DataMaskSettings Metadata Type in SFDX

Architectural Overview#

The DataMaskSettings metadata type controls organization-wide configuration for Salesforce Data Mask. While individual data obfuscation rules are defined within DataMaskPolicy records, DataMaskSettings establishes tenant-level execution parameters, automation flags, and administrative notification targets.

In modern enterprise DevOps pipelines, automating sandbox data sanitization is essential to maintaining zero-trust development environments. By enabling automatic execution flags via DataMaskSettings, platform teams guarantee that whenever a Full or Partial Copy Sandbox finishes refreshing from Production, Data Mask immediately initiates sanitization jobs prior to development team check-in, fulfilling compliance requirements under HIPAA, GDPR, and SOC 2.

Directory and File Conventions#

In SFDX source format, DataMaskSettings is managed under the settings/ directory:

Key Metadata Fields#

Declarative XML and Manifest Examples#

Source Format XML (DataMask.settings-meta.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<DataMaskSettings xmlns="http://soap.sforce.com/2006/04/metadata">
    <enableDataMask>true</enableDataMask>
    <enableAutoExecutionOnRefresh>true</enableAutoExecutionOnRefresh>
    <enableNotificationEmail>true</enableNotificationEmail>
    <notificationEmailRecipient>security-devops@example.com</notificationEmailRecipient>
</DataMaskSettings>

Manifest (package.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>DataMask</members>
        <name>Settings</name>
    </types>
    <version>68.0</version>
</Package>

Retrieval and Deployment Commands#

Use the Salesforce CLI to retrieve and deploy DataMaskSettings:

# Retrieve DataMask settings from an org
sf project retrieve start --metadata Settings:DataMask

# Deploy DataMask settings to target environment
sf project deploy start --metadata Settings:DataMask

Senior Architect Best Practices and Gotchas#

• Production Safe Settings: Even with enableAutoExecutionOnRefresh set to true, the Salesforce Data Mask platform engine includes hardcoded safety interlocks preventing execution inside Production organizations.
• Pair with CI/CD Sandbox Provisioning: Incorporate DataMaskSettings deployment in automated sandbox creation pipelines to ensure new non-production environments inherit enterprise compliance controls from day one.
• Audit Logging and Notification: Always configure notificationEmailRecipient to point to a centralized monitoring inbox or incident response webhook to verify that masking jobs complete without unhandled record lock timeouts.

Frequently asked questions

What parameters are controlled by DataMaskSettings?

It governs org-wide settings for Data Mask, including automatic sandbox execution triggers, completion alerts, and execution safety checks.

Where are DataMaskSettings files stored in an SFDX project?

They are stored in force-app/main/default/settings/ under the file name DataMask.settings-meta.xml.

Can DataMaskSettings trigger masking right after sandbox refresh?

Yes. Enabling post-refresh execution ensures masking policies run automatically before sandbox access is granted to developers.

How do you retrieve DataMaskSettings using the Salesforce CLI?

Execute sf project retrieve start with the metadata flag set to Settings:DataMask.