Salesforce Authenticated / Backup User Permission Requirements

    OwnBackup leverages the Salesforce API. The Authenticated User is the user that connects OwnBackup to the client's Salesforce org. As a best practice, OwnBackup recommends having a dedicated user as the OwnBackup Authenticated User. 

    The specific permissions for each user is defined either in the user’s profile, or via a permission set.

    The recommended best practice for large data volumes, is to have a dedicated Authenticated User for the Backup product, and one Authenticated User for the Archive product.

    This should enhance security and audit trail capabilities, assist in avoiding API concurrency collisions, and other similar user issues.

    User Profile Permissions

    Basic Permissions

    The Authenticated User must have the following permissions:

    • Read and Update access to all record types in your org. (Currently OwnBackup's Permission Report verifies field level permissions, but does not check for the record types you may need). For successful Restore operations and also for un-archiving records if you use the Archive tool. See the attached spreadsheet to assist you in creating a permission set containing all Record Types.

    • Read and Edit access to all Standard and Custom objects, fields, and record types. This can be configured from the Field Level Security page. As part of the implementation of Recover, you will be guided to create an additional permission set for setting Field Level Security.

    Additional Permissions

    The Authenticated User must also have the required permissions as follows:

    • A license for all of the managed packages (for example: nCino) and feature licenses you use in your org. You must ensure that all the necessary Permission Set Licenses (PSL) and Installed Managed Package Licenses (IMPLs) are attributed to the Authenticated User. As a guide, use the Company Information screen to find which features licenses are available and have an assignment number > 1 (indicating that it is actually in use). At the bottom of the Knowledge Base article, there is a link to the Salesforce reference page Available Feature Licenses.

    • TheModify All Datapermission checkbox is enabled in the user profile, and all of its dependent default permissions are enabled.

    • Ensure that the IP addresses for your OwnBackup platform are permitted to access the Salesforce Org. The IP addresses for all OwnBackup platforms are provided in this list. Note the graphic image at the bottom of that page, about adding the relevant addresses to Salesforce.

    • Customers may need to add the OwnBackup IP addresses, as login IP addresses, at the user profile level.

    • OwnBackup recommends using the “System Administrator” profile, or cloning the "System Administrator" profile to a new profile for this Authenticated User, and then ensuring that the user has all of the required permissions, as listed in this article.

      • The Authenticated User will need to have Read and Update access to all Record Types in your org. Currently OwnBackup's Permission Report verifies field-level permissions, but does not check for the Record Types that might be needed. In addition, the attached spreadsheet can assist you in creating a permission set that contains all Record Types. The instructions provided in this spreadsheet are highly useful for successful Restore operations, and also for un-archiving records, if you use the Archive tool.

      • Some organizations require that integration users or API-only users must use a specific profile. In such a case, ensure that the user is granted all the permissions that an Admin would have. Enable the permission "API Only User", which is enabled via the authenticated user's custom profile, or permission set.

      • When setting up Permission Sets for this user, make sure that “Session Activation Required” is not set to True, as this is not supported.

      • As part of the implementation of Recover, you will be guided to create an additional permission set for setting Field-Level Security.

    • Further permissions to consider for Backup and Recovery

      • If your security policies permit it, enable the permission “Password Never Expires” for this user.

      • Enable the “Manage Encryption Key” checkbox in their profile to back up the TenantSecret object.

      • Enable "Edit Read Only Fields" (e.g. to insert a value into Case.ClosedDate during a Restore operation)

      • Enable "Manage All Private Reports and Dashboards"

      • Enable "Manage Experiences"

      • Enable "View All Custom Settings"

      • Enable "View All Lookup Record Names"

      • Enable "View Encrypted Data"

    • Possibly an additional permission might be required, to avoid a problem caused by the Salesforce Summer ‘21 update. In order to avoid problems due to this known Salesforce issue, also add the "Access Conversation Entries" under Administrative Permission in the profile/permission set. This issue could apparently cause an error message even for customers who don't use the functionality. This bug was apparently fixed in Summer ‘21 Patch 13, so you could choose to skip this permission if you are not using that functionality.

    • In order to backup Einstein, an Einstein Analytics Plus Admin is necessary to be assigned to the Authenticated user.

    • Enable the “Manage Prompts” permission to prevent issues backing up Prompt Versions, if they are in use in your org.

