OwnBackup leverages the Salesforce API. The Authenticated User is the user that connects OwnBackup to the client's Salesforce org. As a best practice, OwnBackup recommends having a dedicated user as the OwnBackup Authenticated User.
The specific permissions for each user is defined either in the user’s profile, or via a permission set.
The recommended best practice for large data volumes, is to have a dedicated Authenticated User for the Backup product, and one Authenticated User for the Archive product.
This should enhance security and audit trail capabilities, assist in avoiding API concurrency collisions, and other similar user issues.
The Authenticated User must have the following permissions:
Read and Update access to all record types in your org. (Currently OwnBackup's Permission Report verifies field level permissions, but does not check for the record types you may need). For successful Restore operations and also for un-archiving records if you use the Archive tool. See the attached spreadsheet to assist you in creating a permission set containing all Record Types.
Read and Edit access to all Standard and Custom objects, fields, and record types. This can be configured from the Field Level Security page. As part of the implementation of Recover, you will be guided to create an additional permission set for setting Field Level Security.
The Authenticated User must also have the required permissions as follows:
A license for all of the managed packages (for example: nCino) and feature licenses you use in your org. You must ensure that all the necessary Permission Set Licenses (PSL) and Installed Managed Package Licenses (IMPLs) are attributed to the Authenticated User. As a guide, use the Company Information screen to find which features licenses are available and have an assignment number > 1 (indicating that it is actually in use). At the bottom of the Knowledge Base article, there is a link to the Salesforce reference page Available Feature Licenses.
TheModify All Datapermission checkbox is enabled in the user profile, and all of its dependent default permissions are enabled.
Ensure that the IP addresses for your OwnBackup platform are permitted to access the Salesforce Org. The IP addresses for all OwnBackup platforms are provided in this list. Note the graphic image at the bottom of that page, about adding the relevant addresses to Salesforce.
Customers may need to add the OwnBackup IP addresses, as login IP addresses, at the user profile level.
OwnBackup recommends using the “System Administrator” profile, or cloning the "System Administrator" profile to a new profile for this Authenticated User, and then ensuring that the user has all of the required permissions, as listed in this article.
The Authenticated User will need to have Read and Update access to all Record Types in your org. Currently OwnBackup's Permission Report verifies field-level permissions, but does not check for the Record Types that might be needed. In addition, the attached spreadsheet can assist you in creating a permission set that contains all Record Types. The instructions provided in this spreadsheet are highly useful for successful Restore operations, and also for un-archiving records, if you use the Archive tool.
Some organizations require that integration users or API-only users must use a specific profile. In such a case, ensure that the user is granted all the permissions that an Admin would have. Enable the permission "API Only User", which is enabled via the authenticated user's custom profile, or permission set.
When setting up Permission Sets for this user, make sure that “Session Activation Required” is not set to True, as this is not supported.
As part of the implementation of Recover, you will be guided to create an additional permission set for setting Field-Level Security.
Further permissions to consider for Backup and Recovery
If your security policies permit it, enable the permission “Password Never Expires” for this user.
Enable the “Manage Encryption Key” checkbox in their profile to back up the TenantSecret object.
Enable "Edit Read Only Fields" (e.g. to insert a value into Case.ClosedDate during a Restore operation)
Enable "Manage All Private Reports and Dashboards"
Enable "Manage Experiences"
Enable "View All Custom Settings"
Enable "View All Lookup Record Names"
Enable "View Encrypted Data"
Possibly an additional permission might be required, to avoid a problem caused by the Salesforce Summer ‘21 update. In order to avoid problems due to this known Salesforce issue, also add the "Access Conversation Entries" under Administrative Permission in the profile/permission set. This issue could apparently cause an error message even for customers who don't use the functionality. This bug was apparently fixed in Summer ‘21 Patch 13, so you could choose to skip this permission if you are not using that functionality.
In order to backup Einstein, an Einstein Analytics Plus Admin is necessary to be assigned to the Authenticated user.
Enable the “Manage Prompts” permission to prevent issues backing up Prompt Versions, if they are in use in your org.
Enable the “Manage Flows” permission to prevent issues with backup which were introduced with the Salesforce Winter ‘23 release.
OwnBackup recommends enabling the permission "API Only User" for the Authenticated User. This can be enabled via the authenticated user's custom profile or permission set.
If your security policies permit it, we recommend also enabling "Password Never Expires" for this user.
You can use MFA to login for this user, if needed.
When connecting a backup service from OwnBackup to Salesforce (to start the backups), you will need to login to Salesforce for this user. Therefore the Master Administrator and other Admins will need to know the login credentials for that OwnBackup Authenticated User. This login will generate the OAuth access token that OwnBackup will store and use for access to that Salesforce Org.
This initial login will require the credentials to be entered from the user's desktop, so if IP address restrictions are in place, make sure that the desktop used for the initial login is recognized as the OwnBackup Authenticated User. This will also be the case whenever you need to re-authenticate with Salesforce.
If you are using OwnBackup Recover with a Veeva org, the Authenticated User must have Veeva administrator permissions (no separate license as such).
Permission / Settings Name
Reason / Use Case
Query All Files
More efficient queries and access to private files.
View and Edit Converted Leads
Ability to see all leads
Edit Read Only Fields
Used to populate data on restore to fields that may normally be read only
Manage all Private Reports and Dashboards
Query / restore private reports/dashboards.
User Permissions for Sharing Reports and Dashboards
Needed if using Experience Cloud (formerly Community Cloud).
If using Salesforce Prompts (In App Guidance). If they are in use in your org, prevent issues backup prompt versions.
NOTE: The user needs access to the target object where the prompt is pointing to or the backup of that prompt record will potentially fail. For example the object referenced in the ‘TargetPageKey1’ field on any prompt version record.
Define Prompts in Lightning Experience
Set Audit Fields upon Record Creation
Enable in the user interface when setting up, and assign via System Permissions
Populates original created date of record
Enable the 'Create Audit Fields' permission
OwnBackup for Salesforce FAQs
Update Records with Inactive Owners
Restores records with inactive owners
View All Custom Settings
Grant Read Access to All Custom Settings
View All Lookup Record Names
View Encrypted Data
Manage Orchestration Runs and Work Items
Access to Flow orchestrations since Winter '23
Enable Sharing for Flow Orchestration Objects
Access Conversation Entries
Administrative Permission in the profile/permission set
Avoid problems with the issue described here
CRM Analytics Plus Admin
Modify All Data
'Modify All Data' permission
For more information on user profile permissions in Salesforce, see here.
For information on user profile permissions for an Authenticated User of Archive, see here.
For information on Salesforce user permissions for an Authenticated User of Sandbox Seeding (SBS), see here.
Sometimes you just want to talk to someone. Our customer support team is available by phone: