type is set to User, this is the user field that your user criteria filter is based on. If you set type to any value other than User, then this field isn’t used. | | operation | Field Type UserAccessPolicyFilterOperation (enumeration of type string) Description Required. The operator of the user criteria filter. Values are: - equals - equalsIgnoreCase—Available in API version 59.0 and later. - in— Available in API version 58.0 and later. - includes—Available in API version 59.0 and later. - notEquals Select in if you want to reference multiple profiles or roles in the same user criteria filter via the target field. | | sortOrder | Field Type int Description Required. The numeric reference used to identify the specific user criteria filter. | | target | Field Type string Description Required. If type is set to User, then set this field to User as well. If type is set to any other value, then set this field to the developer name of the specific resource used in the user criteria filter. | | type | Field Type UserAccessPolicyFilterTargetType (enumeration of type string) Description Required. The type of resource that the user criteria filter is based on. Values are: - Group - PackageLicense - PermissionSet - PermissionSetGroup - PermissionSetLicense - Profile - Queue - User - UserRole | | value | Field Type string Description If type is set to User, this field is the value of the user field specified in columnName that your user filter is operating on. If you set type to any value other than User, then this field isn’t used. | ## Declarative Metadata Sample Definition The following is an example of a UserAccessPolicy component. 1 AND 2 Policy to assign Sales Rep PSG to active Sales Reps. Sales Rep Migration 3 Design CreateAndUpdate Grant SalesRepPSG PermissionSetGroup equals 1 SalesRepCustomProfile Profile IsActive equals 2 User User true To reference multiple profiles or roles, in UserAccessPolicyFilter, set the operator field to in. Then, reference the resources’ developer names in the target field, separated by commas. 1 Policy to remove AMER Sales group from employees with one of two roles Remove AMER Sales Group Design Revoke AMERSalesPublicGroup Group in 1 SalesOps,InsideSalesRep UserRole The following is an example package.xml that references the previous definition. \* UserAccessPolicy 61.0 ## Wildcard Support in the Manifest File This metadata type supports the wildcard character \* (asterisk) in the package.xml manifest file. For information about using the manifest file, see [Deploying and Retrieving Metadata with the Zip File](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/file_based_zip_file.htm "The deploy() and retrieve() calls are used to deploy and retrieve a .zip file. Within the .zip file is a project manifest (package.xml) that lists what to retrieve or deploy, and one or more XML components that are organized into folders.").