# Integrating SailPoint with Salesforce SaaS SailPoint's Salesforce SaaS connector offers access management of Salesforce users. This integration with Salesforce gives you policy-based access controls so you can be sure only the right users can see and interact with critical information. This integration enables a deep level of access governance which not only allows you to manage internal users but also your public groups. You can search for specific information about the requirements and field definitions needed to get a working instance of the Salesforce SaaS source in SailPoint. To manage the account data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Managed Systems The Salesforce SaaS connector supports: - Salesforce CRM (sales-cloud) - Salesforce API version 61 - Salesforce Hyperforce-enabled tenants For information on the permissions required to support Hyperforce tenants, refer to [Salesforce Hyperforce Tenant User Access](). > [!NOTE] > > Secrets and non-human identity discovery requires Salesforce API version 61 or later. On earlier versions, the connector cannot read the `EmailMessage` body fields that Enhanced Email introduced, and those records are skipped during a scan. ## Prerequisites - For External Client Application (ECA) authentication, install External Client Application from Salesforce AppExchange. For information, refer to [Installing External Client Application](). For administrator rights and custom profile access on the Salesforce account, refer to [required permissions](). ## Supported Features The Salesforce SaaS connector supports the following features. > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must first activate the feature for you. ### Account Management - \*Load and provision accounts - \*Access certifications (Certification of entitlements connected to accounts) - Enable and disable accounts - Password Management - Add and remove associations of the following group objects with User objects: - `PermissionSet` - `PermissionSetGroup` - `CollaborationGroups` - `PublicGroups` - `Role` - `PermissionSetLicense` - `ManagedPackage` - `DelegateGroup` - Create new Portal Users and Partner Users, and assign licenses > **Note** > > Enabling and disabling portal and partner users is not supported. ### Account - Group Management - Aggregate collaboration groups as entitlements during account aggregation - Aggregate collaboration groups as group objects > **Note** > > If you enable or disable a user that has a collaboration group object assigned to it, Salesforce automatically removes it, but it won't update in the SailPoint user interface for that user. To correct this, run the **Iterate the User** process after the Enable/Disable operation is performed. - Add or remove collaboration groups as entitlements - Manages Salesforce profiles as account-groups - Group aggregation - Refresh groups - Aggregate the following objects as group objects: - `PermissionSet` - `PermissionSetGroup` - `PublicGroup` - `PermissionSetLicense` > **Note** > > Through certification, permission set licenses cannot be removed until associated permission sets are removed. - `ManagedPackage` - `Role` > **Note** > > Includes the bidirectional role hierarchy at one level. - `DelegateGroup` > **Note** > > DelegateGroup objects can be assigned to active (enabled) users. ### Enhanced Domains The Salesforce SaaS connector supports use with the Enhanced Domains feature. ### Role Hierarchy Management The Salesforce SaaS connector can manage a Role hierarchy in addition to the Role itself. Within the Salesforce system, Role hierarchies are used to extend record access automatically. ### Pass-through Authentication Pass-through authentication enables you to sign in to SailPoint using your Salesforce username and password. To use Pass-through authentication, you must use your Salesforce password and the security token appended to it. ### Machine Identity Aggregation Aggregation of Salesforce Agents during Machine Identity Aggregation. > [!NOTE] > > Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. > > For more information, refer to [SailPoint Agentic Fabric](). ### Secrets and Non-Human Identity Discovery Discovery of exposed credentials and non-human identities in the content of Salesforce records. The connector scans the following Salesforce objects: - `Case` - `CaseComment` - `EmailMessage` - `FeedItem` - `FeedComment` - `ContentVersion` - `ContentDocument` - `Attachment` > [!IMPORTANT] > > This feature requires a separate SailPoint Agentic Fabric license. Contact your Customer Success Manager (CSM) for more information. > [!NOTE] > > This feature requires object, field, and system permissions in addition to the permissions required for identity and access management. Refer to [Required Access for Secrets and Non-Human Identity Discovery]() for more information. ### Activity Insights Activity Insights supports activity from Salesforce and its associated accounts. This allows you to gather account information and activity data from Salesforce. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings. For more information on features, refer to [Source Features](). ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview]().