Salesforce Organization User guide
Mainos
Mainos
Salesforce.com: Spring ’13
Set Up and Maintain Your Salesforce Organization
Last updated: March 8, 2013
© Copyright 2000–2013 salesforce.com, inc. All rights reserved. Salesforce.com is a registered trademark of salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their respective owners.
Table of Contents
Table of Contents
Set Up and Maintain Your Salesforce Organization...............................................................................1
Index...............................................................................................................................................542
i
Table of Contents ii
S
ET
U
P AND
M
AINTAIN
Y
OUR
S
ALESFORCE
O
RGANIZATION
Welcome, Salesforce Administrators!
Available in: All Editions
As a Salesforce administrator—that is, a user assigned to the Administrator profile—you’re responsible for setting up your online organization, which means adding users and configuring the system for your needs.
This guide contains the details you need to set up and maintain a Salesforce organization.
We hope this guide provides the complete content you need to get your organization up and running with Salesforce. If you need further support, contact the Support team at salesforce.com.
S
ALESFORCE
T
RIALS
Trial Overview
Available in: All Editions except Database.com
During your trial, you can evaluate Salesforce before you subscribe. Your trial includes:
• Sample data. You can
or
• Administrator privileges. The person who signed up automatically becomes the administrator. You can add another
administrator when you add more users .
• A variety of Salesforce features.
•
to Salesforce.
Note: Features included in your trial may not be available in the Edition you choose to purchase.
If you set up multiple users in your trial and later choose to convert to Personal Edition, all users except the original system administrator will be deactivated.
1
Salesforce Trials Starting a New Trial
Starting a New Trial
Available in: Contact Manager, Group, Professional, Enterprise, and Unlimited Editions
User Permissions Needed
To start a new trial: “Modify All Data”
When you sign up for Salesforce, you can choose an industry-specific template with sample data. During your trial period, you can start a new trial with a blank template. To start a new trial, you must abandon your current trial, including all data and customizations.
You can start a new trial if you have:
• Less than 1000 rows of data
• No additional user licenses added by salesforce.com
• No additional functionality enabled by salesforce.com
To start a new trial:
1. Click
Your Name
> Setup > Data Management > Start a New Trial. This link is available only during your trial period.
2. Select your language and template preferences.
3. Enter the requested text stating that you want to abandon your current trial organization and all of its data. This includes both sample data and data you have entered.
4. Check the box to confirm that all of your current trial data will be lost.
5. Click Submit.
6. When the confirmation page appears, click Submit.
Note: By choosing to start a new trial, you are abandoning your current trial organization including all existing data and customizations. You will no longer be able to access the trial or data. Only usernames will be preserved.
Converting a Trial Using Checkout
Available in: Personal, Contact Manager, Group, Professional, Enterprise, and Unlimited Editions
Users with a Checkout account can convert a Salesforce trial into an Edition subscription. If your organization doesn’t have self-service access to Checkout, submit a request to your salesforce.com representative.
To convert your trial Edition into a subscription using Checkout, you must create a quote. For more detailed instructions on creating a quote, see the Checkout User Guide .
Note: At any point during the quote creation process, you can click Request Assistance to contact your salesforce.com
account representative.
2
Salesforce Trials Deleting Trial Data
To convert your trial Edition into a subscription:
1. To create a quote, click Subscribe Now or select Checkout from the Force.com Apps drop-down list. Note that the Edition and products used in your trial organization are preselected in Checkout.
Important: If at any point during quote creation you close the window, you lose all changes. If you are creating a new quote, you lose the entire quote. You can click Save for Later on any page if you want to save your changes and continue editing it later.
2. If you are a new user, or creating or editing a quote from a trial, enter and confirm the information on the Subscription
Information tab.
3. If you are creating or editing a quote from a trial of a larger Edition, enter and confirm the information on the Products page, review your billing information, and click Jump to Order Review.
4. If you want to create a quote for another Edition, click Editions and Pricing. Enter and confirm the subscription, product, and billing information, then click Jump to Order Review. The Order Review page displays the information you entered, as well as complete pricing for all products on the quote.
Note: If you convert a trial organization to a lesser Edition, such as moving from a Professional Edition trial to a Group Edition subscription, some features and data from your trial are deleted. To accept the deletions, select the Acknowledgment checkbox. Click Review this to see a list of features not supported in your chosen Edition.
If you want to back up all of your data before converting, log into your Salesforce organization and click
Your
Name > Setup > Data Management > Data Export.
5. Verify your purchase and click Place Order.
As a trial user, if you create a quote and don't follow through with placing an order, the quote is saved in Checkout. Once you complete a quote and place an order for an Edition subscription, any other Edition quotes you have open are closed.
Deleting Trial Data
Available in: All Editions except Database.com
User Permissions Needed
To delete trial data: “Modify All Data”
When you sign up for Salesforce, your organization is initially populated with some sample data. During your trial period, administrators can delete all of this sample data plus all of your organization’s data at one time.
To delete all of the existing data in a trial organization:
1. Click
Your Name
> Setup > Data Management > Delete All Data. This link is available only during your trial period.
2. Enter the requested text stating that you understand that all of the data in your organization will be deleted. This includes both sample data and data you have entered. Your user and administration setup is not affected.
3. Click Submit.
After your trial period has ended, you can delete any sample data manually or with the Mass Delete feature.
3
Set Up Your Organization About Company Information
S
ET
U
P
Y
OUR
O
RGANIZATION
About Company Information
Available in: All Editions
To view company information:
To change company information:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
When your company signs up, the information provided during signup is displayed on the Company Information page at
Your Name > Setup > Company Profile > Company Information.
From the Company Information page, you can:
• Click Edit to change your company's information, including your organization's
Default Language
setting.
• Click Currency Setup to set up the ability to use multiple currencies. Available in Group, Professional, Enterprise,
Unlimited, Database.com, and Developer Editions only.
• Go to Checkout to buy additional user or feature licenses by clicking Buy More Licenses in the appropriate related list.
The Company Information page also displays all of the active user and feature licenses you have purchased for your organization.
A user license entitles a user to different functionality within Salesforce and determines which profiles and permission sets are available to the user. A feature license entitles a user to an additional Salesforce feature, such as Marketing or Connect Offline.
This page lists the following for each type of license:
• Status indicates the status of the license.
• Total Licenses indicates the number of licenses for which your company is billed and that are available to you.
•
Used Licenses
is the number of licenses that you have assigned to users.
• Remaining Licenses
is the number of unused licenses.
In addition to license types, the following portal login information is listed for organizations that have Customer Portals or partner portals enabled:
• Monthly Logins Allotted
shows the maximum number of customer or partner portal logins allowed per month.
• Monthly Logins Used
indicates the number of successful logins for all users associated with a customer or partner portal user license for the month.
See Also:
4
Set Up Your Organization About Company Information
Company Information Fields
The available fields vary according to which Salesforce Edition you have.
The Company Information page has the following fields (listed in alphabetical order), including the user and feature licenses purchased for your organization.
Field
Address
Admin Newsletter
API Requests, Last 24 Hours
City
Corporate Currency
Country
Country
(beta)
Created By
Currency Locale
Default Language
Description
Street address of the organization. Up to 255 characters are allowed in this field.
Allow administrators in your organization to choose whether they want to receive administrator-targeted promotional emails from salesforce.com.
The total number of API requests issued by the organization in the last 24 hours. The maximum number of requests depends on your Edition.
City in which organization is located. Up to 40 characters are allowed in this field.
The currency in which the organization's corporate headquarters reports revenue. Serves as the basis for all currency conversion rates. Only for organizations that use multiple currencies.
Country in which organization is located. Up to 80 characters are allowed in this field.
The country for the address. Entry is selected from a picklist of standard values.
User who signed up the organization, including creation date and time. (Read only)
The country or geographic region in which the organization is located. The setting affects the format of currency amounts.
For single currency organizations only.
The default language that is selected for new users in the organization. This setting determines the language used for the user interface text and help. In all editions except Personal
Edition and Database.com, individual users can separately set the language for their own login, which will override the organization setting. In Group Edition, this field is called
Display Language
.
This setting also determines the language in which all customizations—such as custom fields, tabs, and user interface
5
Set Up Your Organization About Company Information
Field
Default Locale
Default Time Zone
Division
Fax
Fiscal Year Starts In
Hide Notices About System Downtime
Hide Notices About System Maintenance
Modified By
Newsletter
Organization Name
Phone
Primary Contact
Description options—are stored. For customizations, individual users' language settings do not override this setting.
The default country or geographic region that is selected for new users in the organization. This setting determines the format of dates, times, and names in Salesforce. In Contact
Manager, Group, Professional, Enterprise, Unlimited, and
Developer Edition organizations, individual users can set their personal locale, which overrides the organization setting. In
Group Edition, this field is called
Locale
.
Primary time zone in which the organization is located. A user's individual
Time Zone
setting overrides the organization's Default Time Zone setting.
Note: Organizations in Arizona should select “Mountain
Standard Time,” and organizations in parts of Indiana that do not follow Daylight Savings Time should select “Eastern
Standard Time.”
Group or division that uses the service, for example, PC Sales
Group. Up to 40 characters are allowed in this field.
Fax number. Up to 40 characters are allowed in this field.
If using a standard fiscal year, the starting month and year for the organization’s fiscal year. If using a custom fiscal year, the value will be “Custom Fiscal Year.”
Select this checkbox to prevent advance notices about planned system downtime from displaying to users when they log in to Salesforce.
Select this checkbox to prevent advance notices about planned system maintenance from displaying to users when they log in to Salesforce.
User who last changed the company information, including modification date and time. (Read only)
Allow users in your organization to choose whether they want to receive user-targeted promotional emails from salesforce.com.
Name of the organization. Up to 80 characters are allowed in this field.
Main phone number at organization. Up to 40 characters are allowed in this field.
Person who is main contact or administrator at the organization. You can enter a name, or select a name from a
6
Set Up Your Organization
Field
Salesforce Licenses
Salesforce.com Organization ID
Restricted Logins, Current Month
State
State/Province
(beta)
Streaming API Events, Last 24 Hours
Zip
Used Data Space
Used File Space
Required Domains
Description list of previously defined users. Up to 80 characters are allowed in this field.
Number of Salesforce user accounts that can be defined for access to the service. This is the number of Salesforce user licenses for which the organization is billed, if charges apply.
Code that uniquely identifies your organization to salesforce.com.
Number of restricted login users who have logged in during the current month.
This value resets to zero at the beginning of each month. The maximum number of restricted login users for the organization is in parentheses.
State or province in which organization is located. Up to 80 characters are allowed in this field.
The state or province for the address. Entry is selected from a picklist of standard values.
The total number of Streaming API events used by the organization in the last 24 hours. The maximum number of events depends on your edition.
Zip or postal code of the organization. Up to 20 characters are allowed in this field.
Amount of data storage in use; the value is expressed as a measurement (for example, 500 MB) and as a percentage of the total amount of data storage available (for example, 10%).
Amount of file storage in use; the value is expressed as a measurement (for example, 500 MB) and as a percentage of the total amount of file storage available (for example, 10%).
See Also:
Required Domains
Available in: All Editions.
Salesforce uses these domains to deliver content.
7
Set Up Your Organization Understanding Language, Locale, and Currency
• *.staticforce.com
• *.content.force.com
• *.force.com
• *.salesforce.com
If you whitelist domains, add these to your list of allowed domains. If you’ve disabled third-party cookies (typically enabled by default in all major browsers), you must accept them for Salesforce to function properly. If your users have general access to the Internet, no action is required.
Understanding Language, Locale, and Currency
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To view company information:
To change company information
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
The available personal setup options vary according to which Salesforce Edition you have.
The Salesforce settings for language, locale, time zone, and currency can affect how objects (Accounts, Leads, Opportunities, etc.) are displayed. In a single currency organization, the Salesforce administrators set the currency locale, default language, default locale, and default time zone for their organizations and the users can set their individual language, locale, and time zone. In a multiple currency organization, the Salesforce administrators set the corporate currency, default language, default locale, and default time zone for their organizations and the users can set their individual currency, language, locale, and time zone.
Note: Single language organizations cannot change their language, although they can change their locale.
Setting
Currency
Corporate Currency
Who can edit the setting
User in a multiple currency organization
Administrator in a multiple currency organization
How to edit the setting Description and effects of the setting
Go to Your Name > Setup
> My Personal Information
> Personal Information >
Edit and select a currency from the activated currencies drop-down list.
User’s default currency for quotas, forecasts, and reports. Shown only in organizations using multiple currencies. This must be one of the active currencies for the organization.
Go to Your Name > Setup
> Company Profile >
Manage Currencies >
Change Corporate and select a currency from the
New Corporate
Currency drop-down list.
The currency in which the organization's corporate headquarters reports revenue.
Serves as the basis for all currency conversion rates. Only for organizations that use multiple currencies.
8
Set Up Your Organization Understanding Language, Locale, and Currency
Setting
Currency Locale
Default Currency ISO
Code
Default Language
Default Locale
Default Time Zone
Who can edit the setting
Administrator in a single currency organization
Not editable
Administrator
Administrator
Administrator
How to edit the setting Description and effects of the setting
To add a currency, click
New, select a currency from
drop-down list, enter a conversion rate, enter the number of decimal places you want, and click Save or Save
& New to add another currency.
Go to
Your Name
> Setup
> Company Profile >
Company Information >
Edit and select a currency from the
drop-down list.
The country or geographic region in which the organization is located. The setting affects the format of currency amounts. For single currency organizations only.
Not editable User's default currency setting for new records. Available only for organizations that use multiple currencies.
Go to Your Name > Setup
> Company Profile >
Company Information >
Edit and select a language from the
drop-down list.
This setting also determines the language in which all customizations—such as custom fields, tabs, and user interface options—are stored. For customizations, individual users' language settings do not override this setting.
Go to
Your Name
> Setup
> Company Profile >
Company Information >
Edit and select a locale from
drop-down list.
Note: Locale names with a country in parentheses also set a default currency
The default country or geographic region that is selected for new users in the organization. This setting determines the format of dates, times, and names in
Salesforce. In Contact Manager,
Group, Professional, Enterprise,
Unlimited, and Developer Edition organizations, individual users can set their personal locale, which overrides the organization setting.
In Group Edition, this field is called
Locale
.
Go to
Your Name
> Setup
> Company Profile >
Primary time zone in which the organization is located. A user's
9
Set Up Your Organization Understanding Language, Locale, and Currency
Setting
Information Currency
Language
Locale
Who can edit the setting
Not editable
User
User
How to edit the setting
Company Information >
Edit and select a time zone
drop-down list.
Description and effects of the setting individual Time Zone setting overrides the organization's
Default Time Zone setting.
Note: Organizations in Arizona should select “Mountain Standard
Time,” and organizations in parts of Indiana that do not follow
Daylight Savings Time should select “Eastern Standard Time.”
Not editable The default currency for all currency amount fields in the user record. Available only for organizations that use multiple currencies.
Go to Your Name > Setup
> My Personal Information
> Personal Information >
Edit and select a language from the
drop-down list.
The primary language for the user. All text and online help is displayed in this language. In
Professional, Enterprise, and
Unlimited Edition organizations, a user’s individual
Language setting overrides the organization’s
Default
Language .
Not available in Personal Edition,
Contact Manager, or Group
Edition ™ . The organization’s
Display Language applies to all users.
Go to Your Name > Setup
> My Personal Information
> Personal Information >
Edit and select a locale from
drop-down list.
Country or geographic region in which user is located.
The
Locale
setting affects the format of date, date/time, and number fields, and the calendar.
For example, dates in the English
Note: Locale (United States) locale display as names with a 06/30/2000 and as 30/06/2000 in country in the English (United Kingdom) parentheses also set locale. Times in the English a default currency (United States) locale display using a twelve-hour clock with
AM and PM (for example, 2:00
PM), whereas in the English
10
Set Up Your Organization
Setting
Time Zone
Understanding Language, Locale, and Currency
Who can edit the setting
User
How to edit the setting Description and effects of the setting
(United Kingdom) locale, they display using a twenty-four-hour clock (for example, 14:00).
The
Locale
setting also affects the first and last name order on
Name
fields for users, leads, and contacts. For example, Bob
Johnson in the English (United
States) locale displays as Bob
Johnson, whereas the Chinese
(China) locale displays the name as Johnson Bob.
For Personal Edition users, the locale is set at the organization level via Your Name > Setup >
Company Profile > Company
Information. For all other users, their personal locale, available at
Your Name > Setup > My
Personal Information > Personal
Information, overrides the organization setting.
Go to Your Name > Setup
> My Personal Information
> Personal Information >
Edit and select a time zone
drop-down list.
Primary time zone in which user works.
Users in Arizona should select the setting with “America/Phoenix,” and users in parts of Indiana that do not follow Daylight Savings
Time should select the setting with “America/Indianapolis.”
See Also:
11
Set Up Your Organization Understanding Language, Locale, and Currency
Language Settings Overview
Available in: All Editions except Database.com
The Salesforce Web user interface, Salesforce for Outlook, Connect for Outlook, Connect Offline, and Connect for Office are available in
.
The Salesforce Web user interface has two language settings:
• Personal language—All on-screen text, images, buttons, and online help display in this language. Edit your personal information to change this setting.
• Default organization language—This applies to all new users until they select their personal language. This setting also determines the language in which all customizations—such as custom fields, tabs, and user interface options—are stored.
For customizations, users' personal language settings don't override this default setting. Some setup items that are manually entered by an administrator can be translated in the Translation Workbench.
Administrators can change this setting by editing the company information.
Text entered by users remains in the language in which it was entered.
See Also:
Understanding Language, Locale, and Currency
What languages does Salesforce support?
Salesforce.com offers three levels of language support:
,
en ) or a five-character locale code (such as en_AU).
Note: Setting a default locale is different from setting a default language.
Aside from the three levels of language support for Salesforce features, documentation, and application development tools, there are two ways you can actually localize your organizations. First, the Translation Workbench: The Translation Workbench lets you specify languages you want to translate, assign translators to languages, create translations for customizations you’ve made to your Salesforce organization, and override labels and translations from managed packages. Everything from custom picklist values to custom fields can be translated so your global users can use all of Salesforce in their language..
If your custom application uses a small number of Salesforce’s standard tabs and fields, you can translate them by renaming tab and field labels.
Fully Supported Languages
You can change the language for all features, including Help, to one of the following fully supported languages by clicking
Your Name
> Setup > Company Profile > Company Information > Edit.
• Chinese (Simplified): zh_CN
• Chinese (Traditional): zh_TW
• Danish: da
12
Set Up Your Organization Understanding Language, Locale, and Currency
• Dutch: nl_NL
• English: en_US
• Finnish: fi
• French: fr
• German: de
• Italian: it
• Japanese: ja
• Korean: ko
• Portuguese (Brazil): pt_BR
• Russian: ru
• Spanish: es
• Swedish: sv
• Thai: th *
* Even though the Salesforce interface is fully translated to Thai, Help remains in English.
End User Languages
For end user languages, Salesforce provides translated labels for all standard objects and pages except Administration Setup and Help. End user languages are useful if you have a multilingual organization or partners who speak languages other than your company’s default language.
When you specify an end user language, labels and Help that are not translated fall back to English except for Spanish (Mexico), which falls back to Spanish.
