Identify the Account for Granting SSPM Access

1. Identify the Salesforce account that you will use to log in to Salesforce during onboarding.

   SSPM will use this account to establish a connection to your Salesforce instance. After SSPM establishes the connection, it will perform an initial scan of your Salesforce instance, and will then run scans at regular intervals. Depending on the access scopes that the account can grant to SSPM, SSPM can run configuration scans of your Salesforce settings, risky account scans, identity scans, and scans of third-party plugins that are connected to your Salesforce instance. For SSPM to run these scans, the Salesforce account that you use to establish the initial connection must remain available. For this reason, we recommend that you use a dedicated service account to grant SSPM access. If you delete the service account, or change the account's password, the scans will fail and you will need to onboard Salesforce again.

   The account that you use to connect to your Salesforce instance can have the full permissions that SSPM requires to complete all its scans and perform automated remediation. You can also use an account that has reduced permissions, in which case some SSPM function will not be available. For example, you might want to use an account with reduced permissions if your organization places limits on service-account permissions. During onboarding, SSPM gives you an option to connect with read-only permissions or with read and write permissions. The onboarding screen also lists the API scopes that SSPM requires for each scan type. After establishing a connection, SSPM will notify you if it is unable to run certain scans because the account did not have the required permissions to grant access to certain scopes.

   Permissions for Read Access: To grant SSPM reduced permissions to perform configuration scans, identity scans, and risky account scans, the account that you use to connect SSPM to your Salesforce instance requires the following permissions. With only these reduced permissions, SSPM will not be able to perform third-party plugin scans or automated remediation.

   Scan Type	Required Permission
   Configuration	API Enabled View Health Check
   Risky Accounts	API Enabled In addition to API Enabled permission, you must also disable login with Salesforce credentials for the account. You can do this by selecting the Disable login with Salesforce credentials checkbox on the Single Sign-on Settings page. More information on this setting is available in the following step.
   Identity	API Enabled View Event Log Files View Setup and Configuration View All Users

   The Identity permissions described in the preceding table typically give SSPM access to the Salesforce objects and fields that SSPM needs to complete its identity scans. During onboarding, SSPM will verify that it can access these objects and fields. If it cannot access these fields, onboarding will fail with the following message.

   Your Salesforce org may be missing required fields or permissions for our Identity security moitoring queries.

   If onboarding fails with this message, verify that the account can access the required objects and fields. See Required Objects and Fields for Identity Scans for more information.

   Additional Permissions for Write Access: To grant SSPM full read and write access, the account that you use to connect SSPM to your Salesforce instance requires the permissions for read access described above, and also the following additional permissions. These additional permissions are required for third-party plugin scans, and for automated remediation of misconfigured settings.

   Scan Type / Remediation	Required Permission
   Configuration Remediation	API Enabled View Health Check Download AppExchange Packages
   Third-Party Plugins	API Enabled Download AppExchange Packages

   To grant the permissions to the user account, you can add the permissions to a permission set, and then assign the permission set to a Salesforce user account.

   1. Add the required permissions to a permission set.

      1. From the setup home page in Salesforce, select UsersPermission Sets.
      2. You can create a new permission set or edit an existing permission set to add the permissions.
         To create a permission set, click New, fill in the basic information, and Save.
         To edit an existing permission set, click its name in the Permission Set Label column.

      3. On the setup page for the permission set, locate the System area and navigate to System Permissions.

      4. On the System Permissions page for the permission set, Edit the permissions.
      5. In the list of system permissions, select the Enabled check box for each of the required permissions.
         When you enable a permission that requires other permissions, Salesforce will automatically enable the other required permissions.

      6. Save your changes.
   2. Assign the permission set to a Salesforce user account.

      1. From the setup home page in Salesforce, select UsersUsers.
      2. From the list of users, click the name of the user.
      3. On the setup page for the user, locate the Permission Set Assignments area to Edit Assignments.

      4. On the Permission Set Assignments page, locate the permission set in the Available Permission Sets list, Add it to the Enabled Permission Sets list for the user, and Save your changes.
2. Verify that your account configuration supports SSPM risky account scans.

   SSPM supports risky account detection for Salesforce. For the risky account scan to work correctly, SSPM requires that you enable a particular setting on the Single Sign-on Settings page. This step is required only for the risky account scan; the configuration scans and third-party plugin scans will be unaffected.

   1. From the setup home page in Salesforce, navigate to the Single Sign-on Settings page. To navigate to this page, select IdentitySingle Sign-on Settings.
   2. On the Single Sign-on Settings page, locate the Delegated Authentication area, and make sure that the Disable login with Salesforce credentials checkbox is selected.

      If the Disable login with Salesforce credentials checkbox is not already selected, make sure that you understand the implications of selecting this checkbox. Modifying any setting on your Salesforce Single Sign-on Settings page might affect your users.

3. Make note of your organization's Salesforce instance URL. The instance URL has the format https://<instance_name>.my.salesforce.com.
4. Log out of all Salesforce accounts.

   Logging out of all Salesforce accounts helps ensure that you log in under the correct account during the onboarding process. Some browsers can automatically log you in by using saved credentials. To ensure that the browser does not automatically log you in to the wrong account, you can turn off any automatic log-in option or clear your saved credentials. Alternatively, you can prevent the browser from using saved credentials by opening the Cloud Management Console in an incognito window.