Salesforce Release 5x Free Integration User Licenses
If you’re a Salesforce professional working with a variety of systems integrated with your Salesforce instance through an integration user, it’s likely that this is the announcement you’ve been waiting for – a dedicated user license is finally available!
In addition to the extremely popular Einstein GPT announcement at TrailblazerDX 2023, Salesforce have shared more information about a wide variety of enhancements. This includes a new type of license you will be able to assign to users: the Salesforce Integration User license. Let’s go through what we know so far about this new license, including the benefits it brings!
What Changes For You?
As you know, each Salesforce user needs to have one license assigned, which ensures their access to the functionality they need to use within Salesforce. For example, a user with a Salesforce license has access to the full CRM functionality and apps, while one with a Salesforce Platform license has their access limited to custom apps. You can view all the available licenses in your org, including this new one, by navigating to the Company Information page in Setup.
Developer Edition orgs include one Salesforce Integration license, while Enterprise, Unlimited, and Performance Edition orgs include five free licenses.
Make sure you take a look over the Standard User Licenses and all other User License types when deciding which is the best option for a certain scenario.
The new Salesforce Integration license is available after March 14, 2023 and is specifically designed for system-to-system integrations, as it only provides the user with API access. Simply put, your instance’s functionality or data cannot be accessed through the user interface by users who are assigned this license type.
This means that it’s time to reevaluate the existing integration for users in your Salesforce org and properly migrate them to an API-only access license – this will free up one of the other licenses for an actual human user who can better make use of it. The Salesforce Integration API permission set license (which includes many of the permissions generally granted to Salesforce Admins) should be used to extend and restrict user or object permissions, alongside other relevant permission sets to ensure access to an uniquely tailored sub-set of data, thus reducing risks of a potential data leak.
Additionally, the individual permissions associated with the Salesforce Integration license or the API Only profile cannot be removed – this also applies to clones of the profile.
Advantages of Using the API Only License
It is no surprise that the biggest advantage for all organizations will be the associated cost, or at least to begin with, the fact that there isn’t one! There will be five Salesforce Integration user licenses readily available per org, in the Performance, Enterprise, and Unlimited editions. Additionally, there’s also one included with every Developer Edition org.
After these first five licenses are consumed, the extra ones will only cost $10 per user per month, making it quite a bargain, especially considering that, until now, you were most likely using a full Salesforce license which is more costly.
Of course, in addition to the monetary aspect, there is the important question of security and traceability. The best practice is to have one user per integration to properly track and identify the transactions at every integration point, and maintain granular control over access – with the new license type and reduced cost, there shouldn’t ideally be any reason to reuse the same user for multiple individual integrations.
Summary
All in all, the Salesforce Integration user license is bound to make your life as a Salesforce Admin (with a limited number of available licenses) easier – you can expect more security and granularity in terms of controlling integration access, at a much lower cost.
sakshi kanoje
It’s a great news
Wiam
I thought it was announced that 10 integration user licenses are for free by Jennifer W. Lee (Salesforce).
Christine Marshall
Jenn’s tweet did say 10 licenses, however, during the True to the Core session they said it was 5 licenses.
Andreea D
The True to the Core session was indeed the correct information as Salesforce has also noted in the documentation that there will be five Salesforce Integration licenses available : https://help.salesforce.com/s/articleView?id=sf.users_license_types_available.htm&type=5
Spencer
Any thoughts on when these will show up? Checking in our org and not seeing this as a Licene type when creating a new user.
Andreea D
Hello Spencer!
The licenses have started showing up in production, sandbox and developer edition orgs already, but most likely Salesforce is doing a phased rollout to all the orgs.
Corné
This is great! However, there doesn’t seem to be any way to access ServiceCloud or Salescloud Object with the ‘Salesforce Integration’-license. Or am I missing something?
Tom Bassett
Thanks for sharing . Currently this doesn’t support PSL (Permission Set Licences) for objects/features such as CPQ. Maybe that’s worth adding in ?
Tom Bassett
As in to access these features you need a paid PSL on top
Andreea D
Hello Tom!
Thank you for highlighting! Indeed definitely worth mentioning that for additional products such as CPQ the paid PSL will be needed on top as it happened before.
Jenni
Can this new integration user license be used with MC Connect? As that requires system admin permission? SF article doesn’t mention MC Connect….
Andreea D
Hello Jenni!
While the documentation per say doesn’t mention MC, it does mention that “The Salesforce API Integration permission set license makes available many of the same user and object permissions typically granted to Salesforce admins.” and that you can combine permissions (the source is this page: https://help.salesforce.com/s/articleView?id=sf.integration_user.htm&type=5) – it may worth testing it out to know for sure if it is a suitable option.
Thank you!
Charlie
Has anyone started to see these licences appear in their Orgs?
In the TttC session Parker suggested it would be happening this week, but I’m not seeing them in my Orgs yet
Andreea D
Hello Charlie! Yes, they started showing up in orgs already, but most likely Salesforce has done a progressive rollout.
