# Configuring Aggregation

## Aggregation Settings

Define the scope of the records to fetch when aggregating user accounts and entitlements.

> [!NOTE]
>
> **Screenshot**
>
> [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/salesforce/saas/help/img/agg10.png>)](<https://documentation.sailpoint.com/connectors/salesforce/saas/help/img/agg10.png>)

1. (*Optional*) Select **Exclude Frozen Accounts** to exclude frozen user accounts. These accounts have the Salesforce attribute `IsFrozen` set to `true`.

   > **Note**
   >
   > To upgrade the existing source, you must add the account schema attribute `IsFrozen`.
2. (*Optional*) Select **Exclude Disabled Accounts** to aggregate only active accounts. This adds the following condition in the `where` clause of the search query for users:

   `AND user.IsActive = true`
3. (*Optional*) Select **Disable User Creation Email** to disable sending emails when a user is created.
4. (*Optional*) Select the **Create Contact on User Creation** option to enable the creation of new Salesforce contacts at the same time you create new users. The newly created contacts use the same attribute data provided for the new users as applicable.

   > **Note**
   >
   > SailPoint only supports simultaneous contact creation during user creation at this time. Simultaneous contact updates and deletions during user updates or deletions aren't supported.

   Afterward, if you want to add a new attribute for a contact that is also available as a user attribute, add the following entry key into the source XML:

   ```xml
   <entry key="contactAttributes">
       <value>
           <List>
               <String>Custom_Attribute</String>
               <String>NewAttribute</String>
           </List>
       </value>
   </entry>
   ```

   Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>) for more information.
5. Enter the **Page Size**, which is the number of records to aggregate in a single page when iterating over large datasets. *Default: 2000 records*
6. Enter the scope of the users that are retrieved during Account or Entitlement aggregation in **Search Query for Users**.

   For more information, refer to [Search Query for Users and Profiles](<#search-query-for-users-and-profiles>).
7. Enter the scope of the profiles that are retrieved during account or entitlement aggregation in **Search Query for Profiles**.

   For more information, refer to [Search Query for Users and Profiles](<#search-query-for-users-and-profiles>).
8. Enter the string for the public groups that are retrieved during account or entitlement aggregation in **Search String for Public Groups**.
9. Enter the string for the roles that are retrieved during account or entitlement aggregation in **Search String for Role**.
10. Enter the string for the permission sets that are retrieved during account or entitlement aggregation in **Search String for Permission Set**.
11. Select **Save**.

## Aggregating Only Active Users

The Salesforce SaaS source has an option to aggregate only active users.

To configure the Salesforce SaaS source to only aggregate active accounts:

1. In the Salesforce, go to the **Aggregation Filters** panel.
2. Check the **Exclude Disabled Accounts** box.

## Search Query for Users and Profiles

Configure the search queries for users and profiles in the Salesforce SaaS source.

On the Salesforce UI, in the **Aggregation Filter** panel, in the **Search Query for Users** field enter the scope of the users that are retrieved during Account or Entitlement aggregation.

In the **Search Query for Profiles** field, enter the scope of the profiles that are retrieved during account or entitlement aggregation.

For instance, specifying the following search query, retrieves only active users during account aggregation:

`select Id from User where IsActive = true`

The scope users or profiles retrieved during aggregation can be defined using custom attributes in the `where` clause, as follows:

`select Id from Profile where Name = xyz`

> [!NOTE]
>
> - The Salesforce SaaS source escapes special characters such as `<`, `>`, and `&` in a search query string and in entitlement provisioning.
> - Only the `where` clause of the search query can be modified per the requirement.
> - When **Exclude Disabled Account** is enabled, the connector adds the following condition in the `where` clause of Search Query for Users:
>
>   `AND user.IsActive = true`
> - If the where clause contains an apostrophe ('), use a backslash (\\) prefix to escape it. For example:
>
>   `Find Id,username from user where lastname is buru'4`
>
>   `Expected Query: Select Id,username from user WHERE lastname ='buru\'4'`
> - If **Manage Active Accounts** is selected, the connector adds the same `AND user.IsActive = true` condition into the `where` clause of the user search query.