Identify the Account for Granting SSPM Access

Identify the Salesforce account that you will use to log in to Salesforce during onboarding.
SSPM will use this account to establish a connection to your Salesforce instance. After SSPM establishes the connection, it will perform an initial scan of your Salesforce instance, and will then run scans at regular intervals of approximately 30 minutes. For SSPM to run these scans, the administrator account that you use to establish the initial connection must remain available. For this reason, we recommend that you use a dedicated service account to grant SSPM access. If you delete the service account, the scans will fail and you will need to onboard Salesforce again.
Required Permissions:
To grant SSPM the access it needs, the account that you use to log in must have the following permissions:
Manage Health Check
Manage Multi-Factor Authentication in User Interface
Manage Users
API Enabled
To grant SSPM the access it needs to perform third-party plugin scans, these additional permissions are required:
Download AppExchange Packages
View Real-Time Event Monitoring Data
Make note your organization's Salesforce instance URL. The instance URL has the format https://
<instance_name>
.my.salesforce.com. Don't specify a Lightning URL.
(
Optional
) Verify that your account configuration supports SSPM risky account scans.
SSPM supports risky account detection for Salesforce. For the risky account scan to work correctly, SSPM requires that you enable a particular setting on the Single Sign-on Settings page. This step is required only for the risky account scan; the configuration scans and third-party plugin scans will be unaffected. However, if you do not complete this step, the risky account scans will fail and SSPM will show that the risky account scan is unhealthy.
Log in to the Salesforce account and navigate to the Single Sign-on Settings page. You can use the Quick Find search box in Salesforce to navigate to this page.
On the Single Sign-on Settings page, locate the Delegated Authentication area, and make sure that the
Disable login with Salesforce credentials
checkbox is selected.
If the
Disable login with Salesforce credentials
checkbox is not already selected, make sure that you understand the implications of selecting this checkbox. Modifying any setting on your Salesforce Single Sign-on Settings page might affect your users.
Log out of all Salesforce accounts.
Logging out of all Salesforce accounts helps ensure that you log in under the correct account during the onboarding process. Some browsers can automatically log you in by using saved credentials. To ensure that the browser does not automatically log you in to the wrong account, you can turn off any automatic log-in option or clear your saved credentials. Alternatively, you can prevent the browser from using saved credentials by opening the Cloud Management Console in an incognito window.