David Allen
This Salesforce article announces it is available after March 14, 2023.
However, we tried to use it, could not find it, and submitted a case to SF support. They finally admitted they are rolling it out gradually and have had some related issues with the API Only profile.
Andreea D
Thank you for sharing, David! This seems to be the case indeed, as some orgs do have the licenses available and some still don’t.
Jeff Hunsaker
Take caution when you start migrating. Our initial look at this in a Sandbox showed that when the license type is changed from Standard License to INtegration License, ALL PERMISSION sets are removed from the User. This includes permission sets not otherwise tied to a license type. We are reviewing this further, but make sure to first document all Permission sets associated to a User prior to changing the license type. If anyone has more details on how this should work, please indicate here. the permission sets are the KEY way to identify FLS for integration users.
Andreea D
Hello Jeff! Thank you for sharing, I’ve also made the change in a sandbox however when changing the license I did receive a pop-up stating that all Permission Sets will be removed, before actually saving the user record with the new license. Not sure why the pop-up wouldn’t appear for you as well in this case though, but it is indeed good practice to document the permissions.
Meghan Halley
This is long overdue and awesome!
Andreea D
It certainly is a great addition!
Julian Olsen
Hey Folks,
anyone already discovered the object permission settings for Account, Contact, etc.? They are not configurable in a profile, that has the license “Salesforce Integration” configured neither in a permission set.
Cheers
Julian
Andreea D
Hello Julian! What I discovered so far is that the object permissions seem to be included in the Salesforce API Integration permission set license. If you navigate to the Permission Set License assignment page for an user, you will notice that on the right hand side next to his PSL all the permissions and object permissions as written down, such as for example “Accounts: Read, Create, Edit, Delete, View All, Modify All”
Nick
Have also found this to be a limitation.
Sam C
Also found this, and extended those permissions out using a permission set assigned to the permission set licence, but has anyone proven use of this integration API user for deployments specifically? Using Workbench or any other deployment tool. I’ve found a lot of inconsistencies compared with using the default sysadmin profile, which of course has pretty much everything enabled
Jacob H
Does the Salesforce Integration license allow access to all SF objects or just custom apps? (i.e. is it more similar to Salesforce license or Salesforce Platform license?)
Thank you!
Andreea D
Hello Jacob! Based on what I could see in the breakdown of the Permission Set License from the PSL assignments page object access is granted for standard object such as Accounts,Contacts and Opportunities as well.
Ben
What I have found is that the profile contains zero object access, but lots of field access. Odd because they’re moving away from profiles for field access.
The “Salesforce Integration” license only allows for custom object access.
The “Salesforce API Integration” license allows for standard object access to be added, but doesn’t actually add any access.
What I did was create the user with the Salesforce integration license and then applied the Salesforce API Integration PSL. Then I created permission sets specifying the Salesforce API Integration PSL to grant standard object access (just so they don’t get assigned to other license type users) and assigned those to the user.
Jen
Thanks Ben! This was very helpful. I was very confused as it seems like the access is in the Salesforce API Integration PSL for access to standard objects (contact, account etc) but the system I’m trying to use this with (Informatica) couldn’t see those objects. Maybe 3rd party vendors need to ‘catch-up’?
I also created a Permission Set with NO license type so I could add access to standard objects.
I’m not sure what you mean (or I don’t know how) by “specifying the Salesforce API Integration PSL”
Harsha
Hi Andrea,
I want to convert a Salesforce license profile to Salesforce API Integration Profile.
I have cloned the API profile and created a new one with similar permissions with a permission set created using Salesforce API Integration Permission set License.
I have a custom object whose sharing setting is controlled by parent because it has master details fields of Account and Opportunity objects in it.
I have already assigned all the high-level permissions of parent objects in the permission set created earlier.
But, I’m still unable to access the custom object with this API Integration Profile.
Could you please help me if this is a bug or if Am I missing any security settings?
Many Thanks in advance!!
Bryan Douglas
With the Salesforce API Integration license, to get access to both standard and custom objects, create a permission set with no license selected. Then you may add every object available. Thats al!
Saar Machtinger
Great post !!!
I have some flows executing after user is created. Any idea how I distinguish the new license type so my flow wouldn’t run ?
* beside adding a check box to do that.
Andreea D
Hello Saar! Happy you enjoyed the post.
I would try to look either at the License Name or License definition key: SELECT Profile.UserLicense.Name, Profile.UserLicense.LicenseDefinitionKey FROM User then use it in the flow {!$Record.Profile.UserLicense.LicenseDefinitionKey} = ‘x’ (assuming it’s a record triggered flow on the User, Record would be the user and x would be the License definition key you want to run it for, or if you want to exclude it would be != ‘y’). If you go for this option, please let me know how it goes.
Georgia Serpe
Hi all. I’ve provisioned one of these licenses — we use a custom domain with SSO and the user is having issues logging in — is anyone experiencing the same?