> For the complete documentation index, see [llms.txt](https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/core-features/spectra-ai/data-sources/crm/salesforce.md). # Salesforce *** ### Overview LightBeam Spectra users can connect various data sources to the LightBeam application and these data sources will be continuously monitored for PII, PHI data. **Example**: Salesforce, Hubspot, ADP, Marketo, etc. After setup, you can review access visibility and activity tracking in [Salesforce Access Governance](/lxqobxw6ak7CTnsQjikH/core-features/governance/access-governance-at-a-data-source-level/salesforce-access-governance.md). *** ### Connecting Salesforce Data Source 1. Login to your LightBeam Instance.
2. Click on **DATASOURCES** on the Top Navigation Bar.
3. Click on **“Add a data source”.**

4. Search for “**Salesforce**”. Figure 2. Type Salesforce in Search Box

5. Click on **Salesforce**. Figure 2.1 Salesforce

6. Fill in the details as shown below and click on **Next**: **Basic Information** * **Data Source Name:** This is the unique name given to the data source. * **Description**: This is an optional field needed to describe the use of this data source. * **Primary Owner:** An email address of who is responsible for this data source and in case of alerts this email ID will get alerts by default. * **Entity Creation:** LightBeam Spectra detects and associates attributes based on the context and identifies whose data it is; these are called as entities. **Example**: Jane Doe is an entity for whom LightBeam Spectra might have detected Name and SSN in a monitored data source. * **Location**: The location of the data source is indicated here. * **Purpose**: The purpose of why the data is being collected/processed. * **Stage**: The stage of the data source. **Example**: Source, Processing, Archival, etc. Figure 3. LightBeam Salesforce - Basic Information

Figure 3. LightBeam Salesforce - Basic Information

**Datasource Configuration** 1. Provide the credentials as shown below (If the credentials belongs to a Salesforce sandbox account select the sandbox option) and click on **Test Connection**. Figure 4. LightBeam Salesforce - Test Connection

Figure 4. LightBeam Salesforce - Test Connection

2. Verify that you get the message “**Test** **Connection Success**”. Figure 5. LightBeam Salesforce - Connection Success

3. Click on **Save**. Now we are ready to browse through onboarded Salesforce datasource dashboard. {% hint style="info" %} **Note**: To get the Salesforce data source details please check Appendix. {% endhint %} ### Next Steps * Review the onboarded Salesforce data source in the dashboard. * See [Salesforce Access Governance](/lxqobxw6ak7CTnsQjikH/core-features/governance/access-governance-at-a-data-source-level/salesforce-access-governance.md) for access visibility and activity tracking. *** ### Appendix #### Configuring a “View All Files” Policy for the LightBeam App Salesforce requires to create a Permission set that would allow assigned users to view all files in the LightBeam app. To enable this functionality, a dedicated Permission Set must be created that grants access to the “Query All Files” capability. This permission is not automatically enabled—even for System Administrators—so it must be explicitly configured to ensure full file visibility across the application. Here is the step-by-step to get that box checked and assigned to your user: **Step 1**: Create the Permission Set Log in to Salesforce and click the Gear Icon (top right) > Setup. In the Quick Find box on the left, type Permission Sets and select it.

Click New. Label: Call it File Admin Access. API Name: (This will auto-fill). License: Leave this as --None-- (this allows you to assign it to any user regardless of their license). Click Save.

Figure 6.2 Fill required information and click save

**Step 2:** Enable "Query All Files" Inside your new Permission Set, scroll down to the Apps section and click App Permissions.

Click the Edit button at the top. Scroll down (or use Ctrl+F / Cmd+F) to find the Content section.

Figure 6.4 Select Query All Files option

Check the box for Query All Files. Note: This automatically enables "View All Data" for files. Scroll back to the top and click Save. A confirmation box will appear; click Save again.

**Step 3:** Assign it to Yourself While still in the Permission Set, click the Manage Assignments button at the top.

Click Add Assignment. Find your name in the list and check the box next to it. Click Next.

Figure 6.7 Select your name and click Next

Click Assign.

Then click on **Done.**

*** #### Steps to Generate Salesforce Data Source Credentials {% hint style="success" %} **Success Tip:** Salesforce editions vary in terms of API access. **Enterprise Edition, Unlimited Edition, Developer Edition,** and **Performance Edition** come with API access, which is essential for integrating LightBeam with Salesforce. However, **Group Edition, Essentials Edition,** and **Professional Edition** do not provide API access by default, although they can be purchased as an add-on for the **Professional Edition**. We recommend using an edition with built-in API access when creating a dedicated **Salesforce Connected App** specifically for integrating LightBeam with Salesforce. {% endhint %} 1. Log in to Salesforce as an *Administrator*. In the drop-down list of the account (in the upper-right corner), select **Setup**. Fig.7. Salesforce - Setup

2. In the left-hand pane, go to **`Apps > App Manager`**. Fig.8. Salesforce - App Manager

3. Click on **New External Client App** (in the upper right corner).

Fig 9. Salesforce - New External Client App

4. On the **External Client App Manager** page, fill in the following required fields under **`Basic Information:` External Client App Name, API Name, Contact Email.**

Fig 10. Salesforce - External Client App Manager

\ Then, save the app by clicking on the ‘**create**’ button. After clicking on ‘Create’, it will take you to this page. Then, click on edit app to update Refresh Token Policy and IP Relaxation section to a new value, as shown below.