• Arabic: ar
• Bulgarian: bg
• Czech: cs
• English (UK): en_GB
• Greek: el
• Spanish (Mexico): es_MX
• Hebrew: iw
• Hungarian: hu
• Indonesian: in
• Norwegian: no
• Polish: pl
• Romanian: ro
• Turkish: tr
• Ukrainian: uk
• Vietnamese: vi
Platform-Only Languages
Platform-only languages are used when you want to localize custom functionality (apps) that you’ve built on the Salesforce platform. When you choose a platform-only language, Salesforce provides translations for all of the custom objects and field labels in the chosen language.
When you specify a platform-only language, labels for standard objects and fields fall back to English except: English (Australia),
English (India), English (Malaysia), and English (Philippines) fall back to English (UK); French (Canada) falls back to French;
Moldovan falls back to Romanian; and Portuguese (European) falls back to Portuguese (Brazil).
• Albanian: sq
13
Set Up Your Organization
• Armenian: hy
• Basque: eu
• Bosnian: bs
• Croatian: hr
• English (Australia): en_AU
• English (Canada): en_CA
• English (India): en_IN
• English (Malaysia): en_MY
• English (Philippines): en_PH
• Estonian: et
• French (Canada): fr_CA
• Georgian: ka
• Hindi: hi
• Icelandic: is
• Irish: ga
• Latvian: lv
• Lithuanian: lt
• Luxembourgish: lb
• Macedonian: mk
• Malay: ms
• Maltese: mt
• Moldovan: ro_MD
• Montenegrin: sh_ME
• Portuguese (European): pt_PT
• Romansh: rm
• Serbian (Cyrillic): sr
• Serbian (Latin): sh
• Slovak: sk
• Slovenian: sl
• Tagalog: tl
• Urdu: ur
• Welsh: cy
See Also:
Understanding Language, Locale, and Currency
Understanding Language, Locale, and Currency
14
Set Up Your Organization Understanding Language, Locale, and Currency
Supported Locales
Available in: Group, Professional, Enterprise, Unlimited, Database.com and Developer Editions
To view company information:
To change company information:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
The available personal setup options vary according to which Salesforce Edition you have.
The Salesforce locale settings determine the following display formats:
• Date and time
• Users’ names
• Addresses
• Commas and periods in numbers
Locale names with a country in parentheses also set a default currency.
Name
Arabic
Code ar
Default currency
Date and time format
02/01/2008
04:30 PM
Time format Number format
06:00 1,234.56
Arabic
(United Arab
Emirates)
Arabic
(Bahrain) ar_AE ar_BH
UAE Dirham:
AED
Bahraini
Dinar: BHD
02/01/2008
04:30 PM
02/01/2008
04:30 PM
06:00
06:00
1,234.56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
15
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Arabic
(Egypt)
Arabic
(Jordan)
Code ar_EG ar_JO
Arabic
(Kuwait) ar_KW
Arabic
(Lebanon)
Arabic (Saudi
Arabia) ar_LB ar_SA
Default currency
Egyptian
Pound EGP
Jordanian
Dinar: JOD
Kuwaiti
Dinar: KWD
Lebanese
Pound: LBP
Saudi Arabian
Riyal: SAR
Date and time format
02/01/2008
04:30 PM
02/01/2008
04:30 PM
02/01/2008
04:30 PM
02/01/2008
04:30 PM
02/01/2008
04:30 PM
Time format
06:00
06:00
06:00
06:00
06:00
Number format
1,234.56
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
16
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Bulgarian
Code bg
Bulgarian
(Bulgaria) bg_BG
Catalan
Catalan
(Spain)
Czech ca ca_ES cs
Default currency
Bulgaria Lev:
BGN
Euro: EUR
Date and time format
2008-1-2
16:30
2008-1-2
16:30
02/01/2008
16:30
02/01/2008
16:30
2.1.2008
16:30
Time format
6:00
6:00
06:00
06:00
6:00
Number format
1 234,56
1 234,56
1.234,56
1.234,56
1 234,56
Name format Address format
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
17
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Czech (Czech
Republic)
Danish
Code cs_CZ da
Danish
(Denmark) da_DK
German
German
(Austria) de de_AT
Default currency
Czech
Koruna: CZK
Danish
Krone: DKK
Euro: EUR
Date and time format
2.1.2008
16:30
02-01-2008
16:30
02-01-2008
16:30
02.01.2008
16:30
02.01.2008
16:30
Time format
6:00
06:00
06:00
06:00
06:00
Number format
1 234,56
1.234,56
1.234,56
1.234,56
1.234,56
Name format Address format
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
ZipCode City
State Country
Address Line
1,
Address Line
2
ZipCode City
18
Set Up Your Organization Understanding Language, Locale, and Currency
Name
German
(Switzerland) de_CH
German
(Germany)
German
(Luxembourg)
Greek
Greek
(Greece)
Code de_DE de_LU el el_GR
Default currency
Swiss Franc:
CHF
Euro: EUR
Euro: EUR
Greek
Drachma:
EUR
Date and time format
02.01.2008
16:30
02.01.2008
16:30
02.01.2008
16:30
2/1/2008 4:30
PM
2/1/2008 4:30
PM
Time format
06:00
06:00
06:00
6:00 μ
6:00 μ
Number format
1'234.56
1.234,56
1.234,56
1.234,56
1.234,56
Name format Address format
State Country
Ms. FName
LName
Address Line
1,
Address Line
2
ZipCode City
State Country
Ms. FName
LName
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
ZipCode City
State Country
Address Line
1,
Address Line
2
ZipCode City
State Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
19
Set Up Your Organization Understanding Language, Locale, and Currency
Name
English
(Australia)
English
(Barbados) en_BB
English
(Bermuda) en_BM
English
(Canada)
English
(United
Kingdom)
Code en_AU en_CA en_GB
Default currency
Date and time format
Australian
Dollar: AUD
2/01/2008
4:30 PM
Barbados
Dollar: BBD
Bermuda
Dollar: BMD
Canadian
Dollar: CAD
British
Pound: GBP
1/2/2008 4:30
PM
1/2/2008 4:30
PM
02/01/2008
4:30 PM
02/01/2008
16:30
Time format
6:00 AM
6:00 AM
6:00 AM
6:00 AM
06:00
Number format
1,234.56
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
20
Set Up Your Organization Understanding Language, Locale, and Currency
Name
English
(Ghana)
English
(Indonesia)
English
(Ireland)
English
(India)
Code en_GH en_ID en_IE en_IN
English
(Malaysia) en_MY
Default currency
Date and time format
Time format
Ghanian Cedi
(New): GHS
1/2/2008 4:30
PM
6:00 AM
Number format
1,234.56
Indonesian
Rupiah: IDR
Euro: EUR
Indian rupee:
INR
Malaysian
Dollar
(Ringgit):
MYR
1/2/2008 4:30
PM
02/01/2008
16:30
2/1/2008 4:30
PM
1/2/2008 4:30
PM
6:00 AM
06:00
6:00 AM
6:00 AM
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
21
Set Up Your Organization Understanding Language, Locale, and Currency
Name
English
(Nigeria)
Code en_NG
English (New
Zealand)
English
(Philippines)
English
(Singapore)
English
(United
States) en_NZ en_PH en_SG en_US
Default currency
Nigerian
Naira: NGN
Date and time format
Time format
1/2/2008 4:30
PM
6:00 AM
Number format
1,234.56
New Zealand
Dollar: NZD
Philippines
Peso: PHP
Singapore
Dollar: SGD
U.S. Dollar:
USD
2/01/2008
4:30 PM
1/2/2008 4:30
PM
1/2/2008 4:30
PM
1/2/2008 4:30
PM
6:00 AM
6:00 AM
6:00 AM
6:00 AM
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
22
Set Up Your Organization Understanding Language, Locale, and Currency
Name Code
English
(South Africa) en_ZA
Spanish
Spanish
(Argentina)
Spanish
(Bolivia)
Spanish
(Chile) es es_AR es_BO es_CL
Default currency
Date and time format
South African
Rand: ZAR
2008/01/02
4:30 PM
Argentine
Peso: ARS
Bolivian
Boliviano:
BOB
Chilean Peso:
CLP
2/01/2008
16:30
02/01/2008
16:30
02-01-2008
04:30 PM
02-01-2008
04:30 PM
Time format
6:00 AM
6:00
06:00
06:00 AM
06:00 AM
Number format
1,234.56
1.234,56
1.234,56
1.234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
23
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Spanish
(Colombia)
Spanish
(Costa Rica) es_CR
Spanish
(Dominican
Republic) es_DO
Spanish
(Ecuador)
Spanish
(Spain)
Code es_CO es_EC es_ES
Default currency
Colombian
Peso: COP
Costa Rica
Colon: CRC
Dominican
Republic
Peso: DOP
CFA Franc
(BEAC):
XAF
Euro: EUR
Date and time format
2/01/2008
04:30 PM
02/01/2008
04:30 PM
01/02/2008
04:30 PM
02/01/2008
04:30 PM
2/01/2008
16:30
Time format
06:00 AM
06:00 AM
06:00 AM
06:00 AM
6:00
Number format
1.234,56
1,234.56
1,234.56
1.234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
24
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Spanish
(Guatemala)
Code es_GT
Spanish
(Honduras) es_HN
Spanish
(Mexico) es_MX
Spanish
(Panama)
Spanish
(Peru) es_PA es_PE
Default currency
Guatemala
Quetzal:
GTQ
Date and time format
2/01/2008
04:30 PM
Time format Number format
06:00 AM 1,234.56
Honduras
Lempira:
HNL
Mexican
Unidad de
Inversion
(UDI): MXV
Panama
Balboa: PAB
US Dollar:
USD
Peruvian
Nuevo Sol:
PEN
01-02-2008
04:30 PM
2/01/2008
04:30 PM
01/02/2008
04:30 PM
02/01/2008
04:30 PM
06:00 AM
06:00 AM
06:00 AM
06:00 AM
1,234.56
1,234.56
1,234.56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
25
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Spanish
(Puerto Rico)
Spanish
(Paraguay)
Code es_PR
Spanish (El
Salvador) es_SVUS
Spanish
(Uruguay)
Spanish
(Venezuela) es_PY es_UY es_VE
Default currency
U.S. Dollar:
USD
Date and time format
01-02-2008
04:30 PM
Time format Number format
06:00 AM 1,234.56
Paraguayan
Guarani:
PYG
U.S. Dollar:
USD
Uruguayan
New Peso:
UYU
Venezuelan
Bolivar
Fuerte: VEF
02/01/2008
04:30 PM
01-02-2008
04:30 PM
02/01/2008
04:30 PM
02/01/2008
04:30 PM
06:00 AM
06:00 AM
06:00 AM
06:00 AM
1.234,56
1,234.56
1.234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
26
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Estonian
(Estonia)
Code et_EE
Finnish
Finnish
(Finland)
French
French
(Belgium) fi fi_FI fr fr_BE
Default currency
Estonian
Kroon: EEK
Date and time format
2.01.2008
16:30
Euro: EUR
Euro: EUR
2.1.2008
16:30
2.1.2008
16:30
02/01/2008
16:30
2/01/2008
16:30
Time format
6:00
6:00
6:00
06:00
6:00
Number format
1 234,56
1 234,56
1 234,56
1 234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
27
Set Up Your Organization Understanding Language, Locale, and Currency
Name
French
(Canada)
French
(Switzerland)
French
(France)
French
(Luxembourg)
Code fr_CA fr_CH fr_FR fr_LU
French
(Monaco) fr_MC
Default currency
Date and time format
Canadian
Dollar: CAD
2008-01-02
16:30
Swiss Franc:
CHF
Euro: EUR
Euro: EUR
Moroccan
Dirham:
MAD
02.01.2008
16:30
02/01/2008
16:30
02/01/2008
16:30
02/01/2008
16:30
Time format
06:00
06:00
06:00
06:00
06:00
Number format
1 234,56
1'234.56
1 234,56
1 234,56
1 234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City
Country -
State
ZipCode
Ms. FName
LName
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
28
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Irish (Ireland)
Croatian
(Croatia)
Hungarian
Hungarian
(Hungary)
Code ga_IE hr_HR hu hu_HU
Armenian
(Armenia) hy_AM
Default currency
Euro: EUR
Croatian
Kuna: HRK
Hungarian
Forint: HUF
Armenian
Dram: AMD
Date and time format
02/01/2008
16:30
02.01.2008.
16:30
2008.01.02.
16:30
2008.01.02.
16:30
1/2/2008 4:30
PM
Time format
06:00
06:00
6:00
6:00
6:00 AM
Number format
1,234.56
1.234,56
1 234,56
1 234,56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
LName
FName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
29
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Indonesian
Indonesian
(Indonesia)
Icelandic
(Iceland)
Italian
Code in in_ID is_IS it
Italian
(Switzerland) it_CH
Default currency
Indonesian
Rupiah: IDR
Iceland
Krona: ISK
Swiss Franc:
CHF
Date and time format
2008/01/02
16:30
02/01/2008
16:30
2.1.2008
16:30
02/01/2008
16.30
02.01.2008
16:30
Time format
06:00
6:00
06:00
6.00
06:00
Number format
1.234,56
1.234,56
1.234,56
1.234,56
1'234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City
Country -
State
ZipCode
30
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Italian (Italy)
Hebrew
Code it_IT iw
Hebrew
(Israel) iw_IL
Japanese
Japanese
(Japan) ja ja_JP
Default currency
Euro: EUR
Israeli Shekel:
ILS
Japanese Yen:
JPY
Date and time format
02/01/2008
16.30
16:30
02/01/2008
16:30
02/01/2008
2008/01/02
16:30
2008/01/02
16:30
Time format
6.00
06:00
06:00
6:00
6:00
Number format
1.234,56
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
LName
FName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Country
ZipCode
State City
Address Line
1,
Address Line
2
LName
FName
Country
ZipCode
State City
Address Line
1,
Address Line
2
31
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Georgian
Georgian
(Georgia)
Kazakh
(Kazakhstan)
Code ka ka_GE kk_KZ
Khmer
(Cambodia) km_KH
Korean ko
Default currency
Georgian
Lari: GEL
Kazakhstan
Tenge: KZT
1/2/2008 4:30
PM
6:00 AM
Cambodia
Riel: KHR
Date and time format
1/2/2008 4:30
PM
1/2/2008 4:30
PM
2008. 1. 2 PM
4:30
Time format
1/2/2008 4:30
PM
6:00 AM
6:00 AM
6:00 AM
6:00
Number format
1,234.56
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
LName
FName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Country
ZipCode
State City
Address Line
1,
Address Line
2
32
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Korean
(South Korea)
Lithuanian
(Lithuania)
Latvian
(Latvia)
Dutch
Code ko_KR lt_LT lv_LV
Malay
(Malaysia) ms_MY nl
Default currency
Date and time format
Time format
Korean Won:
KRW
2008. 1. 2 PM
4:30
6:00
Number format
1,234.56
Lithuanian
Lita: LTL
Latvian Lat:
LVL
Malaysian
Ringgit: MYR
2008.1.2
16.30
2008.2.1
16:30
02/01/2008
4:30 PM
2-1-2008
16:30
06.00
06:00
6:00 AM
6:00
1 234,56
1 234,56
1,234.56
1.234,56
Name format Address format
LName
FName
Country
ZipCode
State City
Address Line
1,
Address Line
2
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
33
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Dutch
(Belgium)
Dutch
(Netherlands)
Dutch
(Suriname)
Norwegian
Code nl_BE nl_NL nl_SR no
Norwegian
(Norway) no_NO
Default currency
Euro: EUR
Euro: EUR
Surinam
Dollar: SRD
Norwegian
Krone: NOK
Date and time format
2/01/2008
16:30
2-1-2008
16:30
2-1-2008
16:30
02.01.2008
16:30
02.01.2008
16:30
Time format
6:00
6:00
6:00
06:00
06:00
Number format
1.234,56
1.234,56
1.234,56
1 234,56
1 234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
34
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Polish
Portuguese
Code pl pt
Portuguese
(Angola) pt_AO
Portuguese
(Brazil)
Portuguese
(Portugal) pt_BR pt_PT
Default currency
Angola
Kwanza:
AOA
Brazilian
Real: BRL
Euro: EUR
Date and time format
2008-01-02
16:30
02-01-2008
16:30
02-01-2008
16:30
02/01/2008
16:30
02-01-2008
16:30
Time format
06:00
6:00
6:00
06:00
6:00
Number format
1 234,56
1.234,56
1.234,56
1.234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
35
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Romanian
Romanian
(Romania) ro_RO
Russian
Russian
(Russia)
Serbian
(Latin)
Code ro ru ru_RU sh
Default currency
Romanian
Leu (New):
RON
Russian
Rouble: RUB
Date and time format
02.01.2008
16:30
02.01.2008
16:30
02.01.2008
16:30
02.01.2008
16:30
02.01.2008.
16:30
Time format
06:00
06:00
6:00
6:00
06.00
Number format
1.234,56
1.234,56
1 234,56
1 234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
36
Set Up Your Organization Understanding Language, Locale, and Currency
Name Code
Serbian
(Latin)
(Bosnia and
Herzegovina) sh_BA
Serbian
(Latin)
(Serbia and
Montenegro)
Slovak
Slovak
(Slovakia)
Slovenian
(Slovenia) sh_CS sk sk_SK sl_SI
Default currency
Convertible
Mark: BAM
Date and time format
02.01.2008.
16:30
Serbian Dinar
(Serbia): RSD
Euro
(Montenegro):
EUR
Euro: EUR
Euro: EUR
02.01.2008.
16:30
2.1.2008
16:30
2.1.2008
16:30
2.1.08 16:30
Time format
06.00
06.00
6:00
6:00
6:00
Number format
1.234,56
1.234,56
1 234,56
1 234,56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
37
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Serbian
Code sr
Serbian
(Bosnia and
Herzegovina) sr_BA
Serbian
(Serbia and
Montenegro)
Swedish
Swedish
(Sweden) sr_CS sv sv_SE
Default currency
Convertible
Mark: BAM
Serbian Dinar
(Serbia): RSD
Euro
(Montenegro):
EUR
Swedish
Krona: SEK
Date and time format
2.1.2008.
16.30
2008-01-02
16:30
2.1.2008.
16.30
2008-01-02
16:30
2008-01-02
16:30
Time format
06.00
06.00
06.00
06:00
06:00
Number format
1.234,56
1.234,56
1.234,56
1 234,56
1 234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
38
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Thai
Code th
Thai
(Thailand) th_TH
Tagalog
Tagalog
(Philippines)
Turkish tl tl_PH tr
Default currency
Thai Baht:
THB
Philippines
Peso: PHP
Date and time format
2/1/2008,
16:30 .
2/1/2551,
16:30 .
1/2/2008 4:30
PM
02.01.2008
16:30
Time format Number format
6:00 .
6:00 .
