Skip to main content

Salesforce

Visualize Salesforce users, roles, groups, policies, and permissions, map Salesforce users to employees, and monitor changes through queries and alerts.

Installation​

The Salesforce integration authorizes JupiterOne through Salesforce's OAuth flow. When you create an instance, you are redirected to Salesforce to log in and grant access, and the integration reads your organization's data based on the identity of the user you log in with.

Prerequisites​

Log in during the OAuth flow as a Salesforce user whose assigned profile or permission set grants the permissions below. These are the permissions the integration's read-only queries require.

  • API Enabled — required for any Salesforce API call. Without it, Salesforce rejects the integration's requests. This is a system permission on the connecting user's profile or permission set.
  • View Setup and Configuration — required to read Profiles, permission sets, and permission set assignments.
  • View Roles and Role Hierarchy — required to read user roles and the role hierarchy.
  • Read access to the User object — required to read user records.
note

Grant these permissions in Salesforce under Setup, from Profiles or Permission Sets, as system permissions on the user you authorize with. Group and group membership data require only authentication and API Enabled.

Configuration in JupiterOne​

To install the Salesforce integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Salesforce. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Salesforce account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.
  • A Description to assist in identifying the integration instance, if desired.
  • A Polling Interval that fits your monitoring needs. You may leave this as DISABLED and manually execute the integration.

Click Create once all values are provided to begin the OAuth flow with Salesforce. You are then redirected to Salesforce to log in and authorize JupiterOne to access your Salesforce organization data, based on the user identity you log in with.

Data Volume Configuration​

By default, the integration ingests all users in your Salesforce organization. You can optionally narrow user ingestion to specific profiles or roles.

Data Filtering Options​

FieldDescriptionDefault
User Profile ID FilterLimits user ingestion to the listed profile IDs. Enter one or more profile IDs separated by commas.Blank (all users)
User Role ID FilterLimits user ingestion to the listed role IDs. Enter one or more role IDs separated by commas.Blank (all users)

How it affects data volume: Leave both filters blank to ingest every user. Providing profile IDs, role IDs, or both restricts ingestion to users matching the values you list, reducing the number of user records ingested.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.