Dedicated integration users per external system
Key Takeaway
Give each external system its own integration user. Assign that user the Salesforce Integration user license, the Minimum Access - API Only Integrations profile, and its own permission sets, so each system gets API-only access limited to the data it needs.
An integration user is a Salesforce user that an admin creates and manages so an external system can authenticate and work with org data through the API. Salesforce recommends one dedicated integration user for each integration, instead of one user shared across systems. Each external system then gets only the data and functionality it needs, and its activity is easier to control and trace.
One integration user per system
Integration users are required for authentication and for accessing external integrations with a Salesforce org. Each integration user is a unique user that a Salesforce admin creates and manages through the standard user setup process.
Following the principle of least privilege, Salesforce recommends creating one Salesforce user for every integration. Assign a different user to each calling system, domain, use case, or API resource, so each user is limited to its own subset of data and functionality. Don't reuse an existing integration user for another integration. Each integration user gets its own permission sets, so the access you grant one system stays with that system.
Salesforce gives three reasons for dedicated integration users:
- More control over operations.
- Better traceability of transactions, because each user's activity belongs to one system.
- Less impact if a user or integration is compromised, because each user reaches only its own subset of data.
A credit union connects two external systems to Salesforce: a document signing service and a credit scoring service. The admin creates two integration users, one for each system. The signing service's user gets permission sets for the agreement records it updates. The scoring service's user gets permission sets for the loan application records it scores. When a loan application changes through the scoring service's user, the change traces back to that one system. If someone steals the signing service's credentials, they get the signing service's access, not the access granted to the scoring service's user.