# Salesforce Required Permissions

The administrator must have the appropriate rights on the Salesforce account to support user provisioning.

The System Administrator Profile can configure and customize the application. It contains the following permissions:

- Has access to all functionality that does not require an additional license
- Can create, edit, and delete custom profiles
- Can reset the password of multiple user accounts
- Can add multiple user accounts
- Has access to all user accounts and profile permissions
- Enable and disable user accounts

## Profile Access to User Accounts

A user profile determines what a user can do in the system. By default, the System Administrator Profile can do the most; the Read Only Profile can do the least. For most users, the Standard User Profile is a good choice. It lets people create and edit most records, as well as access and run reports.

System Administrators can configure Users, Roles, and Profiles from the **Setup** area. To access these settings when signed in to Salesforce, select your name, and then select **Setup** from the drop-down menu. The Users, Roles, and Profiles settings are all available under **Manage Users** in the **Administration Setup** menu.

For more information on configuring a custom user profile to enable the connector to connect to the Salesforce managed system and manage the data within, refer to [Required Access for Custom User Profiles](<#required-access-for-custom-user-profiles>).

## User Licenses Create Access

Most of your users will need a standard Salesforce user license. This license gives the user full access to Salesforce's CRM features and applications, including Chatter. Other user license options limit user access.

## Required Access for Custom User Profiles

SailPoint recommends that you use a System Administrator user profile to grant the Salesforce connector the minimum necessary access within the Salesforce managed system. However, if your organizational policies prohibit the use of a System Administrator user profile in this way, you can create a custom user profile for the connector to use instead.

For identity and access management operations, the custom user profile must have full access to the following Salesforce objects at a minimum:

> [!NOTE]
>
> The list of objects which require full access can vary for custom attributes, depending on how the attribute is defined. You may need to grant full access to additional Salesforce objects for custom attributes.

- Accounts
- Contact
- CollaborationGroup
- Group
- Profile
- PackageLicense
- PermissionSet
- PermissionSetAssignments
- PermissionSetGroup
- PermissionSetLicense
- PermissionSetLicenseAssign
- PublicGroups
- Queues
- Roles
- User
- UserLicense
- UserPackageLicense
- UserRole

## Required Permissions for DelegateGroup

Configure the following permissions before you begin configuring DelegateGroup:

- To manage delegated administration - Customize Application
- To be a delegated administrator - View Setup and Configuration

  > **Note**
  >
  > Delegated administrators can only manage user roles. Delegated administrators cannot create new user roles, copy existing roles, or delete existing roles.

## Salesforce Hyperforce Tenant User Access

To support a Hyperforce tenant, the Salesforce connector requires a custom user profile with full access to the standard objects listed below.

- Accounts
- Contact
- Collaboration Group
- Group
- Profile
- Package License
- Permission Set
- Permission Set Assignments
- Permission Set Group
- Permission Set License
- Permission Set License Assign
- Public Groups
- Queues
- Roles
- User
- User License
- User Package License
- User Role