> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Salesforce ## After this article You'll be able to connect the Salesforce integration to Lumos and resolve common issues that arise when connecting. ## Capabilities | Functionality | Type | Sync | Provision | Description | | :- | :- | :- | :- | :- | | Users | Account | Yes | Yes | User account | | Profiles | Permission | Yes | Yes (assign only. A user must always have exactly one profile, so profiles are swapped, never removed) | [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm\&language=en_US\&type=5) | | Roles | Permission | Yes | Yes | Roles | | Permission Sets | Permission | Yes | Yes | [Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_overview.htm\&language=en_US\&type=5) | | Package Licenses | Permission | Yes | Yes | [Licenses](https://help.salesforce.com/s/articleView?id=platform.users_understanding_license_types.htm\&language=en_US\&type=5) | | Permission Set Groups | Permission | Yes | Yes | Permission Set Groups | | Public Groups | Permission | Yes | No | Public Groups (read-only) | If you use the AppStore to let users request Profiles, configure the request so they can only request one. Provisioning fails if a user selects two or more, because Salesforce allows exactly one Profile per user. | Deprovisioning Action | Type | Description | | :- | :- | :- | | Deactivate | User | Deactivate a user in Salesforce. Deletion isn't supported by Salesforce | | Release | User | Remove all permission sets from the user (does not reclaim a license) | | Transfer | User | Transfer ownership of Accounts, Tasks and Opportunities to another user | ### Activity Tracking Status: Supported. This integration syncs user last-activity timestamps from Salesforce (`LastLoginDate`). ## Required plan and roles There's no minimum Lumos plan required to connect the Salesforce integration. This integration supports full provisioning. Certain permissions can be scoped to read-only to limit what Lumos can do: * Replace **Modify All Data** with **View All Profiles** + **View All Users** * Note: this disables account creation and entitlement assignment in Lumos. Your connecting Salesforce user needs the following system permissions: | Permission | Purpose | | :- | :- | | API Enabled | Access to the Salesforce REST/SCIM APIs (connection fails without it) | | Manage Package Licenses | Sync and assign/unassign package licenses | | Customize Application | Read application and connected-app metadata | | Modify All Data | **Required for provisioning.** Covers account creation and assigning profiles/permission sets | | Manage Connected Applications, View All Profiles, View All Users | Alternative set if Modify All Data is not granted (read-only mode) | | Manage Profile and Permission Sets | Read and assign profiles and permission sets | For **Sandbox instances**, these are additionally required to pull user entitlements: * PermissionsManageUser * PermissionsViewAllUsers Where to enable these permissions (Salesforce admin UI): * Option A (Profile): **Setup → Users → Profiles →** select the user's Profile **→ Edit → Administrative Permissions / System Permissions** * Option B (Permission Set, recommended): **Setup → Users → Permission Sets → New** (for example "Lumos Connector Access") **→ System Permissions → Edit**, enable the permissions above, then **Manage Assignments → Add Assignment** to assign it to the connecting user. If you want to use Lumos to provision access to Salesforce profiles or permission sets, `Modify All Data` is **required**. Lumos strongly recommends connecting with a **dedicated Salesforce service-account user** (with an API-capable license) rather than a named employee, so the connection doesn't break when an individual's role changes. Don't disable UI login or revoke permissions from this account after connecting. Doing so breaks the connector. ## Read-only access vs provisioning **Is read-only possible?** Some scopes can be reduced, but pure read-only is not possible. Replacing **Modify All Data** with **View All Profiles** and **View All Users** on the connecting user gives Lumos a read-only connection. **What read-only requires.** A Salesforce user (ideally a dedicated service account) with **API Enabled**, **Manage Package Licenses**, **Customize Application**, **Manage Profile and Permission Sets**, and the read-only alternative set (**Manage Connected Applications**, **View All Profiles**, **View All Users**) instead of **Modify All Data**. Sandbox connections additionally need **PermissionsManageUser** and **PermissionsViewAllUsers** to pull entitlements. Follow the steps in Instructions, granting the read-only permission set instead of **Modify All Data**. **What full provisioning requires.** The same permission set with **Modify All Data** in place of the read-only alternative. This is required for account creation and for assigning profiles or permission sets. **Watch out for.** Switching between the two modes means updating the connecting user's Profile or Permission Set in Salesforce, not reconnecting the integration, but read-only mode disables account creation and entitlement assignment in Lumos entirely. Don't disable UI login or revoke permissions from the connecting service account after connecting, either action breaks the connector regardless of which mode you chose. ## Instructions ### In Salesforce 1. Confirm the connecting user has the permissions above (create and assign a Permission Set via **Setup → Users → Permission Sets** if needed). 2. Note your Salesforce subdomain, the part of your My Domain URL before `my.salesforce.com`. Include the entire value, including any `--` characters (copying the URL can silently collapse `--` to `-`, which produces an incorrect subdomain). ### In Lumos 1. Find the Salesforce card in your Lumos integrations ([Reconnect](https://app.lumosidentity.com/integrations?tab=connected) or [add new](https://app.lumosidentity.com/integrations?tab=can_integrate)). 2. Enter your Salesforce subdomain when prompted. 3. Log into your production (or sandbox) Salesforce tenant as the connecting user and accept the requested OAuth scopes (`full`, `refresh_token`, `offline_access`) to complete the connection. ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Troubleshooting ### I can't connect the Salesforce integration * Make sure your Salesforce user has the required permissions (including **API Enabled**) and that you're logged into the correct Salesforce environment. * Check that you've entered the correct Salesforce subdomain. If your subdomain includes multiple dashes, input the whole subdomain up until the `my.salesforce.com` domain. ### The Salesforce integration connected for Sandbox but isn't showing any users or permissions * Make sure the URL provided follows the format in the instructions. Copying the URL can silently shorten `--` to a single `-`, which leads to an incorrect subdomain value. * Sandbox connections also require the `PermissionsManageUser` and `PermissionsViewAllUsers` permissions to pull user entitlements. ### I can't remove a Profile entitlement * Salesforce requires every user to have exactly one Profile at all times, so Profiles can't be unassigned, only replaced by assigning a different Profile. Attempting removal returns a 400 ("Cannot remove a profile from an existing user"). ### The connection broke after you locked down the service account * Disabling UI login for, or revoking permissions from, the connecting service account after setup breaks the connector. Keep the account's access (including its MFA/SSO method) intact, and reconnect if credentials changed. ### Lumos is syncing community or portal users you don't want to see * If your Salesforce tenant includes Communities or Partner Portal users and you don't want them in Lumos, contact Lumos Support at [support@lumos.com](mailto:support@lumos.com) or via Slack. Lumos can enable a setting that stops syncing these users, removing them from its Salesforce API calls. ### Account creation reports a duplicate username * If Create Account hits a `409 DUPLICATE_USERNAME`, the username usually belongs to a deactivated Salesforce user. Lumos falls back to reactivating that existing account. ### Can Lumos freeze a Salesforce user? * No — the connector deactivates users, it doesn't freeze them. For offboarding, deactivate the user, optionally transfer data, and release permissions. Lumos also syncs Last Login/Activity for reporting. ### SCIM provisioning fails with 400 "User can only have one email" * The email attribute sync is sending more than one email value per user. Disable the email attribute sync so a single email is sent, then retry the affected error tasks. ### Connecting a second or third Salesforce instance * Multiple Salesforce instances (for example UAT and Production) are supported. Connect each as its own Lumos integration with its own subdomain rather than reusing one connection.