Skip to main content

Required Salesforce Permissions - New in September 2025

Updated

On Aug 18, 2025, Salesforce announced new security requirements going into effect on Sept 2, 2025. These requirements change who can initially connect to oAuth applications that have not been approved in your Salesforce org. The changes impact the entire Salesforce ecosystem, including SalesIntel.

What's Changing

Previously, all users could simply connect to the oAuth app and start exporting data from SalesIntel. Now, a second step is required that users with specific permissions "Install" the app. Users without these permissions cannot connect and export until the app is installed. Installation is a second, separate step that occurs in the Salesforce org after connecting the integration. This is a one-time process; after installation, all additional users can simply connect.

What Permissions are Required

For most orgs, the permission "Approve Uninstalled Connected Apps" is sufficient to connect and install. This permission was added to all standard System Administrator profiles in Summer 2025. If you do not use a standard profile or if you would like to delegate this ability to a user on a different profile, you can add this permission to the appropriate custom profile.

If your org has API Access Controls enabled, the required install permission is "Use Any API Client". 

These permissions are not needed for all users who want to connect SalesIntel and Salesforce. Once the app is installed, users without this permission can connect and use it.

What Steps Should I Take?

Existing accounts with already connected users

Your connected users will be maintained. However, new users will not be able to connect until the app is installed in the Salesforce org. Install the app early to avoid friction as your team grows and changes.

Accounts who have never connected to Salesforce from SalesIntel

Your first connected user must have one of the permissions outlined above or they will not be able to connect. Once connected, this user should then install the app so that all other users can connect. The app does not appear in Salesforce until one user successfully connects.

How to Install the App

Once at least one user is connected, go to Setup > Connected App OAuth Usage > SalesIntel and click “Install”. Confirm the installation. That's it!

  • We recommend setting the Permitted Users setting to “All users may self-authorize”.

  • We recommend setting the IP Relaxation setting to “Relax IP Restrictions” if the org has IP restrictions in place for their users (this is because our server IP addresses are not permanent). If you do not have restrictions in place at all, this setting won’t matter.

Step 1 - Navigate to Connect App OAuth Usage and find the SalesIntel App. Click "Install".

 

Step 2 - Approve the installation.

 

Step 3 - Confirm the recommended settings.

oAuth App Errors

If a user tries to connect the SalesIntel oAuth application, it has not been installed, and they do not have the required permissions, they will receive an error that looks like this:

This error includes: “We can’t authorize you because of an OAuth error. For more information, contact your Salesforce administrator.” and the OAUTH_APPROVAL_ERROR_GENERIC message.

Additionally, when you review the url shown on this page, it will include the parameters that follow:

  • error=invalid_client
  • error_description=app must be installed into org

Here is a sample url with this error shown in the url parameters: 

https://myapp.com?error=invalid_client&error_description=app+must+be+installed+into+org

Powered by Zendesk