# Salesforce SaaS Required Permissions

The administrator must have the appropriate rights on the Salesforce account to support user provisioning.

The System Administrator Profile can configure and customize the application. It contains the following permissions:

- System administrator profile permissions
- Has access to all functionality that does not require an additional license
- Can create, edit, and delete custom profiles
- Can reset the password of multiple user accounts
- Can add multiple user accounts
- Has access to all user accounts and profile permissions
- Enable and disable user accounts

## Profile Access to User Accounts

A user profile determines what a user can do in the system. By default, the System Administrator Profile can do the most; the Read Only Profile can do the least. For most users, the Standard User Profile is a good choice. It lets people create and edit most records, as well as access and run reports.

System Administrators can configure Users, Roles, and Profiles from the **Setup** area. To access these settings when signed in to Salesforce, select your name, and then select **Setup** from the drop-down menu. The Users, Roles, and Profiles settings are all available under **Manage Users** in the **Administration Setup** menu.

For more information on configuring a custom user profile to enable the connector to connect to the Salesforce managed system and manage the data within, refer to [Required Access for Custom User Profiles](<#required-access-for-custom-user-profiles>).

## User Licenses Create Access

Most of your users will need a standard Salesforce user license. This license gives the user full access to Salesforce's CRM features and applications, including Chatter. Other user license options limit user access.

## Requested Scopes for Activity Insights

Activity Insights requests the following scopes from Salesforce:

| Scope | Description |
| --- | --- |
| **For Grant Type: Password** |  |
| Manage user data via APIs (api) | Allows access to the current logged-in user's account using APIs such as REST API and Bulk API 2.0. This scope also includes `chatter_api`, which allows access to connect REST API resources. |
| **For Grant Type: JWT and Refresh Token** |  |
| Manage user data via APIs (api) | Allows access to the current logged-in user's account using APIs such as REST API and Bulk API 2.0. This scope also includes `chatter_api`, which allows access to connect REST API resources. |
| Perform requests at any time (refresh\_token, offline\_access) | Allows a refresh token to be returned when the requesting client is eligible to receive one. With a refresh token, the app can interact with the user's data while the user is offline. This token is synonymous with requesting `offline_access`. |
| **For Grant Type: Client Credentials** |  |
| Manage user data via APIs (api) | Allows access to the current logged-in user's account using APIs such as REST API and Bulk API 2.0. This scope also includes `chatter_api`, which allows access to connect REST API resources. |

> [!NOTE]
>
> Secrets and non-human identity discovery uses the same OAuth scopes listed above, but the service account requires additional object and system permissions. For more information, refer to [Required Access for Secrets and Non-Human Identity Discovery](<#required-access-for-secrets-and-non-human-identity-discovery>).

## Required Access for Custom User Profiles

SailPoint recommends that you use a System Administrator user profile to grant the Salesforce SaaS connector the minimum necessary access within the Salesforce managed system. However, if your organizational policies prohibit the use of a System Administrator user profile in this way, you can create a custom user profile for the connector to use instead.

Secrets and non-human identity discovery requires additional permissions, which are described in [Required Access for Secrets and Non-Human Identity Discovery](<#required-access-for-secrets-and-non-human-identity-discovery>).

For identity and access management operations, the custom user profile must have full access to the following Salesforce objects at a minimum:

> [!NOTE]
>
> The list of objects which require full access can vary for custom attributes, depending on how the attribute is defined. You may need to grant full access to additional Salesforce objects for custom attributes.

- Accounts
- Contact
- CollaborationGroup
- Group
- Profile
- PackageLicense
- PermissionSet
- PermissionSetAssignments
- PermissionSetGroup
- PermissionSetLicense
- PermissionSetLicenseAssign
- PublicGroups
- Queues
- Roles
- User
- UserLicense
- UserPackageLicense
- UserRole

## Required Permissions for DelegateGroup

Configure the following permissions before you begin configuring DelegateGroup:

- To manage delegated administration - Customize Application
- To be a delegated administrator - View Setup and Configuration

  > **Note**
  >
  > Delegated administrators can only manage user roles. Delegated administrators cannot create new user roles, copy existing roles, or delete existing roles.

## Required Access for Secrets and Non-Human Identity Discovery

Secrets and non-human identity discovery scans the content of Salesforce records for exposed credentials. The service account requires the following object access, field-level security, and system permissions in addition to the access required for identity and access management operations.

### Object Access

Grant read-only access to the following objects:

- `Case`
- `CaseComment`
- `EmailMessage`
- `FeedItem`
- `FeedComment`
- `ContentVersion`
- `ContentDocument`
- `Attachment`

### Field-Level Security

Grant read access to the following fields:

| Object | Required read fields |
| --- | --- |
| `Case` | `Subject`, `Description` |
| `CaseComment` | `CommentBody` |
| `EmailMessage` | `Subject`, `TextBody`, `HtmlBody` |
| `FeedItem` | `Body` |
| `FeedComment` | `CommentBody` |

### System Permissions

Grant **View All** on `Case` and `EmailMessage`, or grant the org-wide **View All Data** permission.

> [!IMPORTANT]
>
> Object-level read access does not grant visibility of all records, because record visibility is governed by org-wide defaults and sharing rules. Without **View All**, scans complete successfully but cover only the records visible to the service account.

> [!NOTE]
>
> If your organizational policies prohibit **View All Data**, grant **View All** on each object instead. This is the least-privilege alternative.

## Required Access for Authentication Apps Discovery

To aggregate Salesforce Connected Apps and External Client Apps (ECA) as non-human identities, the service account requires the following permissions. The OAuth scopes are unchanged - `Manage user data via APIs (api)` covers the REST and SOQL calls the connector makes, along with `refresh_token` and `offline_access` for the authorization code flow.

The following permissions are the minimum required to aggregate External Client Apps. These permissions were verified against Salesforce API version 66.0 using a Minimum Access profile and a dedicated permission set.

| Permission | API name | Required for |
| --- | --- | --- |
| API Enabled | `ApiEnabled` | All REST and SOQL calls made by the connector |
| View Setup and Configuration | `ViewSetup` | Reading setup-level configuration |
| View all External Client Apps | `ExternalClientAppViewer` | Querying `ExternalClientApplication`, `ExtlClntAppOauthSettings`, and `ExtlClntAppPlcyCnfg` |

> [!IMPORTANT]
>
> **API Enabled** and **View Setup and Configuration** are not sufficient on their own. Without **View all External Client Apps**, all three External Client App queries fail with an `INVALID_TYPE` error and the message `sObject type 'ExternalClientApplication' is not supported`. After you grant the permission, each of the three queries returns the full set of External Client App records.

> [!NOTE]
>
> These permissions cover External Client Apps only. Connected App aggregation also reads `ConnectedApplication` over SOQL and retrieves OAuth scopes through the Metadata API, which requires additional permissions. A user who holds only the three permissions listed above receives the message `sObject type 'ConnectedApplication' is not supported`.

> [!NOTE]
>
> **Best Practice**
>
> Grant these permissions through a dedicated permission set assigned to the service account rather than through a broad profile.

## Salesforce Hyperforce Tenant User Access

To support a Hyperforce tenant, the Salesforce SaaS connector requires a custom user profile with full access to the standard objects listed below.

- Accounts
- Contact
- Collaboration Group
- Group
- Profile
- Package License
- Permission Set
- Permission Set Assignments
- Permission Set Group
- Permission Set License
- Permission Set License Assign
- Public Groups
- Queues
- Roles
- User
- User License
- User Package License
- User Role