PortalDelegablePermissionSet in SFDX

Architectural Overview#

In multi-tier B2B architectures and Experience Cloud portals, delegated administration empowers external partner and customer super-users to administer accounts within their authorized hierarchy. Internal administrators cannot manually fulfill every user onboarding and permission assignment request across thousands of external partner organizations. However, granting external users broad administrative authority introduces severe security risks.

The PortalDelegablePermissionSet metadata type establishes a secure, bounded delegation model. It explicitly defines which PermissionSet metadata instances an external delegated administrator is authorized to assign to or revoke from other external users.

By maintaining PortalDelegablePermissionSet definitions in version control, enterprise architects guarantee that partner administration privileges remain strictly governed across scratch orgs, sandboxes, and production environments.

Directory and File Conventions#

In SFDX source format, PortalDelegablePermissionSet metadata resides in the portalDelegablePermissionSets/ directory.

Key Metadata Fields#

The XML structure of PortalDelegablePermissionSet references the target permission set and defines delegation bounds:

Declarative XML and Package Manifest Examples#

Below is an enterprise XML definition delegating a deal registration permission set to external partner administrators:

<?xml version="1.0" encoding="UTF-8"?>
<PortalDelegablePermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <permissionSet>Partner_Deal_Desk_Access</permissionSet>
</PortalDelegablePermissionSet>

Accompanying Permission Set Definition#

The referenced permission set must be explicitly restricted to external community user licenses:

<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <hasActivationRequired>false</hasActivationRequired>
    <label>Partner Deal Desk Access</label>
    <license>Partner Community</license>
    <objectPermissions>
        <allowCreate>true</allowCreate>
        <allowDelete>false</allowDelete>
        <allowEdit>true</allowEdit>
        <allowRead>true</allowRead>
        <modifyAllRecords>false</modifyAllRecords>
        <object>Opportunity</object>
        <viewAllRecords>false</viewAllRecords>
    </objectPermissions>
</PermissionSet>

Package Manifest (package.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Partner_Deal_Desk</members>
        <name>PortalDelegablePermissionSet</name>
    </types>
    <types>
        <members>Partner_Deal_Desk_Access</members>
        <name>PermissionSet</name>
    </types>
    <version>68.0</version>
</Package>

CLI Retrieval and Deployment Commands#

Manage PortalDelegablePermissionSet records via the Salesforce CLI (sf):

# Retrieve all delegable permission set configurations
sf project retrieve start --metadata PortalDelegablePermissionSet

# Deploy a specific delegable permission set with its target permission set
sf project deploy start --metadata "PortalDelegablePermissionSet:Partner_Deal_Desk" --metadata "PermissionSet:Partner_Deal_Desk_Access"

# Validate deployment into a target environment
sf project deploy validate --metadata PortalDelegablePermissionSet

Architect Best Practices and Gotchas#

• License Compatibility Constraints: The referenced PermissionSet must align with the external community license of the portal users. If the permission set includes system permissions reserved for standard internal users (such as ModifyAllData or ViewSetup), deployment will fail.
• Dependency Ordering in CI/CD: Always ensure the target PermissionSet is included in the same deployment or deployed prior to PortalDelegablePermissionSet.
• Audit Logging and Monitoring: In high-compliance environments, monitor SetupAuditTrail to track which partner administrators assign delegable permission sets to community users.

Frequently asked questions

What is the purpose of PortalDelegablePermissionSet in Salesforce?

It designates specific permission sets that delegated external portal administrators can assign to users within their Experience Cloud account hierarchy.

Where is PortalDelegablePermissionSet located in an SFDX source project?

Files are stored in force-app/main/default/portalDelegablePermissionSets/ with the suffix .portalDelegablePermissionSet-meta.xml.

Why does deploying PortalDelegablePermissionSet fail when referencing an internal permission set?

The target PermissionSet must only include permissions compatible with external portal user licenses; standard CRM admin permissions will trigger deployment errors.

How does PortalDelegablePermissionSet enhance enterprise security?

It enforces the principle of least privilege by restricting external partner administrators to assigning pre-approved, scoped permission sets.