1/2/2008 4:30
PM
6:00 AM
6:00 AM
06:00
1,234.56
1,234.56
1,234.56
1,234.56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
39
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Turkish
(Turkey)
Ukrainian
Code tr_TR
Ukrainian
(Ukraine) uk_UA
Urdu
(Pakistan)
Vietnamese uk ur_PK vi
Default currency
Date and time format
Turkish Lira:
TRY
02.01.2008
16:30
Ukraine
Hryvnia:
UAH
Pakistani
Rupee: PKR
02.01.2008
16:30
02.01.2008
16:30
1/2/2008 4:30
PM
16:30
02/01/2008
Time format
06:00
6:00
6:00
6:00 AM
06:00
Number format
1.234,56
1.234,56
1.234,56
1,234.56
1.234,56
Name format Address format
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Ms. FName
LName
Ms. FName
LName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
Address Line
1,
Address Line
2
City, State
ZipCode
Country
LName
FName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
40
Set Up Your Organization Understanding Language, Locale, and Currency
Name
Vietnamese
(Vietnam)
Chinese
Chinese
(China)
Chinese
(Hong Kong)
Code vi_VN zh zh_CN zh_HK
Chinese
(Taiwan) zh_TW
Default currency
Vietnam
Dong: VND
Date and time format
16:30
02/01/2008
Chinese
Yuan: CNY
Hong Kong
Dollar: HKD
Taiwan
Dollar: TWD
2008-1-2
PM4:30
2008-1-2
PM4:30
2008 1 2
PM4:30
2008/1/2 PM
4:30
Time format
06:00
6:00
6:00
6:00
6:00
Number format
1.234,56
1,234.56
1,234.56
1,234.56
1,234.56
Name format Address format
LName
FName
Address Line
1,
Address Line
2
City, State
ZipCode
Country
LName
FName
Country
ZipCode
State City
Address Line
1,
Address Line
2
LName
FName
Country
ZipCode
State City
Address Line
1,
Address Line
2
LName
FName
LName
FName
Country
ZipCode
State City
Address Line
1,
Address Line
2
Country
ZipCode
State City
Address Line
1,
41
Set Up Your Organization Understanding Language, Locale, and Currency
Name Code Default currency
Date and time format
Time format Number format
Name format Address format
Address Line
2
See Also:
Understanding Language, Locale, and Currency
Supported Time Zones
Available in: Group, Professional, Enterprise, Unlimited, Database.com and Developer Editions
User Permissions Needed
To view company information:
To change company information:
“View Setup and Configuration”
“Customize Application”
The available personal setup options vary according to which Salesforce Edition you have.
Time Zone Code
GMT+14:00
GMT+13:00
GMT+13:00
GMT+12:45
GMT+12:00
GMT+12:00
GMT+12:00
GMT+11:30
GMT+11:00
GMT+10:30
GMT+10:00
GMT+10:00
GMT+09:30
Salesforce supported times zones and codes (in chronological order):
Time Zone Name
Line Is. Time (Pacific/Kiritimati)
Phoenix Is. Time (Pacific/Enderbury)
Tonga Time (Pacific/Tongatapu)
Chatham Daylight Time (Pacific/Chatham)
Petropavlovsk-Kamchatski Time (Asia/Kamchatka)
New Zealand Daylight Time (Pacific/Auckland)
Fiji Time (Pacific/Fiji)
Norfolk Time (Pacific/Norfolk)
Solomon Is. Time (Pacific/Guadalcanal)
Lord Howe Summer Time (Australia/Lord_Howe)
Eastern Standard Time (Queensland)
Eastern Summer Time (New South Wales)
Central Summer Time (South Australia)
42
Set Up Your Organization
GMT+06:00
GMT+05:45
GMT+05:30
GMT+05:30
GMT+05:00
GMT+05:00
GMT+05:00
GMT+04:30
GMT+04:00
GMT+04:00
GMT+03:30
GMT+03:00
GMT+03:00
GMT+03:00
GMT+03:00
GMT+03:00
GMT+02:00
Time Zone Code
GMT+09:30
GMT+09:00
GMT+09:00
GMT+08:00
GMT+08:00
GMT+08:00
GMT+08:00
GMT+08:00
GMT+08:00
GMT+08:00
GMT+07:00
GMT+07:00
GMT+07:00
GMT+06:30
Understanding Language, Locale, and Currency
Time Zone Name
Central Standard Time (Northern Territory)
Korea Standard Time (Asia/Seoul)
Japan Standard Time (Asia/Tokyo)
Hong Kong Time (Asia/Hong_Kong)
Malaysia Time (Asia/Kuala_Lumpur)
Philippines Time (Asia/Manila)
China Standard Time (Asia/Shanghai)
Singapore Time (Asia/Singapore)
China Standard Time (Asia/Taipei)
Western Standard Time (Australia)
Indochina Time (Asia/Bangkok)
West Indonesia Time (Asia/Jakarta)
Indochina Time (Asia/Saigon)
Myanmar Time (Asia/Rangoon)
Bangladesh Time (Asia/Dacca)
Nepal Time (Asia/Katmandu)
India Standard Time (Asia/Calcutta)
India Standard Time (Asia/Colombo)
Pakistan Summer Time (Asia/Karachi)
Uzbekistan Time (Asia/Tashkent)
Yekaterinburg Time (Asia/Yekaterinburg)
Afghanistan Time (Asia/Kabul)
Gulf Standard Time (Asia/Dubai)
Georgia Time (Asia/Tbilisi)
Iran Standard Time (Asia/Tehran)
Eastern African Time (Africa/Nairobi)
Arabia Standard Time (Asia/Baghdad)
Arabia Standard Time (Asia/Kuwait)
Arabia Standard Time (Asia/Riyadh)
Moscow Standard Time (Europe/Moscow)
Eastern European Time (Africa/Cairo)
43
Set Up Your Organization
GMT+00:00
GMT+00:00
GMT+00:00
GMT-01:00
GMT-02:00
GMT-03:00
GMT-03:00
GMT-03:30
GMT-04:00
GMT-04:00
GMT-04:00
GMT-04:00
GMT-04:30
GMT-05:00
GMT-05:00
GMT-05:00
GMT-05:00
Time Zone Code
GMT+02:00
GMT+02:00
GMT+02:00
GMT+02:00
GMT+02:00
GMT+02:00
GMT+02:00
GMT+01:00
GMT+01:00
GMT+01:00
GMT+01:00
GMT+01:00
GMT+01:00
GMT+00:00
Understanding Language, Locale, and Currency
Time Zone Name
South Africa Standard Time (Africa/Johannesburg)
Israel Standard Time (Asia/Jerusalem)
Eastern European Time (Europe/Athens)
Eastern European Time (Europe/Bucharest)
Eastern European Time (Europe/Helsinki)
Eastern European Time (Europe/Istanbul)
Eastern European Time (Europe/Minsk)
Central European Time (Europe/Amsterdam)
Central European Time (Europe/Berlin)
Central European Time (Europe/Brussels)
Central European Time (Europe/Paris)
Central European Time (Europe/Prague)
Central European Time (Europe/Rome)
Irish Summer Time (Europe/Dublin)
Western European Summer Time (Europe/Lisbon)
British Summer Time (Europe/London)
Greenwich Mean Time (GMT)
Cape Verde Time (Atlantic/Cape_Verde)
South Georgia Standard Time (Atlantic/South_Georgia)
Argentine Summer Time (America/Buenos_Aires)
Brasilia Summer Time (America/Sao_Paulo)
Newfoundland Daylight Time (America/St_Johns)
Atlantic Daylight Time (America/Halifax)
Atlantic Standard Time (America/Puerto_Rico)
Chile Summer Time (America/Santiago)
Atlantic Daylight Time (Atlantic/Bermuda)
Venezuela Time (America/Caracas)
Colombia Time (America/Bogota)
Eastern Daylight Time (America/Indianapolis)
Peru Time (America/Lima)
Eastern Daylight Time (America/New_York)
44
Set Up Your Organization
Time Zone Code
GMT-05:00
GMT-06:00
GMT-06:00
GMT-06:00
GMT-07:00
GMT-07:00
GMT-08:00
GMT-08:00
GMT-09:00
GMT-10:00
GMT-11:00
GMT-11:00
Understanding Language, Locale, and Currency
Time Zone Name
Eastern Standard Time (America/Panama)
Central Daylight Time (America/Chicago)
Central Standard Time (America/El_Salvador)
Central Standard Time (America/Mexico_City)
Mountain Daylight Time (America/Denver)
Mountain Standard Time (America/Phoenix)
Pacific Daylight Time (America/Los_Angeles)
Pacific Standard Time (America/Tijuana)
Alaska Daylight Time (America/Anchorage)
Hawaii Standard Time (Pacific/Honolulu)
Niue Time (Pacific/Niue)
Samoa Standard Time (Pacific/Pago_Pago)
See Also:
Understanding Language, Locale, and Currency
Setting Corporate Currency
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To view currencies:
To change currencies:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
You must specify a Corporate Currency, which reflects the currency in which your corporate headquarters reports revenue. A salesforce.com representative initially sets your corporate currency upon activation of the feature. All conversion rates are based on the corporate currency.
Important: Ensure that Multi-Currency is enabled in your organization.
To change your corporate currency:
1. Click
Your Name
> Setup > Company Profile > Manage Currencies.
45
Set Up Your Organization Understanding Language, Locale, and Currency
2. Click Change Corporate.
3. Choose a new corporate currency from the list of active currencies, and click Save.
See Also:
Understanding Language, Locale, and Currency
Editing Conversion Rates
Available in: Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To view currencies:
To change currencies:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
You can manage exchange rates between your active and inactive currencies and the corporate currency by editing the conversion rates. These are static exchange rates that apply to all currency fields used in your organization. In addition to these conversion rates, your organization may also use dated exchange rates for opportunities and opportunity products.
To edit your organization's static conversion rates:
1. Click
Your Name
> Setup > Company Profile > Manage Currencies.
2. If advanced currency management is enabled, click Manage Currencies.
3. Click Edit Rates in the Active Currencies or Inactive Currencies lists.
4. Enter the conversion rate between each currency and your corporate currency.
5. Click Save.
When you change the conversion rates, currency amounts are updated using the new rates. Previous conversion rates are not stored. All conversions within opportunities, forecasts, and other amounts use the current conversion rate.
If your organization uses advanced currency management, you can also manage dated exchange rates for currency fields on opportunities and opportunity products.
Note:
• You cannot track revenue gain or loss based on currency fluctuations.
• Changing conversion rates causes a mass recalculation of roll-up summary fields, which may take up to 30 minutes, depending on the number of records affected and other factors.
See Also:
46
Set Up Your Organization Understanding Language, Locale, and Currency
Supported Currencies
Available in: Group, Professional, Enterprise, Unlimited, Database.com and Developer Editions
User Permissions Needed
To view company information:
To change company information:
“View Setup and Configuration”
“Customize Application”
The available personal setup options vary according to which Salesforce Edition you have.
Salesforce supported currencies:
Currency Name
Afghanistan Afghani
Albanian Lek
Algerian Dinar
Angola Kwanza
Argentine Peso
Armenian Dram
Aruba Florin
Australian Dollar
Azerbaijanian Manat
Bahamian Dollar
Bahraini Dinar
Bangladesh Taka
Barbados Dollar
Belarussian Ruble
Belize Dollar
Bermuda Dollar
Bhutan Ngultrum
Bolivia Mvdol
Bolivian Boliviano
Botswana Pula
Brazilian Real
Currency Code
AFN
ALL
DZD
AOA
ARS
AMD
AWG
AUD
AZN
BSD
BHD
BDT
BBD
BYR
BZD
BMD
BTN
BOV
BOB
BWP
BRL
47
Set Up Your Organization
Currency Name
British Pound
Brunei Dollar
Bulgaria Lev
Burundi Franc
Cambodia Riel
Canadian Dollar
Cape Verde Escudo
Cayman Islands Dollar
CFA Franc (BCEAO)
CFA Franc (BEAC)
Chilean Peso
Chinese Renminbi
Chinese Yuan
Colombian Peso
Comoros Franc
Convertible Marks
Costa Rica Colon
Croatian Kuna
Cuban Peso
Czech Koruna
Danish Krone
Dijibouti Franc
Dominican Peso
East Caribbean Dollar
Egyptian Pound
Eritrea Nakfa
Estonian Kroon
Ethiopian Birr
Euro
Falkland Islands Pound
Fiji Dollar
DOP
XCD
EGP
ERN
EEK
ETB
EUR
FKP
FJD
KMF
BAM
CRC
HRK
CUP
CZK
DKK
DJF
CVE
KYD
XOF
XAF
CLP
CN
CNY
COP
Currency Code
GBP
BND
BGN
BIF
KHR
CAD
Understanding Language, Locale, and Currency
48
Set Up Your Organization
Indonesian Rupiah
Iranian Rial
Iraqi Dinar
Israeli Shekel
Jamaican Dollar
Japanese Yen
Jordanian Dinar
Kazakhstan Tenge
Kenyan Shilling
Korean Won
Kuwaiti Dinar
Kyrgyzstan Som
Lao Kip
Latvian Lat
Lebanese Pound
Lesotho Loti
Liberian Dollar
Currency Name
Franc Congolais
Gambian Dalasi
Georgia Lari
Ghanian Cedi
Gibraltar Pound
Guatemala Quetzal
Guinea Franc
Guyana Dollar
Haiti Gourde
Honduras Lempira
Hong Kong Dollar
Hungarian Forint
Iceland Krona
Indian Rupee
KES
KRW
KWD
KGS
LAK
LVL
LBP
LSL
LRD
IDR
IRR
IQD
ILS
JMD
JPY
JOD
KZT
GNF
GYD
HTG
HNL
HKD
HUF
ISK
INR
Currency Code
CDF
GMD
GEL
GHS
GIP
GTQ
Understanding Language, Locale, and Currency
49
Set Up Your Organization
Currency Name
Libyan Dinar
Lithuanian Lita
Macau Pataca
Macedonian Denar
Malagasy Ariary
Malawi Kwacha
Malaysian Ringgit
Maldives Rufiyaa
Mauritania Ougulya
Mauritius Rupee
Mexican Peso
Mexican Unidad de Inversion (UDI)
Moldovan Leu
Mongolian Tugrik
Moroccan Dirham
Mozambique Metical
Myanmar Kyat
Namibian Dollar
Nepalese Rupee
Neth Antilles Guilder
New Zealand Dollar
Nicaragua Cordoba
Nigerian Naira
North Korean Won
Norwegian Krone
Omani Rial
Pacific Franc
Pakistani Rupee
Panama Balboa
Papua New Guinea Kina
Paraguayan Guarani
NGN
KPW
NOK
OMR
XPF
PKR
PAB
PGK
PYG
MAD
MZN
MMK
NAD
NPR
ANG
NZD
NIO
MYR
MVR
MRO
MUR
MXN
MXV
MDL
MNT
Currency Code
LYD
LTL
MOP
MKD
MGA
MWK
Understanding Language, Locale, and Currency
50
Set Up Your Organization
Currency Name
Peruvian Nuevo Sol
Philippine Peso
Polish Zloty
Qatar Rial
Romanian Leu
Russian Rouble
Rwanda Franc
Samoa Tala
Sao Tome Dobra
Saudi Arabian Riyal
Serbian Dinar
Seychelles Rupee
Sierra Leone Leone
Singapore Dollar
Solomon Islands Dollar
Somali Shilling
South African Rand
Sri Lanka Rupee
St Helena Pound
Sudanese Pound
Surinam Dollar
Swaziland Lilageni
Swedish Krona
Swiss Franc
Syrian Pound
Taiwan Dollar
Tajik Ruble
Tanzanian Shilling
Thai Baht
Tonga Pa'anga
Trinidad&Tobago Dollar
SEK
CHF
SYP
TWD
TJS
TZS
THB
TOP
TTD
SBD
SOS
ZAR
LKR
SHP
SDG
SRD
SZL
RWF
WST
STD
SAR
RSD
SCR
SLL
SGD
Currency Code
PEN
PHP
PLN
QAR
RON
RUB
Understanding Language, Locale, and Currency
51
Set Up Your Organization
Currency Name
Tunisian Dinar
Turkish Lira
Turkmenistan Manat
U.S. Dollar
UAE Dirham
Ugandan Shilling
Ukraine Hryvnia
Unidades de fomento
Uruguayan New Peso
Uzbekistan Sum
Vanuatu Vatu
Venezuelan Bolivar Fuerte
Vietnam Dong
Yemen Riyal
Zambian Kwacha
Zimbabwe Dollar
UAH
CLF
UYU
UZS
VUV
VEF
VND
YER
ZMK
ZWD
Currency Code
TND
TRY
TMT
USD
AED
UGX
About Fiscal Years
See Also:
About Fiscal Years
Available in: All Editions except for Database.com.
To define or edit fiscal years:
To view fiscal years:
User Permissions Needed
“Customize Application”
“View Setup and Configuration”
Not all businesses use the Gregorian year for their fiscal year. Salesforce makes it easy for you to define a fiscal year that fits your business needs.
52
Set Up Your Organization About Fiscal Years
If your fiscal year follows the Gregorian calendar, but does not start in January, you can simply and easily set your fiscal year by defining a standard fiscal year. If your fiscal year follows a different structure, you can define a custom fiscal year that meets your needs.
Whether you use a standard fiscal year or a custom fiscal year, you can define individual fiscal years once for your entire organization. These fiscal year definitions allow you to use these fiscal periods throughout Salesforce including in reporting, opportunities, and forecasting.
Tip: As a best practice, define your custom fiscal years after your current forecast. Also, update product schedules and forecasts whenever a custom fiscal year is created or changed.
Standard Fiscal Years
Standard fiscal years are periods that follow the Gregorian calendar, but can start on the first day of any month of the year.
Unlike custom fiscal year, standard fiscal years can be used by organizations that do not have customizable forecasting enabled.
Custom Fiscal Years
For companies that break down their fiscal years, quarters, and weeks into custom fiscal periods based on their financial planning requirements, Salesforce allows you to flexibly define these periods using custom fiscal years. For example, as part of a custom fiscal year, you can create a 13-week quarter represented by three periods of 4, 4, and 5 weeks, rather than calendar months.
If you use a common fiscal year structure, such as 4-4-5 or a 13-period structure, you can rapidly define a fiscal year by simply specifying a start date and an included template. If your fiscal year structure is not included in the templates, you can easily modify a template. For example, if you use three fiscal quarters per year (a trimester) rather than four, delete or modify quarters and periods to meet your needs.
Custom fiscal periods can be named based on your standards. For example, a fiscal period could be called “P2” or “February.”
Fiscal years can be modified any time that you need to change their definition. For example, an extra week could be added to synchronize a custom fiscal year with a standard calendar in a leap year. Changes to fiscal year structure take effect immediately upon being saved.
Considerations When Enabling Custom Fiscal Years
Before enabling custom fiscal year, consider these issues:
• Once you enable custom fiscal years, you cannot disable it. However, you can define custom fiscal years that follow the same Gregorian calendar structure as the Salesforce standard fiscal years.
• Fiscal years will not be automatically created. The only fiscal years available are those that your organization defines.
• Custom fiscal years can be enabled only with customizable forecasting, not with collaborative forecasting.
• Enabling or defining custom fiscal years impacts your forecasts, reports, and quotas.
◊ When you define a new custom fiscal year, or when you change the length of any fiscal period, all quotas for that year will be lost.
◊ When you define a new custom fiscal year, or when you change the length of any fiscal period, forecasts, forecast history, and forecast overrides are lost. Changing the length of a period may also affect the previous or next fiscal year and reports associated with it. Forecasts for periods before the first custom fiscal year will be saved and can be accessed as usual.
◊ Forecast reports for a period after the last defined fiscal year cannot be grouped by period, only by date.
◊ To ensure your forecast reports have the most updated amounts, view the forecast for the period included in the report before running a forecast report.
53
Set Up Your Organization About Fiscal Years
• Your organization will not be able to use fiscal period columns in opportunity, opportunity with product, or opportunity with schedule reports.
