Controlling which users can authorize connected apps
Key Takeaway
To limit a connected app to chosen users, change "Permitted Users" from the default "All users may self-authorize" to "Admin approved users are pre-authorized". Then assign profiles or permission sets. The "Manage Profiles" and "Manage Permission Sets" options don't appear on the Connected App Detail page until you make that change.
A connected app lets an external application connect to Salesforce through APIs. The connected app uses standard protocols such as OAuth, SAML and OpenID Connect to authorize, authenticate and provide single sign-on for that application. Admins decide who can authorize and use each connected app, mainly with the Permitted Users OAuth policy plus profiles and permission sets. Org-wide controls add another layer: blocking an app, the required restriction on uninstalled connected apps, and the optional API Access Control feature.
The Permitted Users setting
After a connected app is installed in your org, you set its policies, including who can use it and where they can access it from. The main control over who can use the app is the Permitted Users setting under OAuth Policies. Permitted Users has two options.
| Option | Who gets access | First access |
|---|---|---|
| All users may self-authorize | Any user in the org can authorize the app after signing in | Each user must approve the app the first time they access it |
| Admin approved users are pre-authorized | Only users with a profile or permission set assigned to the app | Those users can use the app without authorizing it first |
"All users may self-authorize" is the default. Salesforce recommends "Admin approved users are pre-authorized" because it gives the admin the most control over who can access the app.
The "Use Any API Client" permission overrides Permitted Users. A user with this permission can access any connected app, even one set to "Admin approved users are pre-authorized". So when you assign the permission, you give up control over authorization. The permission is intended only for a limited number of admins.