Fig. 10.1 Salesforce - Update Refresh Token

Fig. 10.2 Salesforce - Edit Plugin Details

Fig. 10.3 Salesforce - 10.3 Salesforce - Edit refresh token policy and IP Relaxation

After making those changes, click on ‘**Save**’. Then on the ‘Settings’, open the ‘Consumer Key and Secret’ button. After Email OTP verification, it will show you the Consumer Key and Secret, save it somewhere. After copying the client ID and secret, run the script to generate refresh token, using lb-install script to generate and refresh token.

Fig. 10.5 Salesforce - Consumer Key and Secret

\ For Sandbox Salesforce, we need to whitelist [test.salesforce.com](http://test.salesforce.com/) and the Salesforce url. For Production, [login.salesforce.com](http://login.salesforce.com/) and the Salesforce url for your tenant is whitelisted in firewall if being used. **Please Note**: If the SSO is enabled and direct login to Salesforce is not available then use the SSO redirect URL of your organization.

In the Callback URL field, enter the redirect url value[ https://login.salesforce.com](https://login.salesforce.com/) * Go to API (Enable OAuth Settings), and select Enable OAuth Settings. \
5. Go to **`API (Enable OAuth Settings)`**, and select **Enable OAuth Settings**. In the **`Callback URL`** field, enter the redirect url value [`https://login.salesforce.com`](https://login.salesforce.com/) {% hint style="info" %} **Note**: If the **SSO** is enabled and direct login to Salesforce is not available then use the SSO redirect URL of your organization. {% endhint %} Fig.11. Salesforce - API Config

In the **`Selected OAuth Scopes`** field, select each of the following options, and click on **Add** individually: * **Access Connect REST API resources (chatter\_api)** * **Manage user data via APIs (api)** * **Perform requests at any time (refresh\_token, offline\_access)**

Fig.12. Salesforce - Selected OAuth Scopes

{% hint style="success" %} **Success Tip for** **Streamlining API Access and Permissions for Salesforce Integration:**\ To ensure a smooth and secure integration between LightBeam and Salesforce, you'll need specific API permissions. Ensure you have *`read access`* to all the fields in these Salesforce objects: * `Account` * `Contact` * `Case` * `CaseFeed` * `EmailMessage` * `ContentDocument` * `ContentVersion` **Note**: These permissions are typically configured during the credential generation process. For the application to function optimally, the following app permissions are needed: 1. **`Access Connect REST API resources (chatter_api)`** 2. **`Manage user data via APIs (api)`** 3. **`Perform requests at any time (refresh_token, offline_access)`** If you're planning to use the redaction feature, also secure *`write access`* to the following: 1. `CaseFeed` 2. `ContentVersion` 3. `ContentDocument` {% endhint %} Scroll down and tick the checkbox next to **`Enable Client Credentials Flow`**.

Fig.13. Salesforce - Enable Client Credentials Flow

This will open a pop-up as follows. Click on **OK**.

Fig.14 Salesforce - Enable Client Credentials Flow

6. In the **Connected Apps `(Apps > App Manager)`** list, find the App that you just created, and then click **Manage**.
7. On the **`Manage`** page, click the **Edit** button.

Fig.15 Salesforce - Connected Apps - Manage

* Under **`OAuth policies`**, select **All users may self-authorize** in the **`Permitted Users`** list, and then click the **Save** button. This is where our ‘**new**’ service account user should be ‘**applied**’ to the **Connected App** previously created within SFDC. To embed the service account within the connected app, click on **Users** on the main Home page of Salesforce.

For ‘**Connected Apps**’ -> **Lightbeam app**, under ***Client Credentials Flow*** select a user to return the **access\_token,** select ***Integration User*****.** LightBeam will generate Access Token to access Salesforce, and it will be tied to the account which approves the app while generating the refresh token(at the time of running the script). We recommend that we use the integration account: to approve this step so the access token is always tied to this account instead of any real user. **Please Note**: you are using a dedicated integration user, please add this user in View All Files permission set. Follow the steps mentioned under section “**Configuring a “View All Files” Policy for the LightBeam App**” earlier in this document at the beginning of the Appendix section.

