This page outlines the minimum Salesforce permissions required to successfully integrate Salesforce with Sprinklr CFM. It covers the permissions needed for the initial connector setup, ongoing data ingestion from Salesforce into Sprinklr, and write-back operations from Sprinklr to Salesforce, helping ensure a secure and seamless data exchange across systems.

Initial Connector Setup

For a new CFM Salesforce connector:

• System Administrator (Salesforce profile): The first Salesforce user added to the CFM connector must be a System Administrator.

• After the System Administrator is added, restricted Salesforce users can be added for ongoing operations.

The System Administrator is required for initial onboarding only and does not need to remain the operational user for ingestion or Salesforce Sync.

Connected application authorisation

• Approve Uninstalled Connected Apps (System permission, conditional): Required only when the connected application has not already been installed and the user is performing the initial OAuth authorisation.

Without this permission, initial authorisation may fail with OAUTH_APPROVAL_ERROR_GENERIC.

Refer to this article for more details.

Data Ingestion into Sprinklr

Data ingestion requires two Salesforce users with distinct roles:

• A user responsible for configuring the Salesforce Flow and Outbound Message that sends data to Sprinklr.

• A designated User to Send As, whose Salesforce permissions determine which records and fields are included in the Outbound Message and made available for ingestion into Sprinklr.

Ingestion Setup User

Required minimum permission:

• Manage Flow (System permission): Required to create and manage the Flow.

• Customize Application (System permission): Required to create and configure the Outbound Message.

• View All Data (System permission): Required to activate the record-triggered Flow.

Outbound Message User to Send As

The selected User to send as controls which Salesforce field values are included in the Outbound Message.

Minimum permissions:

• Read (object permission): Necessary on the source object, like Case, Task, etc.

• Read access (field-level permission): Mandatory for every field whose value needs to be part of the Outbound Message.

For instance, if the Case object contains Subject, Status, Priority, and CFM_Score__c, the chosen user needs Read Access to those fields.

If a you are unable to access a chosen field, Salesforce might exclude that field from the runtime payload.

Write-Back from Sprinklr to Salesforce

The Salesforce Sync node in CFM utilizes the chosen Salesforce user to either update or create records in Salesforce.

It is not necessary for the selected user to be a System Administrator.

Update an Existing Record

The following configuration is required for updating an existing object:

• API Enabled (system permission): It is necessary to perform API calls with Salesforce. Users with Salesforce Integration already possess this capability via their API-only profile.

• Read and Edit (object permissions): Necessary for the intended object.

• Read access and Edit access (field-level permissions): Necessary for the fields designated in the Salesforce Sync action.

For instance, to update the Status and CFM_Score__c, one needs Read and Edit permissions at the object level for Case, as well as Read and Edit permissions at the field level for both associated fields.
The removal of field-level Edit Access blocked the intended update, and taking away object-level Edit Access also hindered the update for the Case.

Create a New Record

The Salesforce Sync connector user needs these minimum permissions to create a record:

• API Enabled (system permission): It is necessary to perform API calls with Salesforce. Users with Salesforce Integration already possess this capability via their API-only profile.

• Read and Create (object permissions): Access to the target object is necessary. Salesforce does not permit creation without prior read access.

• Read and Edit (field-level security): Each field must have a record created for it.

All required values that Salesforce does not populate automatically must be supplied.

Edit permission on the object isn't needed to create a record.

If the payload includes a field the connector user can't edit, Salesforce still creates the record but leaves that field empty. No error is shown. Make sure the connector user has Read and Edit access to every field mapped in the Salesforce Sync node.

Open Point

The influence of Salesforce Outbound Messages and Salesforce Sync operations on API or event limits, licensing, scalability, and customer entitlements has not been definitively established.