• Opportunity list views will not include a fiscal period columns.
• When custom fiscal years are enabled, you can't use the
FISCAL_MONTH()
,
FISCAL_QUARTER()
, or
FISCAL_YEAR() date functions in SOQL.
See Also:
Customizing the Fiscal Year Structure
Customizing the Fiscal Year Labels
Choosing a Custom Fiscal Year Template
Setting the Fiscal Year
Available in: All Editions except for Database.com.
To view fiscal year:
To change fiscal year:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
You can set one of two types of fiscal years: standard fiscal years or custom fiscal years. For specific information on both types
of fiscal years, see About Fiscal Years on page 52.
Setting a Standard Fiscal Year
If your organization follows the Gregorian calendar year, but you need to change the fiscal year start month, use standard fiscal years. Standard fiscal years can start on the first day of any month, and you can specify whether the fiscal year is named for the starting or ending year. For example, if your fiscal year starts in April 2011 and ends in March 2012, your fiscal year setting
on page 55
Warning:
• Users of Customizable Forecasting: You can lose all quotas, forecast history, and overrides if you change your fiscal start month. To preserve your data, change a month to one previously used as the first month in a quarter.
For example, if your start month is April and you change it to May, which isn't a month that starts a fiscal quarter, you'll lose data. If you change it to July, which is a month that starts a fiscal quarter, you'll preserve your data.
• Users of the Forecasts product first released in Winter ’12: Quota and adjustment information is purged if you change your fiscal year start month.
To set a standard fiscal year:
1. Back up your current data.
a. Run and export these reports to Excel:
54
Set Up Your Organization About Fiscal Years
• Opportunity Pipeline
• Quarterly Forecast Summary
• Quota vs. Actual
b. Optionally, generate weekly export data.
We suggest you do this because changing the fiscal year will cause fiscal periods to shift. This change will affect opportunities and forecasts organization-wide.
2. Click
Your Name
> Setup > Company Profile > Fiscal Year.
3. Select
Standard Fiscal Year
.
4. Choose the start month.
5. Specify whether the fiscal year is defined by the year it begins or ends.
6. Optionally, select
Apply to All Forecasts and Quotas
if you want to apply the new fiscal year settings to your existing forecasts and quotas. This option may not be available depending on your forecast settings.
7. Click Save to finish.
Enabling Custom Fiscal Years
If your fiscal year definition is not met by a standard fiscal year, you can enable custom fiscal years which will allow you to flexibly define a more complex fiscal year structure.
To enable custom fiscal years:
Note: Before enabling custom fiscal years, make sure that you have exported any data related to fiscal periods. For
1. Back up your current data.
a. Run and export these reports to Excel:
• Opportunity Pipeline
• Quarterly Forecast Summary
• Quota vs. Actual
b. Optionally, generate weekly export data.
We suggest you do this because changing the fiscal year will cause fiscal periods to shift. This change will affect opportunities and forecasts organization-wide.
2. Click
Your Name
> Setup > Company Profile > Fiscal Year.
3. Select Custom Fiscal Year .
4. Click Enable Custom Fiscal Years.
5. If you understand the effects of enabling custom fiscal years and you have all your data exported, click OK.
Warning: Custom fiscal years cannot be disabled once enabled. Enabling custom fiscal years has impacts on your reports, forecasts, quotas, and other date sensitive material. Do not enable custom fiscal years unless you understand and are prepared for all the implications.
If you are not certain you want to enable custom fiscal years, click Cancel.
on page 61.
55
Set Up Your Organization About Fiscal Years
Customizing the Fiscal Year Structure
Available in: All Editions except for Database.com.
To define or edit fiscal years:
To view fiscal years:
User Permissions Needed
“Customize Application”
“View Setup and Configuration”
If your custom fiscal year needs a different structure than one available from the
, you can use advanced customization to modify the details of your custom fiscal year definition. Custom fiscal years allow you to:
•
•
Reset the fiscal year to a template
•
•
Change the length of a fiscal week
Warning: Changing the length of a fiscal year has an impact on forecasting and reporting. For detailed information
on the impact, see About Fiscal Years
on page 53.
Customizing the Period Labels
The fiscal year period labels for forecasting and reporting are set by the default label values for the fiscal year periods. To
change them, see Customizing the Fiscal Year Labels on page 57.
Resetting the Fiscal Year to a Template
During customization, if you want to return to a fiscal year template, select a template from the Reset Fiscal Year
Structure
drop-down list.
Note: Resetting the fiscal year structure to a template removes all the customizations you made to the fiscal year.
Adding or Removing Fiscal Periods
You can easily add or remove fiscal periods (such as quarters, periods, or weeks) from the fiscal year structure.
To add fiscal periods:
1. Click Your Name > Setup > Company Profile > Fiscal Year.
2. Click Edit for the fiscal year you want to edit.
3. If it is not already expanded, expand the Advanced Customization section.
4. Select the checkbox for the period before the new period. For example, if you want to add a new quarter, and you want it to be the second quarter, select the checkbox for the first quarter.
5. Click Insert.
56
Set Up Your Organization
Note: The maximum number of fiscal periods is 250.
To remove a fiscal period:
1. Click Your Name > Setup > Company Profile > Fiscal Year.
2. Click Edit for the fiscal year you want to edit.
3. If it is not already expanded, expand the Advanced Customization section.
4. Select the checkbox for the period you want to delete.
5. Click Delete.
Note: You must have at least one quarter, one period, and one week.
About Fiscal Years
Changing the Length of a Fiscal Week
To change the length of fiscal periods:
1. Click
Your Name
> Setup > Company Profile > Fiscal Year.
2. Click Edit for the fiscal year you want to edit.
3. If it is not already expanded, expand the Advanced Customization section.
4. Choose the length from the Duration drop-down list for the fiscal week.
Note: To change the duration of a fiscal period or quarter, insert or delete weeks, or change the length of weeks that compose the period or quarter.
Once you have customized your fiscal year, preview the fiscal year definition. If it is correct, close the preview and click Save to save your fiscal year.
Customizing the Fiscal Year Labels
Available in: All Editions except Database.com.
User Permissions Needed
To define or edit fiscal years:
To view fiscal years:
There are two ways to customize the labeling of your fiscal year:
1. Naming schemes and prefix choices
2. Fiscal year picklist customization
“Customize Application”
“View Setup and Configuration”
57
Set Up Your Organization About Fiscal Years
Fiscal Year Naming Schemes and Prefix Choices
When defining a custom fiscal year, you can choose the labeling scheme to use for your custom fiscal year. Each fiscal period type (quarter, period, and week) has a list of labeling schemes that you can select.
Quarter Name Scheme
Numbered by Year
This option allows you to add the quarter number to the quarter label. The quarter label is a combination of the label for the quarter prefix and the quarter number. For example, if the quarter prefix is “Q”, the label for the third
quarter Q3. To customize the quarter prefix, see
on page 58. By default the number for each
quarter is set by their order (the first quarter is labeled “1”), but you can customize it by selecting a different value from the quarter detail drop-down list.
Custom Quarter Names
This option allows you to set the quarter label to any name. The quarter label is set to the name you select from
. By default the order of the quarter names is the same as the picklist order, but you can customize it by selecting a different value from the quarter detail drop-down list.
Period Name Scheme
Numbered By Year
This option allows you to set the period label based on its position in the year. The period label is a combination of the period prefix and the period number. Period numbers do not reset in each quarter. For example, if the period prefix is “P,” the label for the sixth period is P6. To customize the Period Prefix
on page 59. By default the number for each period is set by their order (the first period is labeled “1”), but you can customize it by selecting a different value from the period detail drop-down list.
Numbered By Quarter
This option allows you to set the period label based on its position in the quarter. The period label is a combination of the period prefix and the period number. Period numbers reset in each quarter. For example, if the period prefix is “P,” and the sixth period is the second period in the second quarter, its label is P2. To customize the period prefix, see
on page 59. By default the number for each period is set by their order within the quarter (the first period in a quarter is labeled “1”), but you can customize it by selecting a different value from the period detail drop-down list.
Standard Month Names
This option allows you to set the period label to the month name of the start of the period. For example, if a period started on October 12 and ends on November 10, the period label would be October.
Custom Period Names
This option allows you to set the period label to any string. The period label is set to the string you select from
by selecting a different value from the period detail drop-down list.
Fiscal Year Picklists
Review these custom picklists to customize the labels for your custom fiscal year.
Quarter Prefix
The quarter prefix picklist is a list of options for the text that prefixes the quarter number or name if your fiscal year uses the Numbered By Year quarter naming scheme. For example, if the fiscal quarter is called “Q4,” the “Q” is the quarter prefix.
58
Set Up Your Organization About Fiscal Years
Period Prefix
The period prefix picklist is a list of options for the text that prefixes the period number or name if your fiscal year uses the Numbered By Year period naming scheme. For example, if the fiscal quarter is called “P4,” the “P” is the period prefix.
Quarter Name
The quarter name picklist is a list of options for the quarter name if your fiscal year uses the Custom Quarter Names quarter naming scheme. For example, if you want to name your quarters for the seasons (Spring, Summer, Fall, and
Winter), you could set the quarter name list to those values.
Period Name
The period name picklist is a list of options for the quarter name if your fiscal year uses the Custom Period Names quarter naming scheme. Similar to the quarter name picklist, you can choose meaningful names for the period name picklist.
Customizing Fiscal Year Names
To customize one of these picklists:
1. Click
Your Name
> Setup > Company Profile > Fiscal Year.
2. Click Edit next to the appropriate picklist.
See Also:
Choosing a Custom Fiscal Year Template
Available in: All Editions except Database.com.
To change your fiscal year:
User Permissions Needed
“Customize Application”
When defining a new custom fiscal year, your first step is to choose a custom fiscal year template. These templates are available to make it easier for you to define your custom fiscal year. They create a simple custom fiscal year that you can customize to meet your exact needs.
Note: If you choose a template and realize that it is not the best one for your fiscal year definition, you can reset it at any time using the Reset Fiscal Year Structure option.
Choose one of three types of templates:
4 Quarters per Year, 13 Weeks per Quarter
Choose one of these templates for your fiscal year if you want each quarter to have the same number of weeks per quarter.
These templates all have 4 quarters, 12 periods, and 52 weeks per year. Each quarter is 13 weeks long and is composed of three periods. Two of the periods in each quarter are 4 weeks, and one is 5 weeks. In a 4-4-5 template, for example,
59
Set Up Your Organization About Fiscal Years the first and second period of a quarter are 4 weeks long, and the third period is 5 weeks long. Weeks are always 7 days long. A typical customization for these templates is to add extra weeks for leap years.
4-4-5
Within each quarter, period 1 has 4 weeks, period 2 has 4 weeks, and period 3 has 5 weeks
4-5-4
Within each quarter, period 1 has 4 weeks, period 2 has 5 weeks, and period 3 has 4 weeks
5-4-4
Within each quarter, period 1 has 5 weeks, period 2 has 4 weeks, and period 3 has 4 weeks
13 Periods per Year, 4 Weeks per Period
Choose one of these templates if your fiscal year has more than 12 periods and if one quarter is longer than the other quarters. These templates all have 4 quarters per year, 13 periods per year, 3 or 4 periods per quarter, 53 weeks per year, and 4 weeks per period (5 weeks in the final period). Weeks generally have 7 days, but will include a short week at the end of a year. The most common customization for this type of template is to create or change the length of a short week.
3-3-3-4
Quarter 1 has 3 periods, quarter 2 has 3 periods, quarter 3 has 3 periods, and quarter 4 has 4 periods
3-3-4-3
Quarter 1 has 3 periods, quarter 2 has 3 periods, quarter 3 has 4 periods, and quarter 4 has 3 periods
3-4-3-3
Quarter 1 has 3 periods, quarter 2 has 4 periods, quarter 3 has 3 periods, and quarter 4 has 3 periods
4-3-3-3
Quarter 1 has 4 periods, quarter 2 has 3 periods, quarter 3 has 3 periods, and quarter 4 has 3 periods
Gregorian Calendar
12 months/year, standard Gregorian calendar.
Unlike the other template styles, you cannot do advanced customization of a fiscal year that has been created from a
Gregorian calendar template. You should only use this template if you want to create a fiscal year that follows the
Gregorian calendar. This template mimics the functionality of standard fiscal years.
See Also:
60
Set Up Your Organization About Fiscal Years
Defining a Custom Fiscal Year
Available in: All Editions except for Database.com.
To view fiscal year:
To change your fiscal year:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
on page 55 for more information.
Enabling custom fiscal years does not automatically define them. You must define all of your company's custom fiscal years so that they fit your company's calendar.
If you have defined a custom fiscal year and you need to change it, you can edit the existing fiscal year definition. Custom fiscal years cannot be deleted. Instead of deleting an existing fiscal year, edit it until it meets your needs.
Before defining or editing any custom fiscal years, be aware of its impact on forecasting, reports, and other objects by reviewing
on page 52.
Defining a New Custom Fiscal Year
To define a new custom fiscal year:
1. Click
Your Name
> Setup > Company Profile > Fiscal Year.
2. Click New. The Custom Fiscal Year template dialog opens.
3. Choose a template and click Continue to close the Custom Fiscal Year template dialog. For more information on the templates, see
Choosing a Custom Fiscal Year Template
on page 59.
4. Set the fiscal year start date, the fiscal year name, and choose the week start day. You can also add a description for the fiscal year.
Note: If this is the first custom fiscal year you have defined, the
Fiscal Year Start Date
and the
Week
Start Date are set to today's date and day of week. If you have already defined a custom fiscal year, they will be set to the day after the last end date of your custom fiscal years.
If you need to make changes other than the start date, year name, or week start day, see
on page 56.
5. Optionally, review the fiscal year definition by clicking on Preview.
If it is correct, close the preview and click Save to save your fiscal year, or Save & New to save your fiscal year and define another fiscal year.
Editing a Custom Fiscal Year
To edit an existing custom fiscal year definition:
1. Click Your Name > Setup > Company Profile > Fiscal Year.
2. Click a defined fiscal year name to review the details. Close the fiscal year preview to continue.
3. Click Edit for the fiscal year you want to edit.
61
Set Up Search Customizing Search Settings
4. Change the
Fiscal Year Start Date
, the
Fiscal Year Name
,
Description
, or
Week Start Day
.
If changing the Fiscal Year Start Date causes this fiscal year to overlap with the previous fiscal year, or if it creates a gap between the fiscal years, the end date of the previous fiscal year will be changed to the day before the start of this fiscal year.
If changing the end date will cause this fiscal year to overlap the next fiscal year, or if it creates a gap between the fiscal years, the start date of the next fiscal year will be changed to the day after the end of this fiscal year.
Note: You cannot change the start or end date of a fiscal year that causes it to overlap with a fiscal year that is defined using a Gregorian year template.
Warning: If you change the start or end date of any quarter, period, or week, all forecast data (including quotas, forecast history, and forecast overrides) that are within that date range, and all forecasts for date ranges automatically adjusted as a result of that change, will be lost. This includes end or start date changes resulting from inserting or deleting periods.
5. Click Preview.
6. Review the fiscal year definition. If it is correct, close the preview and click Save to save your fiscal year. If you need to
make more detailed edits, see Customizing the Fiscal Year Structure on page 56.
Note: Unless you specify them, the fiscal year period labels for forecasting and reporting will be set by the default label values for the fiscal year periods. If you would like to change them, see
Customizing the Fiscal Year Labels
on page 57.
S
ET
U
P
S
EARCH
Customizing Search Settings
Available in: All Editions except Database.com
To modify search settings:
User Permissions Needed
“Customize Application”
To change your organization's search settings:
1. Click
Your Name
> Setup > Customize > Search > Search Settings.
2. Modify the search settings for your organization.
3. Click Save.
Search Settings
The search settings are:
62
Set Up Your Organization Customizing Search Settings
Enable Drop-Down List for Sidebar Search
The drop-down list for sidebar search allows you to limit users' searches by object. When you select Enable Drop-Down
List for Sidebar Search
, a drop-down list appears in the Search section. From this list users can select to search within tags, within a specific object, or across all objects.
Enable “Limit to Items I Own” Search Checkbox
The
Limit to Items I Own
checkbox allows your users to include only records for which they are the record owner when entering search queries in the sidebar.
Note: The
Limit to Items I Own
checkbox that appears in advanced search is always available to users, regardless of this setting.
Enable Document Content Search
Enabling
Document Content Search
allows you to perform a full-text document search. When a new document is uploaded or an old one is replaced, its contents are available as search terms to retrieve the document.
Enable Search Optimization if your Content is Mostly in Japanese, Chinese, or Korean
Enabling this checkbox optimizes search for the Japanese, Chinese, and Korean languages. It affects sidebar search and the account search for Find Duplicates on a lead record in sidebar search and global search. Enable this option if users are searching mostly in Japanese, Chinese, or Korean, and if the text in searchable fields is mostly in those languages.
Do not check this option if you expect content and searches to be mostly in other languages.
Use Recently Viewed User Records for Blank and Auto-Complete Lookups
If this setting is enabled, the list of records returned from a user auto-complete lookup and from a blank user lookup is taken from the user's recently viewed user records. This setting applies only to user object lookups and not to lookups for other objects.
If this setting is not enabled, the dialog shows a list of recently accessed user records from across your organization.
Enable English-Only Spell Correction for Knowledge Search (Beta)
If this setting is enabled, search suggests and searches alternate spellings for English search terms on the Articles and
Article Management tabs, in the articles tool in Case Feed, and in the Salesforce Knowledge sidebar in the Service Cloud console. This setting applies to article searches via the API but not to article searches in global search.
Enable Sidebar Search Auto-Complete
If this setting is enabled, when users start typing search terms, sidebar search displays a matching list of recently viewed records.
Note: Global search includes auto-complete and doesn't require a search setting.
Enable Single-Search-Result Shortcut
If this setting is enabled, users skip the search results page and go directly to the record's detail page when their search returns only a single item.
This setting doesn't apply to tags, case comments (in advanced search), and global search. If the search result is a single tag, case comment, or item in global search, the search results page still appears.
63
Set Up Search Customizing Users' Search Results Filters
Number of Search Results Displayed Per Object
The Number of Search Results Displayed Per Object area allows you to configure the number of items that are returned for each object in the Search Results page. The current setting is in parentheses next to each object. To make changes, select one or more objects, enter the new number of results per page, and click Save. The new value must be between 5 and 50.
Lookup Settings
The Lookup Settings area allows you to enable enhanced lookups and lookup auto-completion for account, contact, user, and any custom object lookups.
Customizing Users' Search Results Filters
Available in: All Editions except Database.com
To change search layouts:
User Permissions Needed
“Customize Application”
To customize search result filters for all users:
1. On the Search Results page, in an object's related list, click Customize... > Filters for All Users.
Alternatively, click
Your Name
> Setup > Customize >
Object Name
> Search Layouts, and click Edit next to Search
Filter Fields.
2. To choose columns, use Add and Remove.
3. To reorder columns, use Up and Down.
4. Click Save.
Configuring Lookups
Available in: All Editions except Database.com
Administrators can configure lookups by:
•
•
Specifying lookup filter fields
•
Enabling lookup auto-completion
64
Set Up Your Organization Configuring Lookups
Enabling Enhanced Lookups
Available in: All Editions except Database.com
To enable enhanced lookups:
User Permissions Needed
“Customize Application”
Enable enhanced lookups so users can use wildcards in their lookups and sort, filter, and page through their results.
