Missing profile descriptions
Why is this an issue?
A profile controls what a user can see and do, and its name alone does not say why it grants the access it does. Without a description, working that out means reading through every permission the profile contains. Descriptions help administrators:
Pick the right profile when setting up a new user
Tell similar profiles apart during an access review
Examples
Example of incorrect metadata:
<Profile>
<custom>true</custom>
<userLicense>Salesforce</userLicense>
</Profile>
Example of correct metadata:
<Profile>
<custom>true</custom>
<description>Grants the regional sales team read and edit access to Accounts, without delete rights.</description>
<userLicense>Salesforce</userLicense>
</Profile>
How can I fix violations?
Add a description saying who the profile is for and what access it grants. Set it directly in the profile metadata:
<description>Grants the regional sales team read and edit access to Accounts, without delete rights.</description>
Profiles are also managed in Setup under Profiles, though which properties you can edit there depends on whether your org uses the enhanced profile user interface.
This rule only applies to custom profiles. Standard profiles, which have <custom>false</custom>, are skipped because you cannot edit them.
When should I disable this rule?
You may dismiss specific violations for profiles kept only for testing or migration.
Resources