Salesforce SaaS Required Permissions

The administrator must have the appropriate rights on the Salesforce account to support user provisioning.

The System Administrator Profile can configure and customize the application. It contains the following permissions:

System administrator profile permissions
Has access to all functionality that does not require an additional license
Can create, edit, and delete custom profiles
Can reset the password of multiple user accounts
Can add multiple user accounts
Has access to all user accounts and profile permissions
Enable and disable user accounts

Profile Access to User Accounts

A user profile determines what a user can do in the system. By default, the System Administrator Profile can do the most; the Read Only Profile can do the least. For most users, the Standard User Profile is a good choice. It lets people create and edit most records, as well as access and run reports.

System Administrators can configure Users, Roles, and Profiles from the Setup area. To access these settings when signed in to Salesforce, select your name, and then select Setup from the drop-down menu. The Users, Roles, and Profiles settings are all available under Manage Users in the Administration Setup menu.

For more information on configuring a custom user profile to enable the connector to connect to the Salesforce managed system and manage the data within, refer to Required Access for Custom User Profiles.

User Licenses Create Access

Most of your users will need a standard Salesforce user license. This license gives the user full access to Salesforce's CRM features and applications, including Chatter. Other user license options limit user access.

Requested Scopes for Activity Insights

Activity Insights requests the following scopes from Salesforce:

Scope	Description
For Grant Type: Password
Manage user data via APIs (api)	Allows access to the current logged-in user's account using APIs such as REST API and Bulk API 2.0. This scope also includes `chatter_api`, which allows access to connect REST API resources.
For Grant Type: JWT and Refresh Token
Manage user data via APIs (api)	Allows access to the current logged-in user's account using APIs such as REST API and Bulk API 2.0. This scope also includes `chatter_api`, which allows access to connect REST API resources.
Perform requests at any time (refresh_token, offline_access)	Allows a refresh token to be returned when the requesting client is eligible to receive one. With a refresh token, the app can interact with the user's data while the user is offline. This token is synonymous with requesting `offline_access`.
For Grant Type: Client Credentials
Manage user data via APIs (api)	Allows access to the current logged-in user's account using APIs such as REST API and Bulk API 2.0. This scope also includes `chatter_api`, which allows access to connect REST API resources.

Note

Secrets and non-human identity discovery uses the same OAuth scopes listed above, but the service account requires additional object and system permissions. For more information, refer to Required Access for Secrets and Non-Human Identity Discovery.

Required Access for Custom User Profiles

SailPoint recommends that you use a System Administrator user profile to grant the Salesforce SaaS connector the minimum necessary access within the Salesforce managed system. However, if your organizational policies prohibit the use of a System Administrator user profile in this way, you can create a custom user profile for the connector to use instead.

Secrets and non-human identity discovery requires additional permissions, which are described in Required Access for Secrets and Non-Human Identity Discovery.

For identity and access management operations, the custom user profile must have full access to the following Salesforce objects at a minimum:

Note

The list of objects which require full access can vary for custom attributes, depending on how the attribute is defined. You may need to grant full access to additional Salesforce objects for custom attributes.

Accounts
Contact
CollaborationGroup
Group
Profile
PackageLicense
PermissionSet
PermissionSetAssignments
PermissionSetGroup
PermissionSetLicense
PermissionSetLicenseAssign
PublicGroups
Queues
Roles
User
UserLicense
UserPackageLicense
UserRole

Required Permissions for DelegateGroup

Configure the following permissions before you begin configuring DelegateGroup:

To manage delegated administration - Customize Application
To be a delegated administrator - View Setup and Configuration

Note

Delegated administrators can only manage user roles. Delegated administrators cannot create new user roles, copy existing roles, or delete existing roles.

Required Access for Secrets and Non-Human Identity Discovery

Secrets and non-human identity discovery scans the content of Salesforce records for exposed credentials. The service account requires the following object access, field-level security, and system permissions in addition to the access required for identity and access management operations.

Object Access

Grant read-only access to the following objects:

Case
CaseComment
EmailMessage
FeedItem
FeedComment
ContentVersion
ContentDocument
Attachment

Field-Level Security

Grant read access to the following fields:

Object	Required read fields
`Case`	`Subject`, `Description`
`CaseComment`	`CommentBody`
`EmailMessage`	`Subject`, `TextBody`, `HtmlBody`
`FeedItem`	`Body`
`FeedComment`	`CommentBody`

System Permissions

Grant View All on Case and EmailMessage, or grant the org-wide View All Data permission.

Important

Object-level read access does not grant visibility of all records, because record visibility is governed by org-wide defaults and sharing rules. Without View All, scans complete successfully but cover only the records visible to the service account.

Note

If your organizational policies prohibit View All Data, grant View All on each object instead. This is the least-privilege alternative.

Required Access for Authentication Apps Discovery

To aggregate Salesforce Connected Apps and External Client Apps (ECA) as non-human identities, the service account requires the following permissions. The OAuth scopes are unchanged - Manage user data via APIs (api) covers the REST and SOQL calls the connector makes, along with refresh_token and offline_access for the authorization code flow.

The following permissions are the minimum required to aggregate External Client Apps. These permissions were verified against Salesforce API version 66.0 using a Minimum Access profile and a dedicated permission set.

Permission	API name	Required for
API Enabled	`ApiEnabled`	All REST and SOQL calls made by the connector
View Setup and Configuration	`ViewSetup`	Reading setup-level configuration
View all External Client Apps	`ExternalClientAppViewer`	Querying `ExternalClientApplication`, `ExtlClntAppOauthSettings`, and `ExtlClntAppPlcyCnfg`

Important

API Enabled and View Setup and Configuration are not sufficient on their own. Without View all External Client Apps, all three External Client App queries fail with an INVALID_TYPE error and the message sObject type 'ExternalClientApplication' is not supported. After you grant the permission, each of the three queries returns the full set of External Client App records.

Note

These permissions cover External Client Apps only. Connected App aggregation also reads ConnectedApplication over SOQL and retrieves OAuth scopes through the Metadata API, which requires additional permissions. A user who holds only the three permissions listed above receives the message sObject type 'ConnectedApplication' is not supported.

Best Practice

Grant these permissions through a dedicated permission set assigned to the service account rather than through a broad profile.

Salesforce Hyperforce Tenant User Access

To support a Hyperforce tenant, the Salesforce SaaS connector requires a custom user profile with full access to the standard objects listed below.

Accounts
Contact
Collaboration Group
Group
Profile
Package License
Permission Set
Permission Set Assignments
Permission Set Group
Permission Set License
Permission Set License Assign
Public Groups
Queues
Roles
User
User License
User Package License
User Role

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.