Salesforce ECA Source Keeps Asking to Re-Authorize in ISC – Causes and Fix

SailPoint Human Fabric (SHF) SHF Community Knowledge Base
1

Overview

After moving the Salesforce SaaS connector to External Client App (ECA) authentication, test connection and aggregation work fine at first. Then after a day or two the Last Authorized Date disappears from the source and you have to click Authorize again. Several people hit this after the ECA rollout, so I’m putting the causes and fixes from a few threads in one place.

Problem / Symptoms

  • Salesforce source in ISC configured with ECA authentication
  • Initial authorization succeeds and Test Connection passes
  • After 1–2 days the Last Authorized Date is gone and aggregations fail or throw random 401s
  • Clicking Authorize again fixes it, but only until the next time

Root Cause

There are two common causes, both on the Salesforce side.

  1. Refresh token rotation. With rotation enabled, every time ISC uses the refresh token, Salesforce issues a new one and invalidates the old one. If ISC ever ends up one rotation behind, Salesforce treats the old token as reused and revokes all active refresh tokens and sessions for that user. This can happen with a retry, overlapping aggregations, or someone re-authorizing the same ECA. Salesforce also caps active refresh tokens at five per user per ECA.
  2. Refresh token policy is shorter than your aggregation schedule. If the ECA’s refresh token expires sooner than the gap between scheduled aggregations, the token is dead by the time ISC tries to use it.

Solution

All of this is done in Salesforce, not ISC.

Step 1: In Salesforce, go to Setup → External Client Apps → External Client App Manager and edit your ECA.

Step 2: Under the OAuth settings, make sure the scopes include refresh_token, offline_access.

Step 3: In the OAuth policies, uncheck Enable Refresh Token Rotation and save.

Step 4: Check the Refresh Token Policy. Either set it to “Refresh token is valid until revoked,” or make sure the expiry is comfortably longer than your aggregation interval.

Step 5: Go back to the Salesforce source in ISC and click Authorize once more so it picks up a fresh token.

Important Note / Gotcha

  • If the rotation toggle is greyed out and Salesforce says the settings are hidden for installed apps, your ECA was probably installed as a packaged app from AppExchange, not created as a standalone ECA. I haven’t seen a documented workaround for that. It’s a case for Salesforce support or whoever owns the package.
  • Use one dedicated integration user for the ECA, and don’t have multiple admins authorizing it from different places. That’s an easy way to burn through the five-token limit.
  • SailPoint pushed a platform-side fix around Aug 21 that cleared this up for some tenants. If it’s working for you now, great, but if it comes back, the settings above are what to check.
  • Turning off rotation is a security trade-off. Run it past your Salesforce admin or security team before changing it in production.

Validation

  • Last Authorized Date stays on the source across a few days of scheduled aggregations
  • Aggregations run without 401s
  • In Salesforce, the integration user’s OAuth usage shows one stable token for the ECA, not a churn of new ones

References

Announcement: Salesforce External Client App is now available

2 Likes
2

Hello @SivaLankapalli ,

Glad that you shared these details. I saw a lot of folks reporting they are facing this issue.

We were able to Enable the ECA connection for our SF instance and test connection is successful. But we are facing an error while doing the account or group aggregation. Do you have any idea on sorting this out ?

WhatsApp Image 2026-10-03 at 6.36.28 PM (2)
WhatsApp Image 2026-10-03 at 6.36.28 PM (2)841×501 32.7 KB

3

Hi Jerin, thanks! Test Connection mostly just checks the token, so when aggregation fails after that, it’s usually permissions or the ECA policies.

I’d start with the integration user. It needs API Enabled, View Setup and Configuration, and View All Users, plus Manage Users if you’re provisioning. Then check that the ECA scopes include api and not only the refresh token ones.

Also check the Permitted Users setting on the ECA. If it’s set to admin approved, the user’s profile or permission set has to be assigned to the ECA. Otherwise test connection passes but the actual calls get rejected. Setting IP Relaxation to relaxed is worth a try too, just to rule it out.

If it still fails, can you paste the error text here? The screenshot’s a bit hard to read.