Permissions required to deploy Data 360 metadata

Salesforce Data 360 introduces a set of metadata types that allow teams to manage their data model, insights, and segmentation. To deploy these metadata components successfully, specific Salesforce permissions and Data 360 setup steps are required.

This document outlines the minimum permissions, recommended permission sets, and environment prerequisites at the time of writing.

User permissions for Metadata Deployment

The user performing the deployment (often an Integration User or System Administrator) must have the following core permissions enabled on their Profile or an assigned Permission Set:

Permission Name	Category	Purpose
API Enabled	Administrative	Required to access the Metadata API, which all modern deployment tools utilize.
View Setup and Configuration	Administrative	Required to retrieve and view metadata components in the setup environment.
Modify Metadata Through Metadata API Functions	Administrative	Required for deploying metadata changes. This ensures the user has permission to write and modify configuration components.
Customize Application	Administrative	Often a dependency for other key metadata permissions.
Data Cloud Architect	Permission set	Grants access to all Data 360 functionality, including Data Cloud Setup, mapping data to the data model, data streams, identity resolution rulesets, and insights. Salesforce renamed this permission set from Data Cloud Admin in September 2025.
Data Cloud	Permission Set License	Required to grant Data Cloud permission sets. Added automatically by Salesforce when adding Data Cloud Architect permission sets to a user, and cannot be removed until the relevant permission sets are also removed

Salesforce owns the Data 360 permission sets and changed them in late 2025:

Data Cloud Admin is now called Data Cloud Architect.
Data Cloud Activation Manager and Data Cloud Activation Specialist are new.
Data Cloud Marketing Admin, Data Cloud Data Aware Specialist, Data Cloud Marketing Manager, and Data Cloud Marketing Specialist are marked legacy.

The permission sets keep their Data Cloud names even though the product is now called Data 360. For the current list, see Salesforce's Data 360 Standard Permission Sets.

Permissions for data ingestion (source org access)

If the Data 360 components being deployed include Data Streams that connect to a Salesforce org (the source), the user running the Data 360 Salesforce Connector must have adequate access to read the source data.

Salesforce creates the Data Cloud Salesforce Connector permission set in the source org when you connect that org to Data 360. To ingest data, that permission set needs View All Records and View All Fields on the objects and fields you're ingesting:

Object Permissions: Read and View All Records access on every custom and standard object being ingested.
Field Permissions: Read Access enabled for every field on the ingested objects that is mapped into Data 360.

Deployment best practices for Data 360

Data 360 deployments involve moving specialized metadata types and require specific considerations:

1. Use permission sets over profiles

Due to the strict and sometimes incompatible deployment rules for Data 360 permissions via the Metadata API (especially for components like Datastream, DataStreamDefinition, etc.), it is strongly recommended to manage all Data 360-related user access using Permission Sets and Permission Set Groups. Many Data 360 permissions cannot be deployed on a Profile.

2. Utilize Data Kits (DevOps Data Kits)

Salesforce recommends using DevOps Data Kits for Data 360 deployments. A Data Kit bundles all related metadata (Data Streams, DMOs, Calculated Insights, Segments) and automatically tracks the necessary deployment sequence, significantly reducing dependency errors.

3. Manual prerequisite: Data Spaces

The Metadata API cannot deploy Data Space definitions. Before deploying any metadata that belongs to a Data Space:

Ensure the target Data 360 org has the exact same Data Space created.
Ensure the Data Space prefix is identical in both the source and target environments.

4. Critical deployment sequence (if using Direct Deploy)

Data 360 components have strict dependencies. Data Kits manage this automatically, and Gearset applies that auto-sequencing as part of the deployment process. If you are using Gearset's Direct Deploy feature to deploy individual components, then you should be aware of the sequence of those dependencies:

Data Streams (Source connections)
Data Model Objects (DMOs)
Identity Resolution Rules
Calculated Insights (must deploy DMOs first)
Segments (must deploy DMOs and CIs first)
Activations (must deploy Segments first)