Fig 17. Salesforce - Select integration user

After linking the service account to the Connected App, the service account should now show the connection in the OAuth Apps section, like shown below:

Fig 18. Salesforce - Service account visible in the OAuth Apps section

**Please Note**: Best practice is one integration user per one integration, for auditing and security. For access and permissions required in order for the LightBeam connection to work properly, see listed access permissions after *Figure 11* of this document. 8. Return to the **Connected Apps `(Apps > App Manager)`** list, find the App you just created, and click on **View**.
9. Note down the **Consumer Key** and **Consumer Secret under API (Enable OAuth Settings)**. These will be used for the configuration of Credential in LightBeam's Salesforce integration.

#### Generate Refresh Token using the credentials mentioned

10. Obtain the authorization code by following these steps:
**Unix/Linux/MacOS**: 1. **Copy the Refresh Token Generation Script:** Save the script to your local system. {% embed url="" %} Script to generate Salesforce refresh token {% endembed %} 2. **Make the Script Executable:** `chmod +x generate-salesforce-refresh-token.sh` 3. **Run the Script:** Execute the script by running the following command in your terminal`bash generate-salesforce-refresh-token.sh` 4. **Provide Required Information:**The script will prompt you for the following information: `Instance URL`, `Consumer Key`, `Consumer Secret`, and `Redirect URL`. **Retrieve the Refresh Token:** The script will generate a Refresh Token. Please save this token as you will need it during the Lightbeam registration process.
**Windows**: 1. **Copy the Refresh Token Generation Script:** Save the script to your local system. {% embed url="" %} Script to generate Salesforce refresh token {% endembed %} 2. **Run the Script:** Right-click on the script and select "Run with PowerShell" from the context menu. 3. **Provide Required Information:** The script will prompt you for the following information: Instance URL, Consumer Key, Consumer Secret, and Redirect URI. 4. **Retrieve the Refresh Token:** The script will generate a Refresh Token. Please save this token as you will need it during the Lightbeam registration process. {% hint style="info" %} For additional guidance or troubleshooting, you can refer to the documentation at . {% endhint %} 11. If you encounter an error that reads "**REST API is not enabled for this Organization**", follow these steps: * Click on **Setup** in the top right corner. * Go to **`ADMINISTRATION > Manage Users`** and click on **Profiles**. * Click **Edit** on the specific profile you want to update. * Scroll down to **`Administrative Permissions`** and check the **`API Enabled`** checkbox. * Save your changes. With these steps completed, you will have all the required configuration parameters like **Consumer Key, Consumer Secret, Access Token,** and **Refresh Token** to onboard the Salesforce data source to LightBeam. {% hint style="success" %} **Success Tip:** We recommend creating a dedicated **Salesforce Connected App** specifically for integrating LightBeam with Salesforce. This application should be exclusively used for this purpose and not shared or repurposed for any other clients or applications. By doing so, you ensure secure and efficient access control, as well as maintain proper management of the LightBeam-Salesforce connection {% endhint %} ### Steps to generate the Salesforce Refresh token #### **For Unix and MacOS Operating System** 1. Login to Salesforce from an account with admin access. 2. Run script bash generate-salesforce-refresh-token.sh 3. Enter the value of InstanceUrl, Consumer Key, Consumer Secret and redirect\_uri from the connected-app details. 4. Open the printed URL in the browser and accept the connected-app permissions.

5\. Copy the code parameter from the redirected URL and paste it in the console. If SSO URL is used then check the note below.

6\. Refresh token will be printed on the console. #### **For Windows Operating System** 1. Login to Salesforce from an account with admin access. 2. Run script generate-salesforce-refresh-token-powershell.ps1 with powershell. 3. Enter the value of InstanceUrl, Consumer Key, Consumer Secret and redirect\_uri from the connected-app details. 4. Open the printed URL in the browser and accept the connected-app permissions.

5\. Copy the code parameter from the redirected URL and paste it in the console. If SSO URL is used then [check the note below](https://github.com/lightbeamai/lb-installer/blob/master/salesforce/README.md#note).

6. Refresh token will be printed on the console. #### Note If the redirect URL configured in the Salesforce application is your organization's SSO URL, the code parameter will be sent to your SSO portal. To retrieve this code, quickly stop the browser immediately after opening the URL generated by the script to prevent an automatic redirect to authentication. In the developer console, you'll find a request containing the code parameter. Use this code in the script to obtain the refresh token. *** ### About LightBeam LightBeam automates Privacy, Security, and AI Governance, so businesses can accelerate their growth in new markets. Leveraging generative AI, LightBeam has rapidly gained customers’ trust by pioneering a unique *privacy-centric* and *automation-first* approach to security. Unlike siloed solutions, LightBeam ties together sensitive data cataloging, control, and compliance across structured and unstructured data applications providing 360-visibility, redaction, self-service DSRs, and automated ROPA reporting ensuring ultimate protection against ransomware and accidental exposures while meeting data privacy obligations efficiently.\ \ LightBeam is on a mission to create a secure privacy-first world helping customers automate compliance against a patchwork of existing and emerging regulations. For any questions or suggestions, please get in touch with us at: . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/core-features/spectra-ai/data-sources/crm/salesforce.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.