---
description: Configuring the Salesforce integration for Veza Lifecycle Management.
---

# Salesforce

### Overview

The Veza integration for Salesforce enables automated user lifecycle management across your identity ecosystem. This integration allows security and IT teams to automate the provisioning, updating, and deprovisioning of Salesforce user accounts based on changes in an authoritative source (such as an HRIS system or another identity provider).

Key capabilities include:

* **User Provisioning**: Automatically create Salesforce user accounts with appropriate profiles and permissions
* **Attribute Synchronization**: Keep user details in sync across systems, ensuring data consistency
* **Permission Management**: Assign and remove permission sets and roles based on policies
* **User Deprovisioning**: Safely disable access when users leave the organization

The integration leverages the SCIM protocol for standardized identity management operations and uses Salesforce-specific APIs for permission management.

| Action Type           | Description                                                                                                        | Supported |
| --------------------- | ------------------------------------------------------------------------------------------------------------------ | --------- |
| SYNC\_IDENTITIES      | Synchronizes identity attributes between systems, with options to create new identities and update existing ones   | ✅         |
| MANAGE\_RELATIONSHIPS | Controls entitlements such as permission set assignments, role assignments, and profile assignments for identities | ✅         |
| DEPROVISION\_IDENTITY | Safely freezes or disables access for identities, includes user deactivation support                               | ✅         |
| CREATE\_ENTITLEMENT   | Creates entitlements such as Salesforce permission sets                                                            | ❌         |
| SOURCE\_OF\_IDENTITY  | Salesforce can act as a source system for identity lifecycle policies                                              | ✅         |

This document includes steps to enable the Salesforce integration for Lifecycle Management, along with details on supported actions and notes.

### Prerequisites and Configuration

Before configuring the integration, ensure you have:

1. Administrative access in Veza to configure the integration
2. An existing [Salesforce integration](../../../integrations/integrations/salesforce) in Veza or add a new one
3. At least one successful extraction from your Salesforce integration
4. The appropriate permissions in Salesforce
5. Salesforce API v40 or later for user provisioning

#### Required Permissions

The Salesforce integration will need the following permissions:

* **Assign Permission Sets**: Enables assignment and removal of permission sets for users.
* **Freeze Users**: Enables freezing and unfreezing user accounts.
* **Manage Internal Users**: Required for user creation and updates.
* **Manage IP Addresses**: Required for managing trusted IP ranges if IP restrictions are used.
* **Manage Login Access Policies**: Required for configuring login access policies.
* **Manage Password Policies**: Required for setting and resetting passwords during user creation.
* **Manage Profiles and Permission Sets**: Required for permission set and profile assignment.
* **Manage Roles**: Required for role assignments and management.
* **Manage Sharing**: Required for managing sharing rules and access control.
* **Manage Users**: Essential for user lifecycle operations.
* **Monitor Login History**: Required for monitoring user logins.
* **Reset User Passwords and Unlock Users**: Required for account management.
* **View All Profiles**: Required to view profile information for all users.
* **View All Users**: Required to view all user information.

In Salesforce, you can add these permissions for the Veza connected app in the **System Permissions** section at the bottom of the Permission Set configuration page.

#### SCIM Requirements

Veza Lifecycle Management uses Salesforce SCIM APIs for identity provisioning operations. The SCIM protocol enables the automated exchange of user identity data between Veza and Salesforce. The permissions listed above provide the necessary access for SCIM functionality.

* The Connected App used for the integration must have OAuth scopes that include `api` and `refresh_token` permissions and a certificate for JWT-based authentication
* To make the required API calls, the integration requires a custom user profile in Salesforce with "API Enabled" permission

For additional details about Salesforce's SCIM implementation, refer to the [Salesforce SCIM documentation](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_overview.htm\&type=5).

