In today’s interconnected business ecosystem, Salesforce rarely operates in isolation. Whether you’re connecting HubSpot, Marketo, ERP systems, or custom applications, proper integration user configuration is the cornerstone of secure, scalable, and maintainable integrations. Yet many organizations rush through this critical setup, creating security vulnerabilities and operational headaches down the line.
Why Dedicated Integration Users Matter
Following the principle of least privilege is essential for security-minded administrators—limiting users’ access rights to only what is required to do their jobs salesforce. When integrations share credentials with actual users or administrators, organizations face significant risks: compromised audit trails, difficulty troubleshooting issues, security vulnerabilities when credentials are exposed, and the inability to isolate problems to specific integrations.
A dedicated integration user provides clear separation of concerns, enhanced security through granular permissions, better audit trails for compliance, and easier debugging when issues arise.
The Evolution: Minimum Access – API Only Integrations Profile
In Spring ’24, Salesforce replaced the “API Only Systems Integrations” profile with the “Minimum Access – API Only Integrations” profile, which is only provisioned in new orgs salesforce. This change represents Salesforce’s commitment to security-first integration architecture.
The new profile starts with zero permissions by default, forcing administrators to consciously grant only necessary access. This “zero trust” approach significantly reduces the attack surface for potential security breaches.
Best Practices for Configuration
1. Start Clean: Verify Profile Permissions
Verify that your Minimum Access – API Only Integrations profile has all permissions removed from the profile itself, and instead use permission sets and permission set groups to extend permissions salesforce. This approach aligns with Salesforce’s direction of retiring profile-based permissions in Spring ’26.
2. Create Unique Profiles Per Integration
Create a new profile for each external application using the Minimum Access – API Only Integrations profile as the template, which gives you granular control of Login IP Ranges, Connected App access and other parameters salesforce.
While this may seem like additional overhead, the benefits are substantial:
- Isolation of security breaches: If one integration is compromised, others remain secure
- Easier troubleshooting: Clear visibility into which integration caused an issue
- Precise permission management: Each integration gets exactly what it needs, nothing more
3. Implement IP Whitelisting
Salesforce strongly advises configuring Login IP Ranges to the external application provider’s published whitelist ranges salesforce. This adds an additional security layer, ensuring that even if credentials are compromised, they can only be used from approved IP addresses.
4. Leverage Permission Sets and Permission Set Groups
With profile-based permissions being retired, permission sets are the future of access management. Create dedicated permission sets for each integration that include:
- Required object-level permissions (CRUD)
- Field-level security settings
- System permissions (like “Password Never Expires” if needed)
- Connected app access
- Custom permissions for managed packages
Pro Tip: Use the “Boostr for Salesforce” Chrome extension to bulk-select field permissions, saving significant configuration time.
5. Test Thoroughly in Sandbox First
If you’re using the Minimum Access – API Only Integrations profile for the first time, configure this in a sandbox before implementing in production to perform thorough testing in a safe environment salesforce.
Create a comprehensive test plan that includes:
- Verification of all required CRUD operations
- Testing of error handling when permissions are insufficient
- Validation of data visibility through sharing rules
- Confirmation that the integration cannot access unauthorized data
Common Pitfalls to Avoid
Sharing Admin Credentials
Never use an administrator’s login for integrations. This creates security risks, muddies audit trails, and makes troubleshooting nearly impossible.
Granting Excessive Permissions
It’s tempting to give broad permissions to “make things work,” but this violates the principle of least privilege. Take the time to identify exact requirements.
Ignoring Field-Level Security
Object access isn’t enough. Ensure sensitive fields are protected through field-level security settings on your permission sets.
Forgetting About Record-Level Access
Even with object and field permissions, sharing rules and organization-wide defaults control record visibility. Configure sharing appropriately for your integration user.
The Five Free Integration Licenses: A Game-Changer
Salesforce now provides five free Salesforce API Integration licenses for most organizations (Unlimited, Enterprise, and Performance editions). This removes the cost barrier that previously led many organizations to share credentials—a significant security risk.
Additional integration licenses are available for just $10/user/month, making it financially feasible to maintain proper security practices even with numerous integrations.
Implementation Checklist
When setting up a new integration user, follow this systematic approach:
Planning Phase:
- Document integration requirements and necessary permissions
- Identify the external system’s IP ranges for whitelisting
- Determine if UI access is required (if yes, standard licenses are needed)
Configuration Phase:
- Create a unique profile cloned from “Minimum Access – API Only Integrations”
- Configure Login IP Ranges on the profile
- Create permission sets with required object, field, and system permissions
- Assign the Salesforce API Integration permission set license
- Create the integration user with clear naming (e.g., “Integration – HubSpot”)
- Set a strong, unique password and security token
Testing Phase:
- Use API tools like Workbench to verify permissions
- Test all required operations (create, read, update, delete)
- Verify sharing rules work correctly
- Confirm unauthorized access is properly blocked
- Document any findings and adjust permissions
Deployment Phase:
- Replicate configuration in production
- Document credentials securely (password manager, not shared documents)
- Configure the external system with integration user credentials
- Monitor initial sync closely for errors
- Establish ongoing monitoring procedures
Ongoing Maintenance
Integration user management doesn’t end at deployment. Establish regular reviews:
- Quarterly: Review assigned permissions and remove any no longer needed
- Semi-annually: Rotate passwords and security tokens
- Annually: Audit all integration users to ensure they’re still active and necessary
- Continuously: Monitor login history for unusual patterns
Conclusion
Proper integration user configuration represents a small upfront investment that pays dividends in security, maintainability, and operational efficiency. With Salesforce’s provision of free integration licenses and modern tools like permission sets, there’s no excuse for cutting corners on integration security.
By following these best practices—starting with minimal permissions, using dedicated users per integration, implementing IP whitelisting, and thorough testing—you’ll create a robust integration architecture that scales securely with your business needs.
Remember: in integration security, the principle of least privilege isn’t just a best practice—it’s your organization’s first line of defense against data breaches and compliance violations.
This article synthesizes best practices from Salesforce’s official documentation, experienced administrators, and real-world implementation experience to provide a comprehensive guide for securing your Salesforce integrations.