Skip to main content

​
After this article

You’ll be able to connect the Salesforce integration to Lumos and resolve common issues that arise when connecting.

​
Capabilities

If you use the AppStore to let users request Profiles, configure the request so they can only request one. Provisioning fails if a user selects two or more, because Salesforce allows exactly one Profile per user.

​
Activity Tracking

Status: Supported. This integration syncs user last-activity timestamps from Salesforce (LastLoginDate).

​
Required plan and roles

There’s no minimum Lumos plan required to connect the Salesforce integration. This integration supports full provisioning. Certain permissions can be scoped to read-only to limit what Lumos can do:
  • Replace Modify All Data with View All Profiles + View All Users
    • Note: this disables account creation and entitlement assignment in Lumos.
Your connecting Salesforce user needs the following system permissions: For Sandbox instances, these are additionally required to pull user entitlements:
  • PermissionsManageUser
  • PermissionsViewAllUsers
Where to enable these permissions (Salesforce admin UI):
  • Option A (Profile): Setup → Users → Profiles → select the user’s Profile → Edit → Administrative Permissions / System Permissions
  • Option B (Permission Set, recommended): Setup → Users → Permission Sets → New (for example “Lumos Connector Access”) → System Permissions → Edit, enable the permissions above, then Manage Assignments → Add Assignment to assign it to the connecting user.
If you want to use Lumos to provision access to Salesforce profiles or permission sets, Modify All Data is required. Lumos strongly recommends connecting with a dedicated Salesforce service-account user (with an API-capable license) rather than a named employee, so the connection doesn’t break when an individual’s role changes. Don’t disable UI login or revoke permissions from this account after connecting. Doing so breaks the connector.

​
Read-only access vs provisioning

Is read-only possible? Some scopes can be reduced, but pure read-only is not possible. Replacing Modify All Data with View All Profiles and View All Users on the connecting user gives Lumos a read-only connection. What read-only requires. A Salesforce user (ideally a dedicated service account) with API Enabled, Manage Package Licenses, Customize Application, Manage Profile and Permission Sets, and the read-only alternative set (Manage Connected Applications, View All Profiles, View All Users) instead of Modify All Data. Sandbox connections additionally need PermissionsManageUser and PermissionsViewAllUsers to pull entitlements. Follow the steps in Instructions, granting the read-only permission set instead of Modify All Data. What full provisioning requires. The same permission set with Modify All Data in place of the read-only alternative. This is required for account creation and for assigning profiles or permission sets. Watch out for. Switching between the two modes means updating the connecting user’s Profile or Permission Set in Salesforce, not reconnecting the integration, but read-only mode disables account creation and entitlement assignment in Lumos entirely. Don’t disable UI login or revoke permissions from the connecting service account after connecting, either action breaks the connector regardless of which mode you chose.

​
Instructions

​
In Salesforce

  1. Confirm the connecting user has the permissions above (create and assign a Permission Set via Setup → Users → Permission Sets if needed).
  2. Note your Salesforce subdomain, the part of your My Domain URL before my.salesforce.com. Include the entire value, including any -- characters (copying the URL can silently collapse -- to -, which produces an incorrect subdomain).

​
In Lumos

  1. Find the Salesforce card in your Lumos integrations (Reconnect or add new).
  2. Enter your Salesforce subdomain when prompted.
  3. Log into your production (or sandbox) Salesforce tenant as the connecting user and accept the requested OAuth scopes (full, refresh_token, offline_access) to complete the connection.

​
API Endpoints Used

​
Troubleshooting

​
I can’t connect the Salesforce integration

  • Make sure your Salesforce user has the required permissions (including API Enabled) and that you’re logged into the correct Salesforce environment.
  • Check that you’ve entered the correct Salesforce subdomain. If your subdomain includes multiple dashes, input the whole subdomain up until the my.salesforce.com domain.

​
The Salesforce integration connected for Sandbox but isn’t showing any users or permissions

  • Make sure the URL provided follows the format in the instructions. Copying the URL can silently shorten -- to a single -, which leads to an incorrect subdomain value.
  • Sandbox connections also require the PermissionsManageUser and PermissionsViewAllUsers permissions to pull user entitlements.

​
I can’t remove a Profile entitlement

  • Salesforce requires every user to have exactly one Profile at all times, so Profiles can’t be unassigned, only replaced by assigning a different Profile. Attempting removal returns a 400 (“Cannot remove a profile from an existing user”).

​
The connection broke after you locked down the service account

  • Disabling UI login for, or revoking permissions from, the connecting service account after setup breaks the connector. Keep the account’s access (including its MFA/SSO method) intact, and reconnect if credentials changed.

​
Lumos is syncing community or portal users you don’t want to see

  • If your Salesforce tenant includes Communities or Partner Portal users and you don’t want them in Lumos, contact Lumos Support at support@lumos.com or via Slack. Lumos can enable a setting that stops syncing these users, removing them from its Salesforce API calls.

​
Account creation reports a duplicate username

  • If Create Account hits a 409 DUPLICATE_USERNAME, the username usually belongs to a deactivated Salesforce user. Lumos falls back to reactivating that existing account.

​
Can Lumos freeze a Salesforce user?

  • No — the connector deactivates users, it doesn’t freeze them. For offboarding, deactivate the user, optionally transfer data, and release permissions. Lumos also syncs Last Login/Activity for reporting.

​
SCIM provisioning fails with 400 “User can only have one email”

  • The email attribute sync is sending more than one email value per user. Disable the email attribute sync so a single email is sent, then retry the affected error tasks.

​
Connecting a second or third Salesforce instance

  • Multiple Salesforce instances (for example UAT and Production) are supported. Connect each as its own Lumos integration with its own subdomain rather than reusing one connection.