Integrating SailPoint with Salesforce SaaS

SailPoint's Salesforce SaaS connector offers access management of Salesforce users. This integration with Salesforce gives you policy-based access controls so you can be sure only the right users can see and interact with critical information. This integration enables a deep level of access governance which not only allows you to manage internal users but also your public groups.

You can search for specific information about the requirements and field definitions needed to get a working instance of the Salesforce SaaS source in SailPoint. To manage the account data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Supported Managed Systems

The Salesforce SaaS connector supports:

• Salesforce CRM (sales-cloud)
• Salesforce API version 61

• Salesforce Hyperforce-enabled tenants

  For information on the permissions required to support Hyperforce tenants, refer to Salesforce Hyperforce Tenant User Access.

Prerequisites

• For External Client Application (ECA) authentication, install External Client Application from Salesforce AppExchange. For information, refer to Installing External Client Application.

For administrator rights and custom profile access on the Salesforce account, refer to required permissions.

Supported Features

The Salesforce SaaS connector supports the following features.

Account Management

• *Load and provision accounts
• *Access certifications (Certification of entitlements connected to accounts)
• Enable and disable accounts
• Password Management

• Add and remove associations of the following group objects with User objects:

  • PermissionSet
  • PermissionSetGroup
  • CollaborationGroups
  • PublicGroups
  • Role
  • PermissionSetLicense
  • ManagedPackage
  • DelegateGroup

• Create new Portal Users and Partner Users, and assign licenses

  Note

  Enabling and disabling portal and partner users is not supported.

Account - Group Management

• Aggregate collaboration groups as entitlements during account aggregation

• Aggregate collaboration groups as group objects

  Note

  If you enable or disable a user that has a collaboration group object assigned to it, Salesforce automatically removes it, but it won't update in the SailPoint user interface for that user. To correct this, run the Iterate the User process after the Enable/Disable operation is performed.

• Add or remove collaboration groups as entitlements

• Manages Salesforce profiles as account-groups
• Group aggregation
• Refresh groups

• Aggregate the following objects as group objects:

  • PermissionSet
  • PermissionSetGroup
  • PublicGroup

  • PermissionSetLicense

    Note

    Through certification, permission set licenses cannot be removed until associated permission sets are removed.

  • ManagedPackage

  • Role

    Note

    Includes the bidirectional role hierarchy at one level.

  • DelegateGroup

    Note

    DelegateGroup objects can be assigned to active (enabled) users.

Enhanced Domains

The Salesforce SaaS connector supports use with the Enhanced Domains feature.

Role Hierarchy Management

The Salesforce SaaS connector can manage a Role hierarchy in addition to the Role itself. Within the Salesforce system, Role hierarchies are used to extend record access automatically.

Pass-through Authentication

Pass-through authentication enables you to sign in to SailPoint using your Salesforce username and password. To use Pass-through authentication, you must use your Salesforce password and the security token appended to it.

Machine Identity Aggregation

Aggregation of Salesforce Agents during Machine Identity Aggregation.

Secrets and Non-Human Identity Discovery

Discovery of exposed credentials and non-human identities in the content of Salesforce records. The connector scans the following Salesforce objects:

• Case
• CaseComment
• EmailMessage
• FeedItem
• FeedComment
• ContentVersion
• ContentDocument
• Attachment

Activity Insights

Activity Insights supports activity from Salesforce and its associated accounts. This allows you to gather account information and activity data from Salesforce.

For more information on features, refer to Source Features.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.