1. Click Your Name > Setup > Customize > Search > Search Settings.
2. In the Lookup Settings area, select the objects for which you want to enable enhanced lookup functionality. Currently, only account, contact, user, and custom object lookups can use this feature.
3. Click Save.
After enabling enhanced lookups, specify which fields users can use to filter lookup search dialog results. If you don't specify any fields, your users can't use filters in enhanced lookup dialogs.
Note: If you enable enhanced lookups in your organization, it is also enabled for any Visualforce pages you create.
See Also:
Specifying Lookup Filter Fields
Available in: All Editions except Database.com
To specify lookup filter fields:
User Permissions Needed
“Customize Application”
After enabling enhanced lookups, specify which fields users can use to filter lookup search dialog results. If you don't specify any fields, your users can't use filters in enhanced lookup dialogs.
1. Take the action for the type of object you want.
• For accounts, contacts, or users:
a. Click
Your Name
> Setup > Customize.
b. Select Accounts, Contacts, or Users.
c. Click Search Layouts.
65
Set Up Your Organization Configuring Lookups
• For custom objects:
a. Click
Your Name
> Setup > Create > Objects.
b. Click the name of the object you want.
c. Scroll to the Search Layouts related list.
2. Click Edit next to the Lookup Filter Fields layout.
3. Use the arrows to add or remove fields from the layout and to define the order in which the fields should display. You can add up to six filter fields to the Selected Fields list. To select more than one field, use CTRL+click, or SHIFT+click to select multiple items in a range.
4. Click Save.
See Also:
Enabling Lookup Auto-Completion
Available in: All Editions except Database.com
To enable lookup auto-completion:
To use lookup auto-completion:
User Permissions Needed
“Customize Application”
“Edit” on the record that includes the lookup field
With lookup auto-completion, users can select items from a dynamic list of matching, recently used records when editing a lookup field. Lookup auto-completion is available on account, contact, user, and custom object lookups. To enable it:
1. Click Your Name > Setup > Customize > Search > Search Settings.
2. In the Search Settings area, select the object lookups for which you want to enable auto-completion. Currently, only account, contact, user, and custom object lookups can use this feature.
3. Click Save.
See Also:
66
Set Up Your Organization State and Country Picklists—Beta
State and Country Picklists—Beta
Available in: All Editions except Database.com
State and country picklists allow users to select states and countries from predefined, standardized lists, instead of entering state and country data into text fields. State and country picklists allow for faster and easier data entry and help to ensure cleaner data that can be leveraged for other uses—in reports and dashboards, for example—with more dependable results. The state and country names in the picklists are based on ISO-3166 standard values, making them compatible with other applications as well.
Note: This release contains a beta version of state and country picklists that is production-quality but has known limitations. To provide feedback on state and country picklists, go to IdeaExchange .
This beta release of state and country picklists makes the picklists available in the shipping, billing, mailing, and “other” address fields in the Salesforce standard objects Account, Contact, Contract, Lead, Person Accounts, Quotes, and Service Contracts.
The picklists are also available for managing users and companies in Administration Setup. First choose the country and then choose from the options that automatically populate the state or province picklist. For the beta release, 249 countries are supported, as well as the states and provinces of the US and Canada.
In this beta release, you can access and use the new picklists in most places that state and country fields are available in Salesforce, including:
• Record edit and detail pages
• List views, reports, and dashboards
• Filters, functions, rules, and assignments
In some cases, you’ll see both the old, text-based state and country fields, as well as the new picklists. If a state or country field is appended with (text only) , it refers to the state or country from an old, unconverted text field. If it is appended with
Code
, as in ShippingCountryCode, it refers to a new picklist field.
State and country picklists can also be searched.
State and Country Picklist Beta Limitations
In this beta release, state and country picklists do not work with:
• Campaign Members
• Translation Workbench
• Salesforce to Salesforce
• Salesforce Touch or Salesforce Mobile
• Visual Workflow, packaging, or partner portals
• Custom indexes or outbound messages
Implementing State and Country Picklists
The process of transitioning from text-based state and country fields to state and country picklists involves five steps.
1. Configure the state and country picklists in the Metadata API. This step is optional but recommended. For more information, read about the AddressSettings component in the Metadata API Developer's Guide.
67
Set Up Your Organization State and Country Picklists—Beta
2.
Scan your organization’s data and customizations to see how they’ll be affected by the switch.
data and update such customizations as list views, reports, and dashboards so they continue to work with the new data type.
3.
The conversion process lets you map the various values in your organization to standard picklist
values. For example, U.S., USA, and United States all map to US.
Note: New organizations include sample account and contact data that you should delete prior to implementing state and country picklists. Choose Setup > Data Management > Mass Delete Records. Then choose the option to Mass Delete Accounts or Mass Delete Contacts.
4.
Turn on the picklists for your users.
5. Optionally, rescan and fix customizations that might still need updating so that they work with the new picklists.
Best Practices for Scanning State and Country Data and Customizations
Available in: All Editions except Database.com
Before switching from text-based state and country fields to standardized state and country picklists, scan your organization to see how it will be affected by the change. This “discovery” process shows you where and how text-based state and country data appears in your organization, and where it is used in customizations, such as list views and reports. After you’ve analyzed the findings of the scan, you can plan accordingly to convert data, update your customizations, and turn on state and country picklists for your users.
Every organization’s discovery process will be unique. For some organizations, the process of transitioning from state and country text fields to standardized picklist values will be straightforward and manageable. For others, it might be a complicated and time-consuming—even daunting—process if state and country metadata is used extensively throughout the organization.
Salesforce.com recommends that you scan your organization early and often so that you can transition smoothly to the new lists. Here are some other best practices and known limitations to keep in mind.
• Scanning does not actually convert any data or fix your customizations. You must convert your data separately and update your customizations individually.
• You can continue to work normally in your organization during the scan.
• The scanning process identifies affected managed packages but doesn’t provide a mechanism for addressing packaging issues.
• Scanning doesn’t find formulas that include state and country metadata.
• If scanning reveals a validation rule or workflow rule that uses a formula function that makes a comparison on state or country text fields (for example,
BEGINS
,
CONTAINS
,
ISCHANGED
, or
REGEX
), you’ll need to use
ISPICKVAL
to make comparisons after converting to state and country picklists.
• Scanning doesn’t find personal list views and reports that use state and country metadata. Individual users will have to update those customizations themselves.
68
Set Up Your Organization State and Country Picklists—Beta
• You can—and should—scan your organization multiple times: After you update a customization, scan again to make sure your changes fixed the problem and didn’t create any new ones.
See Also:
Scanning State and Country Data and Customizations
State and Country Picklists—Beta
Scanning State and Country Data and Customizations
Available in: All Editions except Database.com
User Permissions Needed
To scan state and country data and customizations: “Modify All Data”
Scanning an organization for text-based state and country values is the first step in transitioning to standardized state and country picklists. Scanning reveals where and how text-based state and country data appears in records—for example, you can see all the ways “United States” is saved as a text value, such as “U.S.,” “US,” “America,” and even misspelled entries like
“Unnited States.” In addition, scanning shows you where state and country data is used in customizations, including:
• List views
• Reports
• Validation rules
• Custom buttons and links
• Workflow rules
• Email templates
• Field sets
• Apex classes and triggers
• Visualforce pages
When the scan is complete, you’ll receive two emails with links to detailed reports: one on address data and one on customizations. After analyzing the reports, you can begin the tasks of actually converting existing data to picklist values and updating customizations so they work with the new picklists.
1. Click Your Name > Setup > Data Management > State and Country Picklists.
2. On the State and Country Picklists Setup page, under Step 2,
Scan your organization
, click Scan Now and then click Scan.
3. Wait for the results, which will be emailed to you.
Depending on the size and complexity of your organization, it might take a few minutes or a few hours for the results to be generated.
Note: The emails are sent from [email protected]. They have the subject line, “Salesforce.com Address
Data Scan” or “Salesforce.com Address Customization Scan.” If you don’t receive the emails, make sure that the emails weren’t caught in a spam filter.
69
Set Up Your Organization State and Country Picklists—Beta
4. Click the link in each email to go to a document that contains the report of affected data or customizations.
5. Click View file.
See Also:
State and Country Picklists—Beta
Overview of State and Country Data Conversion
Available in: All Editions except Database.com
Salesforce organizations containing text-based state and country values can convert that data to standardized picklist values.
Converting existing data allows you to keep working with the data after you switch to picklists. Say, for example, you have a report that culls all of your sales reps’ leads in Washington state, and the report is generated from state picklist value US-WA.
To ensure that records with text-based state values such as Wash., WA, and Washington are included in the report, convert text-based state data to standardized picklist values.
Converting existing state and country text data into standardized picklist values is not required, but doing so preserves and helps ensure data integrity after picklists are enabled in the organization.
When you convert data, Salesforce starts with countries, then goes on to states. As you go through the conversion process, here are a few things to keep in mind:
• Save frequently. You can exit the conversion tool and return to it at any time.
• You can continue to work normally in your organization while converting data.
• You can’t convert data while you’re scanning for affected data and customizations, or while state or country picklists are being deployed.
70
Set Up Your Organization State and Country Picklists—Beta
• Steps can be repeated and undone at any time until you enable the picklists for users. After the picklists are enabled, you can’t undo.
See Also:
Converting State and Country Data
State and Country Picklists—Beta
Converting State and Country Data
Available in: All Editions except Database.com
To convert text-based state and country data:
User Permissions Needed
“Modify All Data”
Before you can convert state and country values in the State and Country Picklists setup, you should configure the picklists using the Metadata API. Version 27.0 includes a new (beta) component called AddressSettings that represents state and country picklists. See the Force.com Metadata API Developer's Guide for more information.
The advantages of configuring picklists in the Metadata API before converting data are that:
• When picklists are enabled, all new records created or updated will use your specified integration value, helping to ensure consistent and accurate data in your organization.
• You can mark picklist values as inactive, which you can’t do after enabling the picklists.
When converting existing text-based state and country data to picklist-compatible values, you select specific text values and choose the standard values you want to map them to. For example, you can select all occurrences of “USA” and change them to “United States.”
You must convert countries first, then states and provinces.
You can convert up to 2,000 country values and up to 2,000 state values.
1. Click
Your Name
> Setup > Data Management > State and Country Picklists.
2. On the State and Country Picklists Setup page, under Step 3, Convert your data , click Convert now.
Salesforce opens the Convert Countries page, which displays all of the country text values that appear in your organization and the number of times each value is used.
3. Select the Change box for one or more values you want to convert. For example, select all the iterations of United States.
4. In the Change To area, choose the country you want to convert the text values to and click Save to Changelist.
Note: If you map states or countries to
Unknown value
, users will see states and counties in their records but will encounter an error if they try to edit those values.
5. Repeat Steps 3 and 4 for other country values, such as for Canada.
Salesforce tracks planned changes in the Changelist area.
6. When all of the countries are mapped, click Next to convert state values.
Use the Country of Origin column to identify the country associated with that state or province.
71
Set Up Your Organization State and Country Picklists—Beta
7. On the Confirm Changes page, click Finish to return to the setup overview page or Finish and Enable Picklists to convert the values and turn on state and country picklists in your organization.
A few words about undo:
• On the Convert Countries or Convert States page, click Undo at any time to revert values in the changelist.
• On the Convert States page, click Previous to return to the Convert Countries page and change country mappings.
• You can convert state and country values even after clicking Finish. After picklists are enabled, however, you can no longer edit your conversion mappings.
See Also:
State and Country Picklists—Beta
Enabling and Disabling State and Country Picklists
Available in: All Editions except Database.com
To turn state and country picklists on and off:
User Permissions Needed
“Modify All Data”
When you enable state and country picklists, the lists become available to users right away. However, it can take some time for Salesforce to populate the ISO code fields on existing records. If a user tries to edit the state or country on a record before the code field is populated, he or she will be prompted to select a code value.
1. Click Your Name > Setup > Data Management > State and Country Picklists.
2. On the State and Country Picklists Setup page, in Step 4, click Enable to turn on the picklists.
Note: You can also enable state and country picklists when you finish converting existing, text-based data to picklist values. See
Converting State and Country Data
.
3. To turn off state and country picklists, click Disable at the bottom of the State and Country Picklists Setup page.
If you disable state and country picklists, fields and values revert to text.
See Also:
State and Country Picklists—Beta
72
Set Up Your Organization Customizing User Interface Settings
Customizing User Interface Settings
The available user interface settings vary according to which Salesforce Edition you have.
To modify user interface settings:
User Permissions Needed
“Customize Application”
To change your organization's user interface settings:
1. Click Your Name > Setup > Customize > User Interface.
2. Select or deselect each checkbox to modify the user interface settings for your organization.
3. Click Save.
User Interface Settings
Enable Collapsible Sections
Collapsible sections give users the option to collapse or expand sections on their record detail pages using the arrow icon next to the section heading. When enabling collapsible sections, make sure your section headings are displayed for each page layout. Sections remain expanded or collapsed until the user changes his or her settings for that tab. If your organization has enabled record types, Salesforce remembers a different setting for each record type.
Note: Call center users won't see incoming calls if they collapse the sidebar.
Show Quick Create
The Quick Create area on a tab home page allows users to create a new record quickly with minimal information. It displays, by default, on the tab home pages for leads, accounts, contacts, forecasts, and opportunities. You can control whether the Quick Create area is displayed on all relevant tab home pages.
Note: The
Show Quick Create
setting also affects whether or not users can create new records from within the lookup dialog. For example, with the setting enabled, users can create a new account within the account lookup dialog while creating or editing a contact. Creating new records in the lookup dialog is available only if
Quick Create is available for your chosen record type. In addition, users always need the appropriate “Create” permission to use Quick Create even though it will be displayed for all users.
Enable Hover Details
Hover details display an interactive overlay containing detailed information about a record when users hover the mouse over a link to that record in the Recent Items list on the sidebar or in a lookup field on a record detail page. Users can quickly view information about a record before clicking View for the record's detail page or Edit for the edit page. The fields displayed in the hover details are determined by the record's mini page layout. The fields that display in document hover details are not customizable. This option is enabled by default.
Note: To view the hover details for a record, users must have the appropriate sharing access to that record, as well as the necessary field-level security for the fields in the mini page layout.
73
Set Up Your Organization Customizing User Interface Settings
Enable Related List Hover Links
Related list hover links display at the top of record detail pages and custom object detail pages in Setup. Users can hover the mouse over a related list hover link to display the corresponding related list and its number of records in an interactive overlay that allows users to quickly view and manage the related list items. Users can also click a related list hover link to jump down to the content of the related list without having to scroll down the page. The Enable Related List
Hover Links
checkbox is the default selection.
Enable Separate Loading of Related Lists
Select this option to enable the separate loading of record detail pages: primary record details load first, followed by related list data. When you enable this option, users see primary record details immediately; as related list data loads, users see a progress indicator. Separate loading can improve performance on record detail pages for organizations with large numbers of related lists. This option is disabled by default. Note that this option does not apply to Visualforce pages, user pages, the self-service portal, or other pages for which you cannot control the layout.
Enable Inline Editing
Inline editing lets users quickly edit field values, right on a record’s detail page. This option is enabled by default and applies to all users in your organization.
Note: This doesn't enable inline editing for profiles. Select Enable Enhanced Profile List Views under Setup.
Enable Enhanced Lists
Enhanced lists give you the ability to quickly view, customize, and edit list data to speed up your daily productivity.
When enabled with the Enable Inline Editing setting, users can also edit records directly from the list, without navigating away from the page. This option is enabled by default.
Note: This doesn't enable enhanced lists for profiles. Select Enable Enhanced Profile List Views under Setup.
Enable New User Interface Theme
Note: Starting with Summer '10, new organizations have the new user interface theme enabled by default.
The new user interface theme updates the look and feel of Salesforce and moves user links, such as Setup and Logout, under the user name for all users in your organization. The new user interface theme is not supported in Portals, Console tab, or Help & Training.
Only users with supported browsers see the new user interface theme.
Enable Tab Bar Organizer
The Tab Bar Organizer automatically arranges tabs in the main tab bar to prevent horizontal scrolling of the page. It dynamically determines how many tabs can display based on the width of the browser window and puts tabs that extend beyond the browser's viewable area into a drop-down list.
Note: Note the following limitations:
• The Tab Bar Organizer isn’t available with the partner portal or Customer Portal.
• The Tab Bar Organizer is only available with the new user interface theme. Organizations using the old user interface theme can enable the feature, but it won't be available for users until the new theme is also enabled.
74
Set Up Your Organization Customizing User Interface Settings
• The Tab Bar Organizer isn’t available on Internet Explorer 6.
Enable Printable List Views
Printable list views allow users to easily print list views. If enabled, users can click the Printable View link from any list view to open a new browser window, displaying the current list view in a simple, print-ready format. The link is located next to the Help for this Page link in the colored title bar of the page.
Enable Spell Checker
Available in all Editions. If this option is selected, the Check Spelling button appears in certain areas of the application where text is entered, such as sending an email, or when creating events, tasks, cases, notes, and solutions. Clicking the button checks the spelling of your text. Spell Checker does not support all the languages that Salesforce supports. For example, Spell Checker doesn’t support Thai, Russian, and double-byte languages, such as Japanese, Korean, or Chinese.
Enable Spell Checker on Tasks and Events
Available in all Editions. Select this checkbox to enable the Check Spelling button when users create or edit tasks or events. The spell checker analyzes the Description field on events and the Comments field on tasks.
Sidebar Settings
Enable Collapsible Sidebar
The collapsible sidebar gives users the ability to show or hide the sidebar on every page that normally includes the sidebar.
When you select the Enable Collapsible Sidebar setting, the collapsible sidebar becomes available to all users in your organization, but each user can choose his or her own preference for displaying the sidebar. Users can leave the sidebar visible at all times, or they can collapse the sidebar and only show it when needed by clicking the edge of the collapsed sidebar.
Tip: If your organization uses divisions, we recommend that you keep the sidebar pinned and visible at all times so you always have access to the Divisions drop-down list.
Show Custom Sidebar Components on All Pages
If you have custom home page layouts that include components in the sidebar, this option makes the sidebar components available on all pages for all users in your organization. If you only want certain users to view sidebar components on all pages, grant those user the “Show Custom Sidebar On All Pages” permission.
Note: If the Show Custom Sidebar Components on All Pages user interface setting is selected, the
“Show Custom Sidebar On All Pages” permission is not available.
Calendar Settings
Enable Home Page Hover Links for Events
Select this checkbox to enable hover links in the calendar section of the Home tab. On the Home tab, users can hover the mouse over the subject of an event to see the details of the event in an interactive overlay. This option is enabled by default. Note that this checkbox only controls the Home tab; hover links are always available on other calendar views.
The fields available in the event detail and edit overlays are defined in a mini page layout.
Note: If you create all day events, we recommend adding the All Day Event field to the events mini page layout.
75
Set Up Your Organization Customizing User Interface Settings
Enable Drag-and-Drop Editing on Calendar Views
Select this checkbox to enable the dragging of events on single user daily and weekly calendar views. This allows users to reschedule events without leaving the page. This option is enabled by default.
Note: Calendar views might load less quickly when this checkbox is enabled.
Enable Click-and-Create Events on Calendar Views
Select this checkbox to enable users to create events on day and weekly calendar views by double-clicking a specific time slot and entering the details of the event in an interactive overlay. The fields available in the event detail and edit overlays are defined in a mini page layout.
