Skip to content

Salesforce Required Permissions

The administrator must have the appropriate rights on the Salesforce account to support user provisioning.

The System Administrator Profile can configure and customize the application. It contains the following permissions:

  • Has access to all functionality that does not require an additional license
  • Can create, edit, and delete custom profiles
  • Can reset the password of multiple user accounts
  • Can add multiple user accounts
  • Has access to all user accounts and profile permissions
  • Enable and disable user accounts

Profile Access to User Accounts

A user profile determines what a user can do in the system. By default, the System Administrator Profile can do the most; the Read Only Profile can do the least. For most users, the Standard User Profile is a good choice. It lets people create and edit most records, as well as access and run reports.

System Administrators can configure Users, Roles, and Profiles from the Setup area. To access these settings when signed in to Salesforce, select your name, and then select Setup from the drop-down menu. The Users, Roles, and Profiles settings are all available under Manage Users in the Administration Setup menu.

For more information on configuring a custom user profile to enable the connector to connect to the Salesforce managed system and manage the data within, refer to Required Access for Custom User Profiles.

User Licenses Create Access

Most of your users will need a standard Salesforce user license. This license gives the user full access to Salesforce's CRM features and applications, including Chatter. Other user license options limit user access.

Required Access for Custom User Profiles

SailPoint recommends that you use a System Administrator user profile to grant the Salesforce connector the minimum necessary access within the Salesforce managed system. However, if your organizational policies prohibit the use of a System Administrator user profile in this way, you can create a custom user profile for the connector to use instead.

For identity and access management operations, the custom user profile must have full access to the following Salesforce objects at a minimum:

Note

The list of objects which require full access can vary for custom attributes, depending on how the attribute is defined. You may need to grant full access to additional Salesforce objects for custom attributes.

  • Accounts
  • Contact
  • CollaborationGroup
  • Group
  • Profile
  • PackageLicense
  • PermissionSet
  • PermissionSetAssignments
  • PermissionSetGroup
  • PermissionSetLicense
  • PermissionSetLicenseAssign
  • PublicGroups
  • Queues
  • Roles
  • User
  • UserLicense
  • UserPackageLicense
  • UserRole

Required Permissions for DelegateGroup

Configure the following permissions before you begin configuring DelegateGroup:

  • To manage delegated administration - Customize Application

  • To be a delegated administrator - View Setup and Configuration

    Note

    Delegated administrators can only manage user roles. Delegated administrators cannot create new user roles, copy existing roles, or delete existing roles.

Salesforce Hyperforce Tenant User Access

To support a Hyperforce tenant, the Salesforce connector requires a custom user profile with full access to the standard objects listed below.

  • Accounts
  • Contact
  • Collaboration Group
  • Group
  • Profile
  • Package License
  • Permission Set
  • Permission Set Assignments
  • Permission Set Group
  • Permission Set License
  • Permission Set License Assign
  • Public Groups
  • Queues
  • Roles
  • User
  • User License
  • User Package License
  • User Role

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.