Hello, is it possible to have sdf use a custom role for deployment instead of the developer role? we want to prevent the service user from being able to login through the UI

Yes, this is possible, but there are some limitations. SDF itself does not require the Administrator or Developer role specifically. The deployment user can use a custom role as long as that role has all the required permissions for SDF deployment, SuiteCloud CLI, and the objects being deployed.

thanks

with a big caveat for deploying workflows though, anyone encounter this issue? I mean usually you also need elevated permissions on the workflow subtype too and since workflows operate on a wide range of subtypes you find yourself adding lots of permissions

Yes, this is a common pain point with workflow deployments. The workflow permission alone is usually not enough; the deployment role also needs access to the underlying record types/subtypes. Since workflows can touch many records, the deployment role can grow quite large. A dedicated SDF deployment role is usually the cleanest approach.

Some level of File Cabinet access is required as well if I remember. It's been awhile since we set this up.

what about giving the deployment role administrator access? what is best practices there