Note that recurring events and multi-person events are not supported for click-and-create events on calendar views.
Enable Drag-and-Drop Scheduling on List Views
Select this checkbox to enable users to create events associated with records by dragging records from list views on to weekly calendar views and entering the details of the event in an interactive overlay. This option is disabled by default.
The fields available in the event detail and edit overlays are defined in a mini page layout.
Enable Hover Links for My Tasks List
Select this checkbox to enable hover links for tasks in the My Tasks section of the Home tab and on the calendar day view. This option is enabled by default. Users can hover the mouse over the subject of a task to see the details of that task in an interactive overlay.
The information presented on these overlays is configured by your administrator.
Setup Settings
Enable Enhanced Page Layout Editor
Select this checkbox to activate the enhanced page layout editor for your organization. When enabled, the enhanced page layout editor replaces the current interface for editing page layouts with a feature-rich WYSIWYG editor that contains all of the functionality of the original page layout editor as well as several improvements.
Enable Enhanced Profile List Views
Select this checkbox to activate enhanced list views and inline editing on the profiles list page. With inline editing in enhanced profile list views, you can manage multiple profiles at once.
Enable Enhanced Profile User Interface
Select this checkbox to activate the enhanced profile user interface, which allows you to easily navigate, search, and modify settings for a single profile.
Enable Streaming API
Select this checkbox to activate Streaming API, which allows you to receive notifications for changes to data that match a SOQL query that you define, in a secure and scalable way. This field is selected by default. If you don’t see this checkbox, first verify that your Salesforce edition has API access. If your Salesforce edition has API access and you don’t see the checkbox, contact salesforce.com.
Enable Custom Object Truncate
Select this checkbox to activate truncating custom objects, which permanently removes all of the records from a custom object while keeping the object and its metadata intact for future use.
76
Set Up Your Organization Customizing Report and Dashboard Settings
Advanced Settings
Activate Extended Mail Merge
Select this checkbox to activate Extended Mail Merge for your organization. When selected, the Mass Mail Merge link is available in the Tools area on the home pages for accounts, contacts, and leads. Also, single mail merges requested from the Activity History related list on a record are performed using Extended Mail Merge functionality.
Extended Mail Merge is available by request only. Contact salesforce.com Customer Support if you are interested in this feature.
Always save Extended Mail Merge documents to the Documents tab
When this checkbox is selected, all mail merge documents generated using Extended Mail Merge are added to the user's personal documents folder on the Documents tab, rather than delivered as email attachments. Users are sent confirmation emails when their mail merge requests have completed. Those emails include links for retrieving generated documents from the Documents tab. Note that these documents count against your organization's storage limits.
Customizing Report and Dashboard Settings
Available in: All Editions except Database.com
To modify report and dashboard settings:
User Permissions Needed
“Customize Application”
Administrators can set up and manage report and dashboard settings from the Reports & Dashboards page. To get to this page, click Your Name > Setup > Customize > Reports & Dashboards and click the following links to access report and dashboard settings:
• Customize report and dashboard user interface settings—Control features of the report and dashboard user interface, such as floating report headers, the auto-complete Dashboard Finder, and charting options.
• Customize report and dashboard email settings—Control the way email notifications are sent, including image handling in dashboard emails for Lotus Notes users and sending reports and dashboard refresh notifications to portal users.
• Customize report folders—Click this link to go to the last open report folder. From there, you can edit folder properties, such as name, access, and sharing.
See Also:
Customizing Report and Dashboard User Interface Settings
Customizing Report and Dashboard Email Settings
77
Set Up Your Organization Customizing Report and Dashboard Settings
Customizing Report and Dashboard User Interface Settings
Report and dashboard user interface settings that you can modify include floating report headers, the dashboard finder, the report timeout warning, and dashboard component snapshots. You can choose to enable or disable each of these for your organization..
Available in: All Editions except Database.com
To modify report and dashboard settings:
User Permissions Needed
“Customize Application”
1. Click Your Name > Setup > Customize > Reports & Dashboards > User Interface Settings.
2. Select or deselect options to modify the settings for your organization.
Enable Floating Report Headers
Floating report headers keep the column headings on tabular reports in sight no matter how far users scroll down report results. With floating report headers, users can scroll to the bottom of lengthy tabular reports without having to scroll back to the top to view the names of the column headings. Users can also click floating report headers to sort data in a specific column. When users sort data by clicking a floating report heading, the report refreshes and redirects users to the beginning of report results.
Enable Dashboard Finder
Dashboard finder uses auto-complete to help users quickly find dashboards in the Dashboards tab. This option is enabled by default. To find a dashboard on the Dashboards tab, start typing its name in the search filter, and all dashboards matching that text are dynamically displayed in the drop-down list. The list first shows dashboards the user viewed recently, and then other dashboards appear in alphabetical order by folder. The first 1000 results are shown in a single list; above 1000, results are shown 500 per page. Users only see dashboards in folders they can access. Disable this option to use the static drop-down list instead.
Enable Report Timeout Warning
The report timeout warning analyzes reports at runtime, identifies those that are highly complex and likely to time out, and displays a warning. This option is enabled by default. Users with permission to modify reports can edit the report to improve performance. Users can also run the report in spite of the warning.
The report timeout warning only analyzes reports run manually from the Run Reports page. It doesn’t analyze scheduled reports, reports run from dashboards, or reports run using background export.
The report timeout warning might occasionally flag reports that don’t time out. Additionally, the warning assumes that your organization’s reports will time out after 10 minutes, which is the standard length of time reports can run before timing out. If your organization has extended the limit to 20 minutes, the reports might be less likely to time out. Keep in mind that, even if flagged reports run successfully, they remain highly complex, required extended run times, and could time out in the future.
78
Set Up Your Organization Customizing Report and Dashboard Settings
Enable Dashboard Component Snapshots
Dashboard component snapshots let users with access to dashboards post static images of dashboard components to
Chatter user or group feeds, making the snapshot visible to all users. Chatter feed tracking for dashboards must first be enabled.
Important: This option lets users override dashboard visibility settings, making snapshots visible to all
Chatter users. Though this makes it easy to share time-specific data without having to add people to dashboard folders, be aware that users can inadvertently post sensitive or confidential information.
3. Click Save.
Customizing Report and Dashboard Email Settings
Available in: Enterprise, Unlimited, and Developer Editions
To modify report and dashboard settings:
User Permissions Needed
“Customize Application”
To change your organization's report and dashboard email settings:
1. Click
Your Name
> Setup > Customize > Reports & Dashboards > Email Settings.
2. Select or deselect the following checkboxes to modify the settings for your organization:
Use Images Compatible with Lotus Notes in Dashboard Emails
Dashboard refresh notifications can be sent to specified users when a scheduled dashboard refresh completes. By default, Salesforce sends images in dashboard emails as
.png
(Portable Network Graphic) files, which are not supported in Lotus Notes. When you enable the Use Images Compatible with Lotus Notes in Dashboard
Emails
> option, Salesforce uses
.jpg
images, which Lotus Notes supports, when sending dashboard emails. The
“Schedule Dashboard” permission is required to view this option.
Note: Dashboard emails that contain images compatible with Lotus Notes are substantially larger and the image quality may be lower.
Allow Reports and Dashboards to Be Sent to Portal Users
This option, disabled by default, is available to Enterprise and Unlimited Edition organizations that have a Customer
Portal or partner portal set up. Unless enabled, only internal Salesforce users can receive reports and dashboard refresh notifications. If you enable this option, all internal and portal users specified as recipients receive reports and dashboards.
3. Click Save.
79
Set Up Your Organization Managing Billing & Licenses
Upgrade Report Builder
Available in: All Editions except Database.com
To modify report and dashboard settings:
User Permissions Needed
“Customize Application”
We've released an updated version of report builder, the powerful drag-and-drop editor for reports. With this upgrade:
• All profiles get access to the report builder by default. (You may continue to see the “Report Builder” permission in permission sets and profiles and the PermissionSet and Profile objects in the API, though the upgrade overrides those settings.)
• The old report wizard will be available only to users in Accessibility Mode.
• Group and Professional Edition organizations can use report builder.
• You get scatter charts, a new chart type for reports.
Administrators for existing organizations must manually enable this upgrade. New organizations automatically get the latest version of report builder. If you don't see the Report Builder Upgrade section on the User Interface Settings page, the upgrade has already been enabled for your organization. It’s important to understand that assigning the “Report Builder” permission to all users through profiles or permission sets isn’t the same thing as enabling report builder for your entire organization. To do that, you need to follow the procedure in this topic.
Important: Upgrading does not affect any of your existing reports. However, once you upgrade, you can't return to the old report wizard.
To enable report builder for all users:
1. Click Your Name > Setup > Customize > Reports & Dashboards > User Interface Settings.
2. Review the Report Builder Upgrade section of the page and click Enable. If you don’t see the button, report builder has already been enabled for your entire organization.
3. Confirm your choice by clicking Yes, Enable Report Builder for All Users.
Managing Billing & Licenses
Available in: Contact Manager, Group, Professional, Enterprise, and Unlimited Editions
Checkout contains details about your organization’s Salesforce account, including your licenses, billing information, orders, invoices, and statements.
To access Checkout, click Your Name > Setup > Checkout Summary then choose Proceed to Checkout.
Note: Users with the “Manage Billing” permission have automatic access to Checkout. These users can also grant access to others within the organization
on page 83.
80
Set Up Your Organization Managing Billing & Licenses
From Checkout, you can:
•
Order more licenses and products .
•
Change your billing information
for an active contract.
•
Change credit card information associated with an active contract.
•
View your organization’s orders and invoices
.
• View your previously saved quotes—both quotes you created from Salesforce and quotes created by a sales representative.
• Place orders to purchase new products.
• Contact salesforce.com to request sales assistance.
• Log a case for any Checkout related questions, issues, or concerns.
For detailed instructions on using Checkout, see the Checkout User Guide .
Adding or Subtracting User Licenses
Available in: Personal, Contact Manager, Group, Professional, Enterprise, Unlimited Editions
Users with a Checkout account can add licenses for your organization. If your organization doesn’t have self-service access to
Checkout, submit a request to your salesforce.com representative.
To add more licenses, you must create a quote using Checkout. For more detailed instructions on creating a quote, see the
Checkout User Guide .
Note: At any point during the quote creation process, you can click Request Assistance to contact your salesforce.com
account representative.
If you're a trial user, see Converting a Trial Using Checkout
.
To add more licenses:
1. Create a quote by performing one of the following actions:
• Click
Your Name
> Setup > Checkout Summary and choose Proceed to Checkout.
• Click
Your Name
> Setup > Company Profile > Company Information and click Buy More Licenses in the appropriate related list.
2. Click Add More Salesforce Seats. You can also add more users from within Salesforce.
3. If you have a Group, Professional, Enterprise, or Unlimited Edition subscription:
a. Select your service start date, Edition, number of licenses, and additional products, and click Continue to Order Review.
b. The Order Review page displays a summary of information you entered as well as complete pricing for the products on the quote. If necessary, read and agree to contract special terms or the Master Subscription Agreement by checking the applicable box below each term. Click Place Order.
4. If you have a Contact Manager subscription:
a. Select your service start date, number of additional users, and click Continue to Order Review.
b. The Order Review page displays a summary of information you entered as well as complete pricing for the products on the quote. Click Place Order to place the order.
81
Set Up Your Organization Managing Billing & Licenses
To reduce the number of licenses for your organization contact your salesforce.com representative.
Note: Deactivating a user’s account does not change the number of user licenses for which your company is billed.
For detailed instructions on using Checkout, see the Checkout User Guide .
See Also:
Changing Billing Information
Available in: Contact Manager, Group, Professional, Enterprise, and Unlimited Editions
To change your organization’s payment and billing information, you must have access to Checkout. If your organization doesn’t have self-service access to Checkout, submit a request to your salesforce.com representative.
1. Click Your Name > Setup > Checkout Summary then click Proceed to Checkout.
2. Click Change Contract Billing Address.
3. Update your organization’s address and contact information as necessary.
4. Click Save.
For detailed instructions on using Checkout, see the Checkout User Guide .
See Also:
Changing Credit Card or Direct Debit Information
Available in: Contact Manager, Group, Professional, Enterprise, and Unlimited Editions
To change your credit card or direct debit information, you must have access to Checkout. If your organization doesn’t have self-service access to Checkout, submit a request to your salesforce.com representative.
To access Checkout, go to Your Name > Setup > Checkout Summary and then click Proceed to Checkout.
For specific instructions on changing your payment information in Checkout, see the Checkout User Guide .
82
Set Up Your Organization Managing Billing & Licenses
Note:
You can’t pay your invoice online. Your newly-updated credit or debit card will be charged within 24 hours if there is an outstanding balance on your account. To pay an invoice via credit card, please call the salesforce.com Customer
Service department.
See Also:
Viewing Credit Memos, Account Statements, and Invoices
Available in: Contact Manager, Group, Professional, Enterprise, and Unlimited Editions
To view your organization’s credit memos, account statements, and invoices, you must have access to Checkout. If your organization doesn’t have self-service access to Checkout, submit a request to your salesforce.com representative.
From a credit memo, statement, or invoice details page, you can print, log cases to investigate issues, or contact salesforce.com.
To access Checkout, go to Your Name > Setup > Checkout Summary and then click Proceed to Checkout.
Note: Your account may not have a starting balance depending on the duration of time chosen. You can open all payments, invoices, and credit memos to see more detail or to print them.
For detailed instructions on using Checkout, see the Checkout User Guide .
See Also:
Granting Checkout Access
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To grant Checkout access:
To edit users:
User Permissions Needed
“Manage Billing”
“Manage Users”
Users with the “Manage Billing” permission have access to Checkout when it is enabled for your organization. These users can also grant access to other users within your organization. Users with Checkout access can purchase Salesforce licenses,
83
Set Up Your Organization Critical Updates Overview
AppExchange app licenses, and other related products. Additionally, within Checkout, users can view the organization's quotes, installed products, orders, invoices, payments, and contracts.
To give a user access to Checkout:
1. Click Your Name > Setup > Manage Users > Users.
2. Click on the appropriate user's name to open the user detail page.
3. Click Edit.
4. Select the
Checkout Enabled
checkbox. The user is notified by email when his or her Checkout account is activated and available for login.
See Also:
Critical Updates Overview
Available in: All Editions
To view critical updates:
To activate critical updates:
User Permissions Needed
“View Setup”
“Modify All Data” and “Customize Application”
Salesforce.com periodically releases updates that improve the performance, logic, and usability of Salesforce, but may affect your existing customizations. When these updates become available, Salesforce lists them at
Your Name
> Setup > Critical
Updates, sends a notification email to administrators, and displays a message when administrators click Your Name > Setup.
To ensure a smooth transition, each update has an opt-in period during which you can manually activate and deactivate the update an unlimited number of times to evaluate its impact on your organization and modify affected customizations as necessary. The opt-in period ends on the auto-activation date, at which time Salesforce permanently activates the update.
Warning: Salesforce.com recommends testing each update by activating it in either your Developer Sandbox or your production environment during off-peak hours.
To manage critical updates, click
Your Name
> Setup > Critical Updates. From this page, you can:
• View the summary, status, and auto-activation date for any update that Salesforce has not permanently activated.
• Click Review to view the detail page of any update that Salesforce has not permanently activated. The details include a list of the customizations in your organization that the update might affect and the activation history, which lists each time the update was activated and deactivated.
• Click Activate to activate any inactive update.
• Click Deactivate to deactivate any active update that Salesforce has not permanently activated.
84
Set Up Your Organization About Divisions
Notes on Critical Updates
• Salesforce analyzes your organization to determine if a critical update potentially affects your customizations. If your customizations are not affected, Salesforce automatically activates the update in your organization, and the update does not appear when you click Your Name > Setup > Critical Updates.
• On the scheduled auto-activation date, Salesforce permanently activates the update. After auto-activation, you cannot deactivate the update.
• Each update detail page describes how your customizations might be affected and how you can correct any unintended functionality.
• Salesforce displays a message the first time you access the setup menu after a critical update becomes available. The message lets you choose to have Salesforce display the updates immediately or remind you about the updates later. You can also choose to have Salesforce neither display the updates nor remind you. If you choose this option, Salesforce will not display the message again until another new update is available.
About Divisions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
Divisions let you segment your organization's data into logical sections, making searches, reports, and list views more meaningful to users. For example, you can create a report to show the opportunities for just the North American division, allowing you to get accurate sales numbers for the North American sales team. Divisions are useful for organizations with extremely large amounts of data.
Note: Contact salesforce.com to enable divisions for your organization. Divisions do not restrict users’ access to data and are not meant for security purposes.
See Also:
Getting Started with Divisions
Creating and Editing Divisions
Administrator tip sheet: Getting Started with Divisions
Overview of Divisions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
There are three basic aspects to divisions:
• Division on individual records—Division is a field on individual records which marks the record as belonging to a particular division. A record can belong to a division that the administrator creates, or it can belong to the standard “global” division which is created automatically when your organization enables divisions.
85
Set Up Your Organization About Divisions
• Default division for a user—Users are assigned to a default division that applies to their newly created accounts, leads, and custom objects that are enabled for divisions.
• Working division—If you have the “Affected by Divisions” permission, you set the division in which you want to work using a drop-down list in the sidebar. Then, searches will show only the data for your working division. You can change your working division at any time. If you do not have the “Affected by Divisions” permission, you do not have a working division; you always see records in all divisions.
The following table shows how using divisions affects different areas:
Area
Search
List views
Reports
Description
If you have the “Affected by Divisions” permission:
• In sidebar search, you can select a working division to search, or you can search all divisions.
• In advanced search, you can perform an advanced search on a working division or all divisions.
• In global search, you can perform a global search on a working division or all divisions.
• For searches in lookup dialogs, the results include records in the division you select from the drop-down list in the lookup dialog window.
Note: All searches within a working division also include the global division. For example, if you search within a working division called Western Division, your results will include records found in both the
Western Division and the global division.
If you do not have the “Affected by Divisions” permission, your search results always include records in all divisions.
If you have the “Affected by Divisions” permission, list views include only the records in the division you specify when creating or editing the list view. List views that are not searching all records (such as My Open Cases) include records in all divisions.
If you do not have the “Affected by Divisions” permission, your list views always include records in all divisions.
If you have the “Affected by Divisions” permission, you can set your report options to include records in just one division or all divisions. Reports that are already scoped (such as My
Cases or My team’s accounts) include records in all divisions, and you cannot further limit them to a specific division.
If you do not have the “Affected by Divisions” permission, your reports always include records in all divisions.
86
Set Up Your Organization
Area
Viewing records and related lists
Creating new records
Editing records
Custom objects
Relationships
About Divisions
Description
When viewing the detail page of a record, the related lists show all associated records to which you have access, regardless of division.
When you create new accounts, leads, or custom objects that are enabled for divisions, the division is automatically set to your default division, unless you override this setting.
When you create new records related to an account or other record that already has a division, the new record is assigned to the existing record’s division. For example, if you create a custom object record that is on the detail side of a master-detail relationship with a custom object that has divisions enabled, it is assigned the master record's division.
When you create records that are not related to other records, such as private opportunities or contacts not related to an account, the division is automatically set to the global division.
When editing accounts, leads, or custom objects that are enabled for divisions, you can change the division. All records that are associated through a master-detail relationship are automatically transferred to the new division as well. For example, contacts and opportunities are transferred to the new division of their associated account, and detail custom objects are transferred to their master record's new division.
