Hello everyone, I am setting up the Salesforce connector integration. The integration documentation recommends assigning Administrator permissions, but the client does not want to grant such a high level of access. Has anyone assigned a different permission set that covers the following steps?
Account creation
Account enabling
Account deactivation
Account updating
Access removal
Access assignment
From what I can see, if the Administrator profile isn’t an option, I’d need to create a custom profile with the necessary operations. Has anyone done it this way?
Hello Guilherme. Yes, the custom profile approach works. The object list from that doc page (User, Profile, PermissionSet, PermissionSetAssignments, PermissionSetGroup, PermissionSetLicense, PermissionSetLicenseAssign, PublicGroups, Queues, Roles, CollaborationGroup, Group, Accounts, Contact, PackageLicense, UserLicense, UserPackageLicense, UserRole) with full CRUD access is what the connector needs to handle everything you listed: account create, enable, disable, update, and entitlement assignment/removal.
If you are provisioning custom attributes on the User object, you may need to grant access to additional objects depending on how those attributes are defined. The docs call this out but don’t enumerate every possible case, so test each operation in a sandbox against the custom profile before going to production. Missing object permissions tend to surface there, not during test connection.