> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/environment/organizations/creating-a-dedicated-salesforce-user.md).

# Creating a Dedicated Salesforce User

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

When connecting your Salesforce org to Flosum Cloud Apps, you need to provide a user account to establish and maintain the connection. It's recommended to create a dedicated Salesforce user account instead of using an employee's personal account. This prevents disruptions if, for example, an employee leaves and their personal account is deactivated. 

This article offers general instructions for two methods to create a dedicated Salesforce user for use with Flosum Cloud Apps.

* [#recommended-user-setup](#recommended-user-setup "mention") - Explains using the System Administrator profile.
* [#alternative-permission-set-model](#alternative-permission-set-model "mention") - Explains creating a custom profile and permission set.

{% hint style="info" %}

#### Flosum's Recommendation

* Creating a single Integration User in **Production** with the Admin profile.
* Create a single dedicated User in production with the **System Administrator** profile.
* Use the same user when connecting **Sandbox** and **Production** orgs.
* Take advantage of sandbox refresh inheritance. After a refresh, the **Production** dedicated user automatically exists in the refreshed sandbox.

**Why this matters:** This approach minimizes ongoing maintenance and eliminates permission gaps that may break deployments. 
{% endhint %}

## Recommended User Setup

{% stepper %}
{% step %}

### Dedicated User Creation

1. In your Salesforce **Production org**, create a user named **Flosum Integration**. 
   1. **Note**: You can use any user name.
2. Assign the **System Administrator** profile.
3. Ensure the following permissions are enabled:
   1. **API Enabled**
   2. **Query All Files**
   3. **Approved Uninstalled Connected Apps**
4. Use this user to connect **all environments** (production and sandboxes) to Flosum Cloud Apps.
   {% endstep %}

{% step %}

### Why the System Administrator Profile Is Preferred

* Grants full access to metadata retrieval and deployment.
* Reduces maintenance when Salesforce introduces new permissions.
* Ensures deployments run in a fully authorized context.

{% hint style="warning" %}

#### Warning

Using a restricted profile (even with “Modify Metadata Through Metadata API Functions”) often causes failed deployments and permission-related issues.
{% endhint %}
{% endstep %}
{% endstepper %}

## Alternative: Permission Set Model

For customers with strict security policies that prohibit granting admin access, you can create a custom profile and permission set that provides all the permissions required by Flosum Cloud Apps.

{% hint style="warning" %}
This method requires **more maintenance** after Salesforce API releases because new permissions may need to be added.
{% endhint %}

{% stepper %}
{% step %}

### Create Custom Profile and Permission Set

1. Create a **custom profile** with minimal base permissions.
2. Create a dedicated **“Flosum Integration Permissions”** permission set.
3. Add all required permissions to the permission set from the tables below.

#### Required Permissions Table

| Permission Area                | Setting                                             |
| ------------------------------ | --------------------------------------------------- |
| **Assigned Apps**              | All Apps                                            |
| **Apex Class Access**          | All classes (including system classes)              |
| **Visualforce Page Access**    | All pages                                           |
| **Custom Setting Definitions** | All custom settings                                 |
| **Custom Metadata Types**      | All custom metadata types                           |
| **System Permissions**         | See the **Required System Permissions Table** below |

#### Required System Permissions Table

| Permission                                         | Purpose                                                                   |
| -------------------------------------------------- | ------------------------------------------------------------------------- |
| **API Enabled**                                    | Required for all API calls (metadata retrieval and deployment).           |
| **Author Apex**                                    | Required to retrieve and deploy Apex classes and triggers.                |
| **Create and Customize Dashboards**                | Needed for dashboard deployments.                                         |
| **Create and Customize List Views**                | Required for deploying list views across environments.                    |
| **Create and Customize Reports**                   | Needed to retrieve and deploy reports.                                    |
| **Create Dashboard Folders**                       | Required for organizing dashboards into folders.                          |
| **Create Folders for Lightning Email Templates**   | Required for managing Lightning email template folders.                   |
| **Create Report Folders**                          | Needed for report folder creation during deployments.                     |
| **Customize Application**                          | Grants the ability to modify application settings, picklists, and fields. |
| **Edit HTML Templates**                            | Required for modifying classic email templates.                           |
| **Manage Connected Apps**                          | Required to manage connected apps used for integrations.                  |
| **Manage Custom Permissions**                      | Enables deployment of custom permissions.                                 |
| **Manage Custom Report Types**                     | Required to deploy custom report types.                                   |
| **Manage Dashboards in Public Folders**            | Grants control over public dashboards.                                    |
| **Manage Data Categories**                         | Required to deploy data categories for knowledge articles.                |
| **Manage IP Addresses**                            | Needed to retrieve and deploy org security settings.                      |
| **Manage Login Access Policies**                   | Required for deploying login access settings.                             |
| **Manage Package Licenses**                        | Required for retrieving managed package namespaces.                       |
| **Manage Password Policies**                       | Required to deploy org password policy settings.                          |
| **Manage Profiles and Permission Sets**            | Required for profile and permission set deployments.                      |
| **Manage Public Classic Email Templates**          | Needed to modify public email templates.                                  |
| **Manage Public Documents**                        | Required to manage shared documents.                                      |
| **Manage Public Lightning Email Templates**        | Needed to modify shared Lightning email templates.                        |
| **Manage Public List Views**                       | Required to modify shared list views.                                     |
| **Manage Reporting Snapshots**                     | Required to manage reporting snapshots.                                   |
| **Manage Reports in Public Folders**               | Needed for shared report management.                                      |
| **Manage Roles**                                   | Required to retrieve and deploy roles and hierarchy.                      |
| **Manage Session Permission Set Activations**      | Needed for activating session-based permission sets.                      |
| **Manage Sharing**                                 | Required to retrieve and deploy sharing rules.                            |
| **Manage Synonyms**                                | Required to manage synonyms for knowledge articles.                       |
| **Manage Translation**                             | Required to retrieve and deploy translations.                             |
| **Modify Data Classification**                     | Needed for field data classification and privacy settings.                |
| **Modify Metadata Through Metadata API Functions** | Mandatory for all deployments.                                            |
| **View All Custom Settings**                       | Required to view and deploy custom settings.                              |
| **View All Data**                                  | Required for running test classes and deployments.                        |
| **View All Users**                                 | Required for retrieving metadata with user ownership details.             |
| **View Roles and Role Hierarchy**                  | Required to retrieve role hierarchy.                                      |
| **View Setup and Configuration**                   | Required to view and deploy all metadata components.                      |
| {% endstep %}                                      |                                                                           |

{% step %}

### Create Dedicated User

1. Create a user named **Flosum Integration**. 
   1. **Note**: You can use any user name.
2. Assign the **custom profile** you created above.
3. Add the **Flosum Integration Permissions** you created above.
4. Use this user to connect **all environments** (production and sandboxes) to Flosum Cloud Apps.
   {% endstep %}
   {% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/environment/organizations/creating-a-dedicated-salesforce-user.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.