When editing other types of records, you cannot change the division setting.
When you enable divisions for a custom object, Salesforce initially assigns each record for that custom object to the global division.
When you create a custom object record:
• If the custom object is enabled for divisions, the record adopts your default division.
• If the custom object is on the detail side of a master-detail relationship with a divisions-enabled custom object, it adopts the division of the master record.
If you convert a lookup relationship to a master-detail relationship, detail records lose their current division and inherit the division of their master record.
If you convert a master-detail relationship to a lookup relationship, the division for any detail records is determined by the previous master record.
87
Set Up Your Organization
Area
About Divisions
Description
If you delete a master-detail relationship, the division for any detail records is determined by the previous master record.
See Also:
Getting Started with Divisions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
1. Contact salesforce.com to enable divisions for your organization.
When divisions are enabled, one global division is automatically created for your organization and all records are assigned to that division by default. The default name for this division is “Global,” which you may customize if you wish.
2. Create divisions for your organization's data. See
Creating and Editing Divisions
on page 89.
Before creating divisions, plan which divisions you need based on how you want to segment your data. For example, you may want one division for all of the records belonging to your North American sales team and one division for your
European sales team. You can create a maximum of 100 divisions, including any inactive ones.
3. For custom objects, select Enable Divisions on the custom object definition page to enable for divisions.
Transferring records includes associated records. For example, when you transfer divisions for accounts, all records related to a particular account, such as contacts and opportunities, inherit the division of that account.
5. Add division fields to page layouts, as appropriate.
6. Add divisions to field-level security, as appropriate.
7. Enable the “Affected by Divisions” permission for users who should be able to limit list views, searches, and reports by division. Users without this permission still have a default division, can view division fields, change the division for a record, and specify a division while creating records.
page 90 for information on changing divisions for one user at a time.
A user’s default division determines the division assigned to all new accounts and leads he or she creates, unless the user explicitly sets a different division. When users create records related to an account or other record that already has a division, the new record is assigned to the existing record’s division; the default division is not used.
Remember to set the default division for all users, even those without the “Affected by Divisions” permission. Records created by users without that permission are still assigned to a division.
88
Set Up Your Organization About Divisions
9. Users can set their default division.
See Also:
Creating and Editing Divisions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To create or edit divisions:
To limit list views, searches, and reports by division:
“Modify All Data”
“Affected by Divisions”
To create and edit divisions:
1. Click
Your Name
> Setup > Company Profile > Manage Divisions.
2. Click New to create a division, or Edit to change an existing one.
3. Enter the division name.
4. Select the checkbox to make the division active, meaning that records and users can be assigned to this division.
You cannot make a division inactive if users or lead queues are assigned to that division.
5. Click Save.
Note: You can create a maximum of 100 divisions, including any inactive ones.
To change the order in which divisions appear in the Division picklist field, click the Sort button and use the arrows to order the divisions.
See Also:
89
Set Up Your Organization About Divisions
Transferring Divisions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To mass transfer divisions:
User Permissions Needed
“Modify All Data”
To change the division for multiple records at one time:
1. Click Your Name > Setup > Data Management > Mass Division Transfer.
2. Select the type of record for which you want to reassign divisions, and click Next.
When you transfer divisions for accounts, all records related to a particular account, such as contacts and opportunities, inherit the division of that account. Likewise, transferring divisions for custom objects includes any custom objects on the detail side of a master-detail relationship with that custom object.
3. Set the search conditions that the records must match, and click Next.
4. Select the new division for the matching records.
5. When transferring users, select the Change the division...
checkbox to also change the division of the records owned by the users.
6. Click Transfer.
If you are transferring less than 5,000 records, they are transferred immediately. A confirmation message displays when the transfers are complete.
If you are transferring 5,000 or more records, the request is placed in a queue for processing. You will receive an email notification when the transfers are complete.
Changing Your Default Division
Available in: Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To change your default division: “Manage Users”
If your organization uses divisions to segment data, your user information contains a default division. This is the division that is applied, by default, to all new accounts, leads, and appropriate custom objects you create, unless you explicitly set a different division during record creation. For records you create that are related to an account or other record that already has a division, the new record is assigned to the existing record’s division; the default division is not used.
Your default division setting does not restrict you from viewing or creating records in other divisions.
90
Set Up Your Organization How do I discontinue my service?
To change your default division:
1. Click Your Name > Setup > My Personal Information > Personal Information.
To change the default division of another user, click
Your Name
> Setup > Manage User > Users, and select the name of the user.
2. Click Change next to the
Default Division
field.
3. Select a new default division.
4. Select an option to determine if the records you currently own should be transferred to the new division as well.
5. Click Save.
How do I discontinue my service?
If the service does not meet your needs, you can discontinue it. Users who are up-to-date with their payments may request a complete download of the data that exists in the system. Contact salesforce.com Support to submit your request directly.
M
ANAGE
U
SERS
User Management Overview
The available user management options vary according to which Salesforce Edition you have.
In Salesforce, every user is identified by a username, password, and a single profile. The profile determines what tasks users can perform, what data they see, and what they can do with the data.
Depending on your organization's Salesforce edition and the additional features your organization has purchased, you may have user licenses—such as Marketing, Connect Offline, and Sales Anywhere—which give users the ability to access other features that are only available with a specific user license. A user can be assigned to one or more of these licenses. You can also set up accounts for users outside your organization who need to access a limited set of fields and objects. These user licenses can grant access to Customer Portal, partner portal, or Self-Service. Finally, using Salesforce to Salesforce, you can create connections to share records with other Salesforce users outside of your organization.
Note: Starting with Spring ’12, the Self-Service portal isn’t available for new organizations. Existing organizations continue to have access to the Self-Service portal.
As an administrator, you can perform user management tasks such as creating and editing users, resetting passwords, and creating Google Apps accounts. You can also grant permissions, create and manage other types of users, create custom fields, set custom links, run reports on users, and delegate user administration tasks to other users.
See Also:
91
Manage Users Viewing and Managing Users
Viewing and Managing Users
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Customer Portal and partner portals are not available in Database.com
To view user lists :
User Permissions Needed
“View Setup and Configuration”
To view and manage the users in your organization, click Your Name > Setup > Manage Users > Users. The user list shows all the users in your organization, partner portal, and Salesforce Customer Portal. From the user list, you can:
•
.
•
.
•
Reset passwords for selected users .
•
• View a user's detail page by clicking the name, alias, or username.
• View or edit a profile by clicking the profile name.
• If Google Apps ™ is enabled in your organization, export users to Google and create Google Apps accounts by clicking
Export to Google Apps
Tips for Managing Users
• You can create custom fields for users and set custom links to display on the user detail page. To access these options, click
Your Name
> Setup > Customize > Users.
• You can use the sidebar search to search for any user in your organization, regardless of the user's status. However, when using a lookup dialog from fields within records, the search results return only active users. You can also run user reports in the Reports tab.
• To simplify user management in organizations with large numbers of users, delegate aspects of user administration to non-administrator users.
Note: You cannot delegate administrative duties related to your organization to partner portal or Customer Portal users. However, you can delegate some portal administrative duties to portal users.
See Also:
92
Manage Users Viewing and Managing Users
Adding a Single User
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To create new users:
User Permissions Needed
“Manage Users”
The maximum number of users you can create is determined by your Edition.
To create a new user for your organization:
1. Click
Your Name
> Setup > Manage Users > Users.
2. Click New User.
3. Enter the user’s first name, last name, and email address. The email address becomes the username.
Note: If the user’s name includes non-English characters, the user must add the specified language to the mail format settings within Outlook if viewing email in Outlook.
4. In Professional, Enterprise, Unlimited, and Developer Editions, select a
Role
. Depending on your organization’s sharing settings, roles can specify the level of visibility that users have into your organization’s data.
5. Select a User License . The profiles available to you depend on the user license you choose.
Note:
• Some options become unavailable depending on the license type you choose. For example, the
Marketing
User and Allow Forecasting options are not available for Force.com user licenses because the Forecasts and Campaigns tabs are not available to users with a Force.com license. Force.com user licenses are not available for Professional, Group, or Contact Manager Editions.
• You can change a Salesforce license to a Force.com license, but you can’t change a Force.com license to a
Salesforce license.
6. Select a profile, which specifies the user’s minimum permissions and access settings.
7. Select the other options and enter the remaining user information as needed.
8. If your organization has Approvals enabled, you can set the user’s approver settings, such as delegated approver, manager, and preference for receiving approval request emails.
9. In Unlimited, Enterprise and Developer Edition organizations, you can select Send Apex Warning Emails to send email to the user when an application that invokes Apex uses more than half of the resources specified by the governor limits. This feature can be used during Apex code development to test the amount of resources being used at runtime.
10. Check Generate new password and notify user immediately to have the user’s login name and a temporary password emailed to the new user. Temporary passwords for new users expire in six months, and users must change their
93
Manage Users Viewing and Managing Users password the first time they log in. The login link in the email can only be used once. A user who follows the link without setting a password must have an administrator reset their password before they can log in.
See Also:
Adding Multiple Users
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To create new users:
User Permissions Needed
“Manage Users”
The maximum number of users you can create is determined by your Edition.
The Add Multiple Users page provides a way to quickly add users to your organization. Depending on the number of available licenses, you can create up to 10 users. With this page, you specify the minimum information needed. Once you’ve created the users, edit individual users to specify more details for each one.
To add multiple users:
1. Click
Your Name
> Setup > Manage Users > Users.
2. Click Add Multiple Users.
3. If multiple user license types are available in your organization, select the user license you want to associate with the users you’ll create. The user license determines the available profiles. If only one type of license is available, it’s automatically selected.
4. Specify the information for each user.
Field
First Name
Last Name
Email (User Name)
Profile
Role
Description
The user’s first name.
The user’s last name.
The user’s email address. The email address entered here becomes the username.
Specifies the user's minimum permissions and access settings.
If roles are set up for your organization, specifies the level of visibility that the user has into your organization’s data.
5. Select
Generate passwords and notify user via email
to email a login name and temporary password to each new user.
94
Manage Users Viewing and Managing Users
Temporary passwords for new users expire in six months, and users must change their password the first time they log in.
The login link in the email can only be used once. A user who follows the link without setting a password must have an administrator reset their password before they can log in.
6. Click Save.
See Also:
Editing Users
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To edit users:
User Permissions Needed
“Manage Users”
To view or edit user information:
1. Click
Your Name
> Setup > Manage Users > Users.
You can also edit your organization's users from the Users in Role related list in the role detail page.
2. Click Edit next to a user’s name.
3. Change the settings as needed. Additionally, be aware of the following behaviors and options when editing a user.
• If you change a user’s email address and
Generate new password and notify user immediately
is deselected, a confirmation message will be sent to the new email address that you entered. The user must click the link provided in that message for the new email address to take effect. This process ensures system security. When generating a new password for a user, the new password is automatically sent to the user’s email address and email verification is not enforced.
• If you change a user's username, a confirmation email with a login link is sent to the email address associated with that user account. If the user has problems logging into future sessions, they can use the link in the email. Problems might occur because an organization could have multiple login servers. It may take up to 24 hours for the username change to replicate to all of them. The link in the email connects directly to the server where the actual username change was made. This ensures that users can always log in, even if server replication is slow.
• Click Unlock to unlock a user that is locked out of Salesforce. This button is only available when a user is locked out.
• If your organization has managed packages installed, click Assign Licenses to assign a package license to the user.
Click Remove to remove a license assigned to the user.
• Click Grant Checkout Access to grant the user access to Checkout.
4. Click Save.
95
Manage Users Viewing and Managing Users
Note:
• Users can change or add to their own personal information after they log in.
• Administrators can restrict the domain names of users’ email addresses to a list of explicitly allowed domains. Any attempts to set an email address with another domain will result in an error message. Contact salesforce.com to enable this functionality for your organization.
See Also:
Deactivating (Deleting) Users
You can't delete a user, but you can deactivate an account so a user can no longer log in to Salesforce.
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To deactivate users:
User Permissions Needed
“Manage Users”
Watch a Demo: Removing Users’ Access to Salesforce (3:45 minutes)
1. Click Your Name > Setup > Manage Users > Users.
2. Click Edit next to a user’s name.
3. Deselect the
Active
checkbox and click Save.
Tips on Deactivating Users
Consider the following when deactivating users:
• Deactivated users lose access to any records that were manually shared with them, or records that were shared with them as team members. However, you can still transfer their data to other users and view their names on the Users page.
• Deactivated users are removed from the default opportunity and account teams of other users. The deactivated users' default opportunity and account teams are not removed.
• If a user on an account team has Read/Write access (Account Access, Contact Access, Opportunity Access, and Case
Access) and is deactivated, the access will default to Read Only if the user is reactivated.
• Deactivated users continue to own opportunities and appear in forecasts and territories. When users are deactivated, their opportunity forecast overrides, adjusted total overrides, and manager's choice overrides on subordinates' forecasts are frozen.
However, the manager of a deactivated user can apply manager's choice overrides to that user's forecasts. Rollup amounts are kept current. If a deactivated user is later reactivated, the user can resume normal work as before. If “Allow Forecasting” is disabled for a user who is deactivated, the user is removed from any territories her or she is assigned to.
• A deactivated user doesn't count against your organization’s available user licenses. However, deactivating a user doesn't reduce the number of licenses for which your organization is billed; you must change your organization’s license count to change your billing.
96
Manage Users Viewing and Managing Users
• You can't deactivate a user selected as a Customer Portal
Administrator
.
• You can't deactivate a user selected in a custom hierarchy field even if you delete the field. You must delete and permanently erase the field first.
• When a delegated portal user administrator deactivates a portal user, the administrator doesn't have the option to remove the portal user from any teams that user is a member of.
• If opportunity splitting is enabled and a user is deactivated, the user is not removed from any opportunity teams on which the user is assigned a split percentage. To remove the user from the opportunity team, you must first reassign the split percentage.
• If Chatter is enabled and you deactivate a user, the user is removed from Following and Followers lists. If you reactivate the user, the subscription information in the Following and Followers lists is restored.
Subscription information can’t be restored if you deactivate multiple users that are following each other. For example, user
A follows user B and user B follows user A. If you deactivate user A and user B, their subscription information to each other is deleted from Following and Followers lists and can’t be restored if you reactivate the users.
• It's possible for inactive users to be listed as “Created By” users even though they are no longer active in an organization.
This can happen because some system operations create records and toggle preferences, acting as an arbitrary administrator user in your organization to complete the task. This user may be active or inactive.
• You can’t deactivate a user if they’re assigned as the sole recipient of a workflow email alert.
See Also:
User Fields
The available fields vary according to which Salesforce Edition you have.
A user's personal information—or user detail—page has the following fields, listed in alphabetical order. Some of these fields may not be visible or editable depending on your permissions or edition.
Field
Accessibility Mode
Active
Address
Admin newsletter
Description
When selected, enables a user interface mode designed for visually-impaired users.
Administrative checkbox that enables or disables user login to the service.
Street address for user. Up to 255 characters are allowed in this field.
Opt in to receive administrator-targeted promotional emails from salesforce.com. This field is not available if your organization has disabled your choice to receive emails from salesforce.com.
97
Manage Users
Field
Alias
Allow Forecasting
Api Token
Call Center
Checkout Enabled
City
Color-Blind Palette on Charts
Community Nickname
Company
Contact
Country
Country
(beta)
Created By
Currency
Custom Links
Data.com User Type
Viewing and Managing Users
Description
Short name to identify user on list pages, reports, and other pages where the entire name does not fit. Up to eight characters are allowed in this field.
Indicates whether the user can use customizable forecasting.
Indicates whether an API token has ever been reset.
Salesforce.com uses this field to help you troubleshoot issues related to API tokens if issues should occur.
The name of the call center to which this user is assigned.
Indicates whether the user is notified by email when his or her Checkout account is activated and available for login.
You must have “Manage Billing” permission to enable.
City portion of user’s address. Up to 40 characters are allowed in this field.
Indicates whether the option to set an alternate color palette for charts has been enabled. The alternate palette has been optimized for use by color-blind users. For dashboard emails, the alternate palette is not used.
A community nickname is the name used to identify this user in a community. Up to 40 alphanumeric characters are allowed.
Standard users can edit this field.
Company name where user works. Up to 40 characters are allowed in this field.
Name of the associated contact if the user is a partner user.
Country portion of user’s address. Up to 80 characters are allowed in this field.
The country for the address. Entry is selected from a picklist of standard values.
User who created the user including creation date and time.
(Read only)
User’s default currency for quotas, forecasts, and reports.
Shown only in organizations using multiple currencies. This must be one of the active currencies for the organization.
Listing of custom links for users as set up by your administrator.
Enables a user to find contact and lead records from Data.com
and add them to Salesforce. Also indicates the type of
Data.com user. Data.com Users get a limited number of records to add or export per month, and their unused additions expire at the end of each month. For each Data.com User,
98
Manage Users
Field
Default Currency ISO Code
Default Division
Delegated Approver
Department
Development Mode
Disable Auto Subscription For Feeds
Division
Email Encoding
Viewing and Managing Users
Description you can see the monthly limit and number of records added to Salesforce or exported during the month. Data.com List users share account, contact, and lead record additions from a pool. You can see the organization’s limit, and the number of records each Data.com List User has added to Salesforce or exported.
User's default currency setting for new records. Available only for organizations that use multiple currencies.
Division that is applied, by default, to all new accounts and leads created by the user, unless he or she explicitly sets a different division. When users create records related to an account or other record that already has a division, the new record is assigned to the existing record’s division; the default division is not used.
This setting does not restrict the user from viewing or creating records in other divisions. Users can change their division at any time.
Available only in organizations that use divisions to segment their data.
User lookup field used to select a delegate approver for approval requests. Depending on the approval process settings, this user can also approve approval requests for the user.
Group that user works for, for example, Customer Support.
Up to 80 characters are allowed in this field.
Enables development mode for creating and editing
Visualforce pages.
This field is only visible to organizations that have Visualforce enabled..
Disables automatic feed subscriptions to records owned by a user. Only available in organizations with Chatter enabled.
Company division to which user belongs for example, PC
Sales Group. Up to 40 characters are allowed in this field.
Email address of user. Must be a valid email address in the form: [email protected]. Up to 80 characters are allowed in this field.
Character set and encoding for outbound email sent by user from within Salesforce.
ISO-8859-1
represents all Latin characters and should be used by English-speaking users.
UTF-8
(Unicode) represents all characters for all of the world’s languages, but is not supported by some older email software.
99
Manage Users
Field
Employee Number
End of day
Fax
Federation ID
First Name
Force.com Flow User
Force.com Quick Access Menu
Information Currency
Knowledge User
Language
Last Login
Last Name
Viewing and Managing Users
Description
Shift_JIS
,
EUC-JP
and
ISO-2022-JP
are useful for
Japanese users.
Identifying number for a user.
Time of day that user generally stops working. Used to define the times that display in the user’s calendar.
Fax number for user.
The value used to identify a user for federated authentication single sign-on.
First name of user, as displayed on the user edit page. Up to
40 characters are allowed in this field.
Grants the ability to run flows. Available in Developer (with limitations), Enterprise, and Unlimited Editions.
You must have the “Manage Force.com Flow” permission to enable.
If the user has the “Run Flows” permission, you don’t need to enable this field.
