activationUserGroupName not supported in sandbox definition file for `org create sandbox`

[thomasminney]

Summary

Spring '25 enforces specifying a group when creating a sandbox: https://help.salesforce.com/s/articleView?id=release-notes.rn_dev_environments_selective_access_changes.htm&release=252&type=5

In #3008 (released in 2.61.8), this was supported in the definition file with activationUserGroupName. When using this property in the definition file, I get error:

 "name": "UserGroupQueryFailedError",
  "message": "Unable to find the ID of the activation user group \"create_test\" that's defined in the definition file."

But when using the id of the same group with ActivationUserGroupId, the sandbox create request is accepted.

Steps To Reproduce

• Create a group called "create_test" in production org
• Copy id for the sandbox-def-id.json file content below
• Run sf command: sf org create sandbox --json --wait 6 --no-prompt --definition-file=sandbox-def-name.json --target-org <prod-org-alias>
• Observe error mentioned
• Run sf command: sf org create sandbox --json --wait 6 --no-prompt --definition-file=sandbox-def-id.json --target-org <prod-org-alias>
• Observe request accepted and sandbox gets provisioned

sandbox-def-id.json

{
    "autoActivate": true,
    "description": "Test sandbox for create with group",
    "licenseType": "DEVELOPER",
    "sandboxName": "TESTSBX",
    "templateId": "",
    "ActivationUserGroupId": "00G..."
}

sandbox-def-name.json

{
    "autoActivate": true,
    "description": "Test sandbox for create with group",
    "licenseType": "DEVELOPER",
    "sandboxName": "TESTSBX",
    "templateId": "",
    "activationUserGroupName": "create_test"
}

Expected result

Sandbox created and users in activation group have access

Actual result

Sandbox creation request is rejected and error is thrown

Additional information

System Information

cmd.exe

{
  "architecture": "win32-x64",
  "cliVersion": "@salesforce/cli/2.72.21",
  "nodeVersion": "node-v22.12.0",
  "osVersion": "Windows_NT 10.0.26100",
  "rootPath": "C:\\Users\\thomasminney\\AppData\\Roaming\\npm\\node_modules\\@salesforce\\cli",
  "shell": "cmd.exe",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.2.16 (core)",
    "@oclif/plugin-commands 4.1.15 (core)",
    "@oclif/plugin-help 6.2.20 (core)",
    "@oclif/plugin-not-found 3.2.33 (core)",
    "@oclif/plugin-plugins 5.4.24 (core)",
    "@oclif/plugin-search 1.2.17 (core)",
    "@oclif/plugin-update 4.6.21 (core)",
    "@oclif/plugin-version 2.2.19 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.29 (core)",
    "@oclif/plugin-which 3.2.23 (core)",
    "@salesforce/cli 2.72.21 (core)",
    "apex 3.6.8 (core)",
    "api 1.3.2 (core)",
    "auth 3.6.85 (core)",
    "community 3.2.22 (user) published 212 days ago (Sat Jun 22 2024) (latest is 3.3.8)",
    "data 4.0.1 (core)",
    "deploy-retrieve 3.17.0 (core)",
    "info 3.4.30 (core)",
    "limits 3.3.43 (core)",
    "marketplace 1.3.7 (core)",
    "org 5.2.16 (core)",
    "packaging 2.9.10 (core)",
    "schema 3.3.45 (core)",
    "settings 2.4.9 (core)",
    "signups 2.2.1 (user) published 282 days ago (Sat Apr 13 2024) (latest is 2.6.10)",
    "sobject 1.4.48 (core)",
    "telemetry 3.6.29 (core)",
    "templates 56.3.34 (core)",
    "trust 3.7.53 (core)",
    "user 3.6.5 (core)",
    "sfdx-git-delta 5.34.0 (user) published 369 days ago (Tue Jan 16 2024) (latest is 6.1.1)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[alan-morey]

@thomasminney If your group name create_test is the developer name, then I think you need to change that value to be the regular name value, since the lookup query is filtering on the Group.Name field not the Group.DeveloperName field.

See here: https://github.com/salesforcecli/plugin-org/blob/dff3976371863628bf8498b7de151eb44cf41fa4/src/shared/sandboxRequest.ts#L127-L134

@cristiand391 @soridalac Maybe that query should be querying on the DeveloperName field instead?

[soridalac]

@thomasminney I tried to reproduce the steps and mine is working fine. Can you try sf data query -q "select id from group where name = 'create_test'" -o <prod-org-alias>. Is it showing the output id or throwing an error?

@alan-morey thank you for your suggestions!

[thomasminney]

Thank you @alan-morey and @soridalac , I can confirm the query and the sandbox definition file work for me when using the group Name rather than DeveloperName, I wrongly assumed that the latter field would be the one that is used.

[soridalac]

Thank you @thomasminney for confirming and @alan-morey for clarify the issue!