We have a 3rd party developer who should not have access to our production data.
Is it possible to create a profile where they can only deploy the incoming change sets they created on the lower environment? Or do they need access to the objects being updated?
If possible, what are the permissions/settings which need to be configured?
Without the "Modify All Data" permission, users won't be able to deploy changes to objects they don't have access to.
In Salesforce, deploying change sets typically requires broad access to both metadata and data, which includes the "Modify All Data" permission.
Granting the "Modify All Data" permission does provide broad access and essentially admin privileges, which may not be suitable for your scenario where you want to restrict access to production data.