#### Enabling the Integration

To enable the integration:

1. In Veza, go to the **Integrations** overview.
2. Search for or create a [Salesforce](../../../integrations/integrations/salesforce) integration.
   1. Ensure the integration permission set includes the [required permissions](#required-permissions).
3. Check the box to **Enable usage for Lifecycle Management**.
4. Save the configuration.

Configure the extraction schedule to ensure your Salesforce data remains current:

1. Go to Veza **Administration** > **System Settings**.
2. In **Pipeline** > **Extraction Interval**, set your preferred interval.
3. Optionally, set a custom override for Salesforce in the _Active Overrides_ section.

To verify the health of the Lifecycle Management data source:

1. Use the main Veza navigation menu to open the **Lifecycle Management** > **Integrations** page or the Veza **Integrations** overview.
2. Search for the integration and click the name to view details.
3. In the **Properties** panel, click the magnifying glass icon under **Lifecycle Management Enabled**.

### SCIM Implementation Details

Veza's Salesforce integration implements the SCIM 2.0 protocol to standardize identity management operations:

* Users are represented with standard SCIM core attributes plus Salesforce-specific Enterprise extensions
* The system uses email addresses as the primary key for user lookups
* Usernames cannot be changed after creation and must be unique within the Salesforce instance
* User profiles are managed through SCIM entitlements
* User roles are handled through SCIM roles endpoints
* User Deprovisioning is implemented as deactivation (setting `active=false`)
* Permission sets are assigned through Salesforce API calls after user creation

### Supported Actions

Salesforce can serve as a _source_ for identity information in Lifecycle Management Policies. User identity details are synchronized from Salesforce, with changes propagated to connected systems.

Salesforce can also be a _target_ for identity management actions based on changes in another external source of truth or as part of a workflow:

The integration supports the following lifecycle management [Actions](../actions):

#### Sync Identities

Primary action for user management (creating or updating users):

* Usernames cannot be changed after creation.
* Email addresses must be unique.
* Required attributes must be present (Username, Email, FirstName, LastName).
* Passwords are set during user creation.
* `Division` and `Department` attributes are excluded during updates due to Salesforce API limitations.
* Salesforce does not support changing usernames after creation.

The following attributes can be synchronized:

| Property       | Required | Type        | Description               | Notes             |
| -------------- | -------- | ----------- | ------------------------- | ----------------- |
| username       | Yes      | String      | Primary login identifier  | Unique identifier |
| emails         | Yes      | String List | User's email addresses    |                   |
| first\_name    | Yes      | String      | Given name                |                   |
| last\_name     | Yes      | String      | Family name               |                   |
| profile\_id    | Yes      | String      | User's profile ID         |                   |
| is\_active     | No       | Boolean     | Account status            |                   |
| department     | No       | String      | Organizational department |                   |
| user\_role\_id | No       | String      | User's role ID            |                   |

***

#### Manage Relationships

The following relationship types are supported:

* Groups: Add and remove group memberships (only for groups with `Group Type = Regular`).
* Permission Sets: Add and remove permission set assignments.
* Permission Set Groups: Add and remove permission set group assignments.
* Profiles: Manage profile assignments.
* User Roles: Synchronize user role assignments.

**Notes:**

* Profile and role assignments are managed via SCIM and Salesforce APIs.
* When removing a profile assignment, users are assigned the "Minimum Access - Salesforce" profile by default. This profile must exist in your Salesforce instance for profile changes to work properly.
* Only Salesforce groups with the property `Group Type = Regular` can be used in Manage Relationships configurations.
* Groups of type `RoleAndSubordinatesInternal` are not supported but can be assigned through their corresponding roles.
* Direct creation of permission sets ("Create Entitlement" action) is not currently supported.

***

#### Deprovision Identity

When a user is deprovisioned:

* The user account is frozen or deactivated (Salesforce does not allow user deletion).
* Permission set assignments are removed.
* Attribute history is preserved for audit.
* The account can be reactivated if needed.
