> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/salesforce.md).

# Salesforce

This page documents how to install P0 for a Salesforce organization so you can manage just-in-time access to Salesforce permission sets. Users request a permission set, and P0 assigns it to their Salesforce user when access is approved and removes it when access expires.

{% hint style="warning" %}
The Salesforce integration is in preview. Functionality and configuration may change.
{% endhint %}

P0 assigns and removes permission sets directly through the Salesforce REST API. This lets P0 revoke entitlements when access expires, which Salesforce's SCIM provisioning does not support.

### Before you begin

You need administrator access to your Salesforce organization to complete these steps. In Salesforce:

1. Create a permission set for P0 to use.
2. Grant that permission set the **Assign Permission Sets** and **View All Users** permissions.
3. Create an external client application.
4. Add the **Manage user data via APIs (api)** OAuth scope to the application.
5. Assign the permission set you created to the external client application.
6. Enable the client-credentials flow for the application.

When you create the external client application, Salesforce generates a **Consumer key** and **Consumer secret**. You provide these to P0 in the next section.

{% hint style="info" %}
P0 maps each requestor to a Salesforce user by email address. Every user who requests Salesforce access must already exist as an active Salesforce user whose email matches their P0 identity. P0 assigns permission sets to existing users; it does not create Salesforce users.
{% endhint %}

### Set up the Salesforce integration

1. Open the P0 dashboard at [p0.app](https://p0.app) and log in to your organization.
2. In the sidebar, click **Integrations**. Under **Resources**, click **Salesforce**.
3. Select the **Access management** component.
4. When prompted for the **My Domain name**, enter your Salesforce My Domain. P0 builds your login URL from this value as `{my-domain-name}.my.salesforce.com`.
5. (Optional) If your organization uses a non-standard domain suffix, enter the complete login URL in the **Full Salesforce domain** field, including the suffix (for example, `my-org-domain.foo.my.salesforce.com`). P0 uses this value verbatim instead of the default. Leave the field empty to use the default. The value must end with `my.salesforce.com`.
6. Enter the **Consumer key** and **Consumer secret** from your external client application.
7. Click **Next** to finish.

When you finish installation, P0 validates the credentials by listing your Salesforce users and permission sets. If validation fails, confirm that the P0 permission set has the **Assign Permission Sets** and **View All Users** permissions and that the client-credentials flow is enabled.

{% hint style="info" %}
Use the **Full Salesforce domain** field only when your login URL doesn't follow the standard `{my-domain-name}.my.salesforce.com` pattern. The value must end with `my.salesforce.com`; P0 rejects other domains during installation.
{% endhint %}

{% hint style="success" %}
You are ready to make just-in-time requests for Salesforce permission sets with P0. See [Requesting Salesforce access](/integrations/resource-integrations/salesforce/requesting-access.md).
{% endhint %}

### What P0 grants

P0 grants Salesforce **permission sets**. A single request can include one or more permission sets. P0 lists all permission sets in your organization except profiles, so users select from your existing permission sets.

To grant least-privileged access, create permission sets that scope access to only the objects, fields, and permissions a user needs, then make those permission sets available through P0. For more information, see Salesforce's documentation on permission sets.

### Limitations

* The integration is in preview.
* P0 grants Salesforce permission sets only. Profiles are not available for request.
* Each requestor must already exist as an active Salesforce user whose email matches their P0 identity.