Identity security & governance for Salesforce
Salesforce access builds through profiles, permission sets, and permission set groups in combinations that IGA tools checking only for an active license cannot resolve. Oleria maps effective access across human users and connected app NHIs into a continuous identity security graph.
Key Takeaways
- Salesforce access builds through profiles, permission sets, and permission set groups in combinations that IGA tools checking only for an active license or profile cannot resolve into the actual data objects and operations each user can reach.
- Connected apps and integration users running on OAuth tokens and API credentials accumulate Salesforce permissions independently of the human user governance process, creating NHI access to pipeline, customer data, and contract terms that no periodic certification captures.
- Oleria maps Salesforce profiles, permission sets, role hierarchies, sharing rules, and connected app grants into a continuous identity security graph, surfacing impersonation events, dormant integration users, and permission drift that native Salesforce Shield tools cannot detect without a graph model.
- Continuous Salesforce access certification through Oleria identifies users with toxic permission set combinations, service accounts with excessive object-level access, and connected apps with API permissions that exceed their documented integration scope.
This summary was created with AI and reviewed by an editor.
Ask AI to write a summary
Featured event: A CISO’s take
Join Jim Alkove and Ramy Houssaini to learn how forward-thinking security teams are addressing Enterprise AI Copilot risks.
See and control who can reach your CRM data
Oleria's Salesforce integration gives security teams a single view of who can access Salesforce data, how they got that access, and whether they use it. It covers people and non-human identities (NHIs) across Sales Cloud and Service Cloud, so Salesforce identity governance rests on facts, not guesses.
Salesforce holds your pipeline, customer data and contract terms. Access builds up through profiles, permission sets and groups, plus integrations that run on their own. Oleria maps it all in one continuous identity security graph.
Why is Salesforce access so hard to govern?
Legacy identity governance and administration (IGA) tools only check for an active license or profile. They miss how access really breaks:
- Permission drift. Users pick up Permission Sets and Permission Set Groups as roles change, leaving standing over-privilege.
- Unwatched integrations. Integration accounts and Connected Apps often run with "Modify All Data" API access, no multi-factor authentication (MFA) and no key rotation.
- Over-shared records. Sharing rules can quietly expose sensitive accounts, deals or tickets.
- Silent impersonation. "Login-as" lets IT staff act as other users without a real-time audit trail.
What Oleria shows you in Salesforce
How security teams use Oleria with Salesforce
- Rein in integration accounts. Surface unrotated API tokens, inactive service accounts and over-privileged integration profiles early.
- Keep admin impersonation traceable. Track "login-as" events continuously, so administrative actions stay traceable for SOC 2 and ISO 27001 compliance.
- Run SOX access reviews without spreadsheets. Run object-level Sarbanes-Oxley (SOX) access reviews inside Oleria instead of static exports.
- Right-size unused privilege. Oleria compares granted permissions with audit logs and flags rights unused for 30, 60 or 90 days.
How does Oleria connect to Salesforce?
Oleria connects through an OAuth 2.0 connected app with dedicated client credentials. A dedicated service account gets read-only access through an Oleria-specific Permission Set. Oleria takes an initial full snapshot, then runs continuous incremental syncs.
For step-by-step setup, read the Oleria Salesforce integration guide.
Salesforce identity governance FAQs
What is Salesforce identity governance?
Salesforce identity governance is the practice of controlling who can access Salesforce data, how they got that access, and whether they still need it. Oleria supports it by mapping users and non-human identities to their effective Salesforce object permissions, then pairing them with audit activity.
How does Oleria resolve Salesforce Permission Set Groups?
Oleria automatically unrolls nested Permission Set Groups, direct Profiles and Public Groups in Salesforce. It then evaluates object-level permissions for each identity, so security teams see true effective access instead of a list of assignments. The result shows exactly who can read, edit or delete sensitive Salesforce records.
Can Oleria govern Salesforce Connected Apps and integration users?
Yes. Oleria discovers Salesforce integration accounts, Connected Apps and automated process users alongside human employee accounts. Teams can then spot over-privileged or inactive non-human identities in Salesforce, check whether they run without MFA, and disable them from Oleria when they pose a risk.
Do you need Salesforce Shield for activity logging in Oleria?
No. Standard Salesforce login, logout and Setup Audit Trail events work with Oleria out of the box. For enhanced report execution and URI tracking, Oleria integrates with Salesforce Event Monitoring, which is part of Salesforce Shield. Teams can start with standard events and add Shield data later.
How do you run user access reviews in Salesforce?
Oleria replaces static spreadsheet exports with object-level Salesforce access reviews run directly inside Oleria. Reviewers see each identity's effective Salesforce permissions alongside real activity, including rights unused for 30, 60 or 90 days. That context supports SOX access reviews and makes it clear which privileges to remove.
See who can really reach your Salesforce customer data. Book a demo.