Enables the Force.com quick access menu, which appears in object list view pages and record detail pages, and provides shortcuts to customization features for apps and objects.
The default currency for all currency amount fields in the user record. Available only for organizations that use multiple currencies.
Grants access to Salesforce Knowledge. The user's profile determines whether he or she has access to the Article
Management tab or Articles tab. Available in Professional,
Enterprise, and Unlimited Editions.
The primary language for the user. All text and online help is displayed in this language. In Professional, Enterprise, and
Unlimited Edition organizations, a user’s individual
Language setting overrides the organization’s Default Language .
Not available in Personal Edition, Contact Manager, or Group
Edition ™ . The organization’s Display Language applies to all users.
Date of last login. (Read only)
Last name of user, as displayed on the user edit page. Up to
80 characters are allowed inthis field.
100
Manage Users
Field
Locale
Make Setup My Default Landing Page
Manager
Marketing User
Viewing and Managing Users
Description
Country or geographic region in which user is located.
The Locale setting affects the format of date, date/time, and number fields, and the calendar. For example, dates in the
English (United States) locale display as 06/30/2000 and as
30/06/2000 in the English (United Kingdom) locale. Times in the English (United States) locale display using a twelve-hour clock with AM and PM (for example, 2:00 PM), whereas in the English (United Kingdom) locale, they display using a twenty-four-hour clock (for example, 14:00).
The Locale setting also affects the first and last name order on
Name
fields for users, leads, and contacts. For example,
Bob Johnson in the English (United States) locale displays as
Bob Johnson, whereas the Chinese (China) locale displays the name as Johnson Bob.
For Personal Edition users, the locale is set at the organization level via Your Name > Setup > Company Profile > Company
Information. For all other users, their personal locale, available at Your Name > Setup > My Personal Information >
Personal Information, overrides the organization setting.
When this option is enabled, users land in the Setup page when they log in.
Lookup field used to select the user's manager. This field:
• Establishes a hierarchical relationship, preventing you from selecting a user that directly or indirectly reports to itself.
• Allows Chatter to recommend people and records to follow based on your organization's reporting structure.
This field is especially useful for creating hierarchical workflow rules and approval processes without having to create additional hierarchy fields.
Note: Unlike other hierarchy fields, Salesforce allows you to inactivate users who are referenced in the
Manager
field.
When enabled, the user can create, edit, and delete campaigns, configure advanced campaign setup, import leads, and update campaign history via the member import wizards. Available in Professional, Enterprise, and Unlimited Editions.
To use the campaign import wizards, Marketing Users must also have the Marketing User profile (or the “Import Leads” permission and the “Edit” permission on campaigns in
Enterprise and Unlimited Edition organizations).
101
Manage Users
Field
Mobile
Mobile User
Viewing and Managing Users
Description
If this option isn’t selected, the user can only view campaigns and advanced campaign setup, edit the Campaign History for a single lead or contact, and run campaign reports.
Cellular or mobile phone number. Up to 40 characters are allowed in this field. This number is used for SMS-based identity confirmation.
Administrators enable this feature by checking
Enable
SMS-based identity confirmation
at Your Name >
Setup > Security Controls > Session Settings.
Once enabled, every user sees a screen after logging in that asks them to register for mobile verification. The user can take one of the following actions:
• Enter a mobile phone number and then have it verified with a text message.
• Skip entering a mobile number now, but get asked again at their next login.
• Completely opt out of mobile verification.
Once a user’s mobile phone number is verified, Salesforce will use it to verify the user when necessary, such as when a user tries to log in from an unknown IP address.
Administrators can also enter users’ mobile numbers and pre-verify them. If Enable SMS-based identity confirmation
is set when an Administrator enters a mobile number for a user, or when a mobile number is set from an
API using the
User
object, the mobile number is automatically considered verified. If Enable SMS-based identity confirmation
is not set, the new mobile phone number is not considered verified. “Verified” means that Salesforce will not ask the user to verify a mobile phone number at login, and that Salesforce will use the number to send the user a verification code when necessary for SMS-based identity confirmation.
Allocates one Salesforce Mobile license to the user, granting the user access to Salesforce Mobile app. The number of user records enabled by this checkbox can’t exceed the total number of mobile licenses your organization has. Available in
Professional, Enterprise, and Unlimited Editions.
The Mobile User checkbox is enabled by default for Unlimited and Developer Edition users. To prevent users from activating the Salesforce Mobile app on their mobile devices before you’re ready to deploy it in your organization, disable the checkbox for all your users.
102
Manage Users
Field
Mobile Configuration
Modified By
Monthly Contact and Lead Limit
Name
Newsletter
Offline User
Partner Super User
Phone
Profile
Receive Approval Request Emails
Viewing and Managing Users
Description
If the user has already activated his or her Salesforce Mobile account, deselecting the Mobile User checkbox revokes the user's mobile license. The next time the user's device synchronizes with Salesforce, all the Salesforce data is deleted from the device, and the device is no longer associated with the user.
Note: The Mobile User checkbox doesn't apply to the free version of Salesforce Mobile because users of the free app can access Salesforce from their device without a mobile license.
The mobile configuration assigned to the user. If no mobile configuration is specified, this field defaults to the mobile configuration assigned to the user's profile.
This field is only visible to organizations that use Salesforce to manage mobile configurations.
User who last changed the user fields, including modification date and time. (Read only)
If the user's
Data.com User Type
is Data.com User, the number of Data.com contact and lead records the user can add each month.
The default number of records per license is 300, but you can assign more than that or fewer, up to the organization limit.
Combined first and last name of user, as displayed on the user detail page.
Opt in to receive user-targeted promotional emails from salesforce.com. This field is not available if your organization has disabled your choice to receive emails from salesforce.com.
Administrative checkbox that grants the user access to Connect
Offline. Available in Professional, Enterprise, and Unlimited
Editions.
Denotes whether a partner portal user is a super user.
Phone number of user. Up to 40 characters are allowed in this field.
Administrative field that specifies the user’s base-level permissions to perform different functions within the application. Additional permissions may be granted to the user through permission sets.
Set preferences for receiving approval request emails.
103
Manage Users Viewing and Managing Users
Field
Receive Salesforce CRM Content Daily Digest
Receive Salesforce CRM Content Email Alerts
Role
Description
If selected, specifies that a non-portal user with a
Salesforce
CRM Content User license and Salesforce CRM Content subscriptions will receive a once-daily email summary if activity occurs on his or her subscribed content, libraries, tags, or authors. To receive email, the
Receive Salesforce CRM
Content Email Alerts checkbox must also be selected.
Portal users do not need the
Salesforce CRM Content
User license; they only need the View Content in
Portals
user permission.
If selected, specifies that a non-portal user with a
Salesforce
CRM Content User
license and Salesforce CRM Content subscriptions will receive email notifications if activity occurs on his or her subscribed content, libraries, tags, or authors.
To receive real-time email alerts, select this checkbox and do not select the
Receive Salesforce CRM Content
Daily Digest
checkbox. Portal users do not need the
Salesforce CRM Content User
license; they only need the
View Content in Portals
user permission.
Administrative field that specifies position of user within an organization, for example, Western Region Support Manager.
Roles are selected from a picklist of available roles, which can be changed by an administrator.
Not available in Personal Edition, Contact Manager, or Group
Edition.
Salesforce CRM Content User
Self-Registered via Customer Portal
Send Apex Warning Emails
Show View State in Development Mode
Administrative checkbox that indicates whether a user has access to use Salesforce CRM Content. Available in
Professional, Enterprise, and Unlimited Editions.
When enabled, specifies that the user was created via self-registration to a Customer Portal. Available in Enterprise and Unlimited Editions.
If selected, specifies that the user will receive email notification whenever he or she executes Apex that surpasses more than
50% of allocated governor limits.
Available in Developer, Enterprise, and Unlimited Editions only.
Enables the View State tab in the development mode footer forVisualforce pages.
This field is only visible to organizations that have Visualforce enabled, and Development Mode selected.
104
Manage Users
Field
Site.com Contributor User
Site.com Publisher User
Start of day
State/Province
State/Province (beta)
Time Zone
Title
Used Space
User License
Username
Viewing and Managing Users
Description
Allocates one Site.com Contributor license to the user, granting the user limited access to Site.com Studio.
Contributors can use Site.com Studio to edit site content only.
The number of user records with this checkbox enabled can't exceed the total number of Site.com Contributor licenses your organization has.
Available in Developer, Enterprise, and Unlimited Editions, only if Site.com is enabled for your organization.
Allocates one Site.com Publisher license to the user, granting the user full access to Site.com Studio. Publishers can build and style websites, control the layout and functionality of pages and page elements, and add and edit content.
The number of user records with this checkbox enabled can't exceed the total number of Site.com Publisher licenses your organization has.
Available in Developer, Enterprise, and Unlimited Editions, only if Site.com is enabled for your organization.
Time of day that user generally starts working. Used to define the times that display in the user’s calendar.
State or province portion of user’s address. Up to 80 characters are allowed in this field.
The state or province for the address. Entry is selected from a picklist of standard values.
Primary time zone in which user works.
Users in Arizona should select the setting with
“America/Phoenix,” and users in parts of Indiana that do not follow Daylight Savings Time should select the setting with
“America/Indianapolis.”
Job title of user. Up to 80 characters are allowed in this field.
Amount of disk storage space the user is using.
Indicates the type of user license.
Administrative field that defines the user’s login. Up to 80 characters are allowed in this field.
105
Manage Users
Field
Zip/Postal Code
User License Types
Description
Zip code or postal code portion of user’s address. Up to 20 characters are allowed in this field.
See Also:
User License Types
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To view user license types: “View Setup and Configuration”
You may have more than one type of user license in your organization. A user license entitles a user to different functionality within Salesforce and determines which profiles and permission sets are available to the user.
To view a list of the active user licenses in your company, click
Your Name
> Setup > Company Profile > Company
Information. This page lists the following for each type of user license:
• Status indicates the status of the license.
• Total Licenses indicates the number of licenses for which your company is billed and that are available to you.
•
Used Licenses
is the number of licenses that you have assigned to users.
•
Remaining Licenses
is the number of unused licenses.
If Checkout is enabled for your organization, you can click Buy More Licenses to go to Checkout to buy additional user licenses.
In addition to license types, the following portal login information is listed for organizations that have Customer Portals or partner portals enabled:
•
Monthly Logins Allotted
shows the maximum number of customer or partner portal logins allowed per month.
• Monthly Logins Used
indicates the number of successful logins for all users associated with a customer or partner portal user license for the month.
Note: You may see other types of licenses listed on this page if your organization has purchased custom user licenses for different types of functionality. Your organization may also have other licenses that are still supported, but are no longer available. Contact salesforce.com for more information.
These lists describe the functionality a user is entitled to for each type of standard user license.
106
Manage Users User License Types
Salesforce License Types
Salesforce
Designed for users who require full access to standard CRM and Force.com AppExchange apps. Users with this user license are entitled to access any standard or custom app.
Each license provides additional storage for Enterprise and Unlimited Edition users.
Salesforce
Platform
Note: This license is not available for new customers.
Designed for users who need access to custom apps but not to standard CRM functionality. Users with this user license are entitled to use custom apps developed in your organization or installed from Force.com
AppExchange. In addition, they are entitled to use core platform functionality such as accounts, contacts, reports, dashboards, documents, and custom tabs. However, these users are not entitled to some user permissions and standard apps, including standard tabs and objects such as forecasts and opportunities.
Users with this license can also use Connect Offline.
Note: Users with this license can only view dashboards if the running user also has the same license.
Force.com -
One App
Users with a Salesforce Platform user license can access all the custom apps in your organization.
Each license provides additional storage for Enterprise and Unlimited Edition users.
Note: This license is not available for new customers.
Designed for users who need access to one custom app but not to standard CRM functionality. Force.com
- One App users are entitled to the same rights as Salesforce Platform users, plus they have access to an unlimited number of custom tabs. However, they are limited to the use of one custom app, which is defined as up to 10 custom objects, and they are limited to read-only access to the Accounts and Contacts objects.
Note: Users with this license can only view dashboards if the running user also has the same license.
Each license provides an additional 1 MB of data storage and 1 MB of file storage, regardless of the
Salesforce Edition.
Force.com
App
Subscription
Grants users access to a Force.com Light App or Force.com Enterprise App, neither of which include
CRM functionality.
A Force.com Light App has up to 10 custom objects and 10 custom tabs, has read-only access to accounts and contacts, and supports object-level and field-level security. A Force.com Light App can’t use the Bulk
API or Streaming API.
A Force.com Enterprise App has up to 10 custom objects and 10 custom tabs. In addition to the permissions of a Force.com Light App, a Force.com Enterprise App supports record-level sharing, can use the Bulk
API and Streaming API, and has read/write access to accounts and contacts.
Note: Users with this license can only view dashboards if the running user also has the same license.
107
Manage Users User License Types
Each Force.com App Subscription license provides an additional 20 MB of data storage and 612 MB of file storage, regardless of the Salesforce edition.
Knowledge
Only User
Designed for users who only need access to the Salesforce Knowledge app. This license provides access to the following tabs: Articles, Article Management, Chatter, Chatter Files, Home, Profiles, Reports, custom objects, and custom tabs. The Knowledge Only User license includes a Knowledge Only profile that grants access to the Articles tab. To view and use the Article Management tab, a user must have the “Manage
Articles” permission.
Chatter Free
Designed for Unlimited, Enterprise, and Professional Edition users that don't have Salesforce licenses but need access to Chatter. These users can access standard Chatter people, profiles, groups, and files. They can't access any Salesforce objects or data.
Note: You can upgrade a Chatter Free license to a standard Salesforce license at any time, however, you can't convert a standard Salesforce or Chatter Only license to a Chatter Free license.
Chatter
External
Designed to allow customers in Chatter groups. Customers are users outside of a company’s email domain.
Chatter Only Also known as Chatter Plus. Designed for Unlimited, Enterprise, and Professional Edition users that don’t have Salesforce licenses but need access to some Salesforce objects in addition to Chatter. These users can access standard Chatter people, profiles, groups, and files, plus they can:
• View Salesforce accounts and contacts
• Use Salesforce CRM Content, Ideas, and Answers
• Modify up to ten custom objects
Note: You must expose the tabs for the standard Salesforce objects that the Chatter Only user profile can access, as they are hidden by default for these users.
Professional Edition organizations must have Profiles enabled to perform these tasks. Contact your sales representative for more information.
For more information on Chatter Plus users, see Chatter Plus Frequently Asked Questions .
Sites and Site.com License Types
Guest User Designed for public users who access your Site.com or Force.com sites. Site visitors have access to any information made available in an active public site. For each Guest User license, you can develop one site for your organization.
For Site.com, Developer, Enterprise, and Unlimited Editions each come with unlimited Guest User licenses.
For Force.com sites, Enterprise and Unlimited Editions each come with 25 Guest User licenses. Developer
Edition comes with one Guest User license.
Note:
• You can't purchase additional Guest User licenses for Force.com sites.
• The Authenticated Website high-volume portal user license is specifically designed to be used with Force.com sites. Because it's designed for high volumes, it should be a cost-effective option to use with Force.com sites.
108
Manage Users User License Types
Site.com
Only
Designed for Unlimited and Enterprise Edition users who need access to Site.com but not to standard
CRM functionality. Site.com Only users are entitled to the same rights as Force.com - One App users, plus they have access to the Content app. However, they don't have access to the Accounts and Contacts objects. Users have access to an unlimited number of custom tabs, but are limited to the use of one custom app, which is defined as up to 20 custom objects.
Each Site.com Only user also needs either a Site.com Contributor or Site.com Publisher feature license to access Site.com.
Service Cloud Portal User Licenses
Service Cloud Portal users have the High Volume Customer Portal license. This license gives contacts unlimited logins to your Service Cloud Portal to access customer support information. Users with this license can access accounts, assets, cases, contacts, custom objects, documents, ideas, and questions, depending on their permission settings.
The Overage High Volume Customer Portal license is the same as the High Volume Customer Portal license, except that users do not have unlimited logins. Contact salesforce.com for information about the number of Customer Portal licenses you can activate.
This table lists the permissions that can be assigned to Service Cloud portal users.
Create Read Update Delete
Accounts
Assets
Cases
Contacts
Custom Objects
Documents
Ideas
Knowledge
Price Books
Products
Questions and Answers
Solutions
Customer Portal User Licenses
Users of a Customer Portal site have the Customer Portal Manager Standard license. It allows contacts to log into your
Customer Portal to manage customer support. You can associate users who have a Customer Portal Manager Standard license with the Customer Portal User profile or a profile cloned and customized from the Customer Portal User profile. This lets them view and edit data they directly own or data owned by or shared with users below them in the Customer Portal role hierarchy. These users can also view and edit cases where they are listed in the
Contact Name
field.
Users with the Customer Portal Manager Standard license can:
109
Manage Users User License Types
• View contacts, price books and products.
• View and edit accounts and cases.
• Create and edit assets.
• Create, view, edit and delete custom objects.
• Access custom objects depending on their permissions.
• Receive the “Portal Super User” permission.
• Access Salesforce CRM Content if they have a Salesforce CRM Content feature license or the appropriate permissions.
The Overage Customer Portal Manager Standard license is the same as the Customer Portal Manager Standard license, except that users are limited to one login per month.
Note: This license is not available for new customers.
This table lists the permissions that can be given to Customer Portal users.
Create Read
Accounts
Assets
Cases
Contacts
Custom Objects
Documents
Ideas
Knowledge
Price Books
Products
Solutions
Questions and Answers
Update Delete
Customer Portal — Enterprise Administration User Licenses
Customer Portal — Enterprise Administration users have the Customer Portal Manager Custom license. This license gives contacts unlimited logins to your Salesforce Customer Portal to manage customer support. You can associate users who have a Customer Portal Manager Custom license with the Customer Portal User profile or a profile cloned and customized from the Customer Portal User profile, which lets them view and edit data they directly own and view, create, and edit cases where they're listed in the
Contact Name
field.
Users with this license can:
• Create, read or update accounts, assets and cases.
• View contacts.
• View custom objects and run reports depending on their permissions.
110
Manage Users User License Types
• Receive the “Portal Super User” and “Delegated Portal User Administrator” permissions.
• Access Salesforce CRM Content if they have a Salesforce CRM Content feature license or the appropriate permissions.
The Overage Customer Portal Manager Custom license is the same as the Customer Portal Manager Custom license, except that users do not have unlimited logins. Contact salesforce.com for information about the number of Customer Portal licenses you can activate.
This table lists the permissions that can be given to Customer Portal — Enterprise Administration users.
Create Read Update Delete
Accounts
Assets
Cases
Contacts
Custom Objects
Documents
Ideas
Knowledge
Price Books
Products
Solutions
Questions and Answers
Platform Portal User Licenses
Platform portal users have the Authenticated Website license, which is designed to be used with Force.com Sites. It gives named sites users unlimited logins to your Platform Portal to access customer support information.
Users with this license have read and create access on ideas and questions and answers, and read-only access to documents, knowledge, price books, and products.
The Overage Authenticated Website license is the same as the Authenticated Website license, except that users do not have unlimited logins.
This table lists the permissions that can be given to Platform portal users.
Create Read Update Delete
Documents
Ideas
Knowledge
Price Books
Products
111
Manage Users User License Types
Create Read Update Delete
Questions and Answers
Partner Portal User Licenses
Partner Portal users have the Gold Partner user license. They can only access Salesforce using the partner portal.