Salesforce

Trustle reads users, profiles, roles, permission sets, and sign-in history from Salesforce. Trustle can create and deactivate users, and change their profiles, roles, and permission sets.

Prerequisites

• A Salesforce administrator who can create external client apps, permission sets, and users.
• A profile named exactly Minimum Access - Salesforce. Salesforce includes this standard profile. Do not rename or delete it. Trustle gives it to each user that Trustle creates. Trustle also moves a user to it when Trustle removes their profile. Without it, these requests fail.
• An identity provider connected in Trustle, for example Okta or Microsoft Entra ID. Trustle hides SaaS Applications until one is connected.

Configure Salesforce

Step 1: Create an external client app

1. Go to Setup → Apps → External Client Apps → External Client App Manager.

   

2. Click New external client app.

   

3. Fill in the required fields under Basic Information. For example, enter the name Trustle.

   

4. Under API, select Enable OAuth. Set these values:

   Setting	Value
   Callback URL	https://console.trustle.io/salesforce-callback. Salesforce requires a value. Trustle does not use it.
   OAuth Scopes	Manage user data via APIs (api)
   Flow Enablement	Select Enable Client Credentials Flow.
   Security	Keep the defaults.

   

5. Click Create.

Step 2: Create a permission set

1. Go to Administration → Users → Permission Sets.

   

2. Click New.

   

3. Enter a name, for example Trustle Integration.

   

4. Click Save.

Step 3: Grant permissions

1. On the page of the new permission set, go to System → System Permissions.

   

2. Click Edit. Select API Enabled. Salesforce also selects some related permissions.

   

3. Select Manage Users. Salesforce also selects some related permissions.

   

4. Check the optional permissions you need:

   Permission	Required	What Trustle does with it
   API Enabled	Yes	Signs in with the external client app. Reads users, profiles, roles, and permission sets.
   Manage Users	Yes	Creates and deactivates users. Changes their profiles, roles, and permission sets.
   View Setup and Configuration	Optional	Reads the sign-in history, to find accounts that sign in only through the API. Without it, Trustle marks fewer accounts as service accounts.
   Modify All Data	Optional	Assigns profiles that include Modify All Data. Without it, Salesforce refuses those assignments and the requests fail.

5. Click Save.

Note

Salesforce does not let a user assign a profile that has more permissions than the user has. If the run-as user does not have Modify All Data, the access request page shows “Trustle connection is missing permission: Modify All Data” on each profile that includes it.

Step 4: Create the run-as user

Trustle acts as this user in Salesforce.

1. Go to Administration → Users → Users.

   

2. Create a user for Trustle. Set User License to Salesforce and Profile to Minimum Access - Salesforce.

   

3. Open the new user. In Permission Set Assignments, click Edit Assignments.

   

4. Add the permission set from Step 2. Click Save.

   

Step 5: Set the run-as user on the app

1. Open the external client app from Step 1.

   

2. On the Policies tab, click Edit.

   

3. Select Enable Client Credentials Flow. In Run As (Username), enter the user from Step 4. Click Save.

   

Step 6: Collect the values for Trustle

1. On the external client app page, select the Settings tab.

   

2. Open OAuth Settings. Click Consumer Key and Secret.

   

3. Verify your identity.

   

4. Copy the Consumer Key and the Consumer Secret.

   

5. Go to Setup → Settings → My Domain.

   

6. In My Domain Details, find Current My Domain URL. The domain is the part before .salesforce.com.

   

Trustle field	Where to find it in Salesforce	Example
Consumer Key	External client app → Settings → OAuth Settings	3MVG9…
Consumer Secret	External client app → Settings → OAuth Settings	A1B2C3…
Domain	My Domain → Current My Domain URL, without .salesforce.com	yourcompany.my. For yourcompany-dev-ed.develop.my.salesforce.com, enter yourcompany-dev-ed.develop.my.

Connect in Trustle

1. In Trustle, go to Connections.
2. Under SaaS Applications, find Salesforce and click Connect.
3. Enter a Connection Name, for example Salesforce production. Description is optional.
4. Enter the values from Step 6.
5. Click Test Connection.
6. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can sign in and read one user. It does not check every permission. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Salesforce connection.
2. Wait for the first sync to finish.
3. Check that the user count matches the number of users in Salesforce.
4. Check that the profiles, roles, and permission sets from Salesforce show in Trustle.

If something is missing, see Troubleshooting.

Note

Trustle takes the last-used date from the Salesforce Last Login field. A sign-in through the API also updates this field. Trustle does not show which records or objects a user opened. Salesforce records that only with Event Monitoring (Salesforce Shield).

Security notes

Note

• Use a dedicated run-as user and external client app for Trustle only.
• Grant Modify All Data only if Trustle must assign profiles that include it.
• Store the consumer secret in a secret manager. Never commit it to a repository.
• Rotate the consumer secret on your normal schedule. Then paste the new value into the Trustle connection.
• Salesforce does not let anyone delete a user. When Trustle removes or suspends a user, Trustle deactivates the user.

Troubleshooting

Test Connection fails

Trustle does not show the reason yet. Check these values:

• Consumer Key and Consumer Secret: copy them again from Step 6. “Invalid or expired credentials” means Salesforce refused them.
• Domain: enter the part of Current My Domain URL before .salesforce.com. Do not add https://. “Failed to create Salesforce client” usually means a wrong domain or a client credentials flow that is not on.
• Run-as user: check that Enable Client Credentials Flow is on and Run As (Username) names an active user. See Step 5.
• API Enabled: “Insufficient permissions” means the run-as user cannot use the API. Check the permission set from Step 3.

Trustle cannot create a user or remove a profile

Check that a profile named exactly Minimum Access - Salesforce exists. Trustle gives this profile to new users, and to users whose profile it removes. Then retry the request.

A profile request fails, or shows “missing permission: Modify All Data”

The profile includes Modify All Data, and the run-as user does not. Add Modify All Data to the permission set from Step 3. The warning goes away after the next sync.

Accounts that use only the API show as people

Add View Setup and Configuration to the permission set from Step 3. Trustle reads the sign-in history after the next sync.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Salesforce My Domain URL. Never send a secret, key, or token.