    NOTE: The user will also need access to the target object where the prompt is pointing to or the backup of that prompt record will potentially fail. For example the object referenced in the ‘TargetPageKey1’ field on any prompt version record.
    • Enable the “Manage Flows” permission to prevent issues with backup which were introduced with the Salesforce Winter ‘23 release.

    • OwnBackup recommends enabling the permission "API Only User" for the Authenticated User. This can be enabled via the authenticated user's custom profile or permission set.

    • If your security policies permit it, we recommend also enabling "Password Never Expires" for this user.

    • You can use MFA to login for this user, if needed.

    • When connecting a backup service from OwnBackup to Salesforce (to start the backups), you will need to login to Salesforce for this user. Therefore the Master Administrator and other Admins will need to know the login credentials for that OwnBackup Authenticated User. This login will generate the OAuth access token that OwnBackup will store and use for access to that Salesforce Org.

    This initial login will require the credentials to be entered from the user's desktop, so if IP address restrictions are in place, make sure that the desktop used for the initial login is recognized as the OwnBackup Authenticated User. This will also be the case whenever you need to re-authenticate with Salesforce.

    • If you are using OwnBackup Recover with a Veeva org, the Authenticated User must have Veeva administrator permissions (no separate license as such).

    Note: The new Salesforce Integration User license is currently not supported. Our current testing indicates the scope of this license type is not enough to provide comprehensive access for backup and restore operations. 

    Required Permissions Table (Backup and Restore)  

    Permission / Settings Name

    Permission Type

    Reason / Use Case

    Documentation

    Query All Files

    App Permission

    More efficient queries and access to private files.

    Query All Files

    View and Edit Converted Leads

    App Permission

    Ability to see all leads

    View and Edit Converted Leads

    Edit Read Only Fields

    System Permissions

    Used to populate data on restore to fields that may normally be read only

    Edit Read Only Fields

    Manage all Private Reports and Dashboards

    System Permissions

    Query / restore private reports/dashboards.

    User Permissions for Sharing Reports and Dashboards

    Manage Experiences

    System Permissions

    Needed if using Experience Cloud (formerly Community Cloud).

    Manage Experiences

    Manage Prompts

    System Permissions

    If using Salesforce Prompts (In App Guidance). If they are in use in your org, prevent issues backup prompt versions.

    NOTE: The user needs access to the target object where the prompt is pointing to or the backup of that prompt record will potentially fail. For example the object referenced in the ‘TargetPageKey1’ field on any prompt version record.

    Define Prompts in Lightning Experience


     

    Set Audit Fields upon Record Creation

    Enable in the user interface when setting up, and assign via System Permissions

    Populates original created date of record

    Enable the 'Create Audit Fields' permission

    OwnBackup for Salesforce FAQs

    Update Records with Inactive Owners

    Enable in the user interface when setting up, and assign via System Permissions

    Restores records with inactive owners

    Update Records with Inactive Owners

    View All Custom Settings

    System Permissions

    Needed to backup custom settings

    Grant Read Access to All Custom Settings

    View All Lookup Record Names

    System Permissions

    Needed to backup lookup relationshipsView All Lookup Record Names

    View Encrypted Data

    System PermissionsNeeded to backup encrypted data using classic encryptionView Encrypted Data

    Manage Flow

    System PermissionsSystem Permissions 

    Manage Orchestration Runs and Work Items

    System Permissions

    Access to Flow orchestrations since Winter '23

    Enable Sharing for Flow Orchestration Objects 

    Access Conversation Entries

    Administrative Permission in the profile/permission set

    Avoid problems with the issue described here

    Access Conversation Entries

    CRM Analytics Plus Admin

    Permission Set LicenseBackup Einstein Analytics / Tableau CRM Note: Only supports the elements using the force.com api.CRM Analytics Plus Admin

    Modify All Data

    System Permissions 

    'Modify All Data' permission

    Manage Users Must be enabled to retrieve the Profile metadata object and run Analyze Profile Permissions 

       

      More on User Profile Permissions 

      For more information on user profile permissions in Salesforce, see here.  

      For information on user profile permissions for an Authenticated User of Archive, see here.

      For information on Salesforce user permissions for an Authenticated User of Sandbox Seeding (SBS), see here.

       

       

       

       

      Attachments

      « Previous ArticleNext Article »


      Contact Us

      Sometimes you just want to talk to someone. Our customer support team is available by phone: