Most of the configuration work around Subscribers happens on the Publisher side: setting up the License Management Application, building the package, and configuring the support console. The Subscriber side is comparatively light: install the package, grant the right people access, and grant login access to the Publisher's support team when needed. This guide covers the Subscriber-side workflow, since that is what most readers of a dictionary entry need to know on day one.
- Install the managed package from AppExchange
Find the package on AppExchange (or use the private install URL the Publisher provided). Click Get It Now and authenticate as a System Administrator. Pick the target environment (Production or Sandbox). Salesforce shows the components that will be installed and any pre-existing components that conflict. Review the list, choose the access level (Install for Admins Only is safer; Install for All Users is faster but risks giving access too broadly). Accept the terms and click Install. The install runs synchronously for small packages and asynchronously for larger ones, with an email notification when it completes.
- Assign permission sets and validate the install
Most managed packages ship with one or more permission sets that grant access to the package objects, fields, and Apex. After install, open Setup, Permission Sets, and assign the package permission sets to the users who need access. Without this step, even System Administrators may not see the package tabs and components. Validate the install by navigating to the package main tab as a target user, verifying records load, and confirming any package-provided automations fire as expected. Document the permission-set assignment process in the user onboarding playbook so new hires get the right access automatically.
- Grant login access to the Publisher for support
When you need Publisher-side support, open Setup, search Grant Login Access, find the Publisher's company name in the list, and grant access for a defined duration. Pick the shortest duration that fits your support need (1 day for a quick fix, 1 week for an investigation). Notify the Publisher's support contact that access has been granted. Revoke the access early if the issue resolves before the duration expires. Audit the access grant in your security log; access through this channel is logged with the Publisher user identity on every action they take.
- Monitor for upgrades and plan the upgrade window
Salesforce sends an email notification when the Publisher releases a new managed package version. The notification goes to the package install user by default, but most orgs route it to a shared inbox so package upgrades are not gated on one person mailbox. When a new version drops, read the Publisher release notes, install in sandbox first, validate that custom Apex extensions still compile, and schedule a production upgrade window. Patch versions are usually drop-in; major versions may need component reconfiguration. Document each upgrade in your change management log for audit and rollback planning.
- Managed package components are read-only in the Subscriber org. Apex classes, triggers, and Visualforce pages from the package cannot be edited; Subscriber extensions must live in unmanaged Apex that references package globals.
- Sandbox refreshes copy the installed package but create a new License record on the Publisher LMA. Coordinate with the Publisher when refreshing high-value sandboxes so license expectations stay in sync.
- Granting Login Access to the Publisher logs every action under the Publisher user identity. Audit the support session afterward to confirm the changes match the agreed scope before closing the ticket.
- Patch versions are drop-in; major versions can require manual reconfiguration. Read the Publisher release notes before installing, and always test upgrades in sandbox before production.
- Permission sets shipped by a package are not automatically assigned to users on install. Without explicit assignment, even System Administrators may see partial functionality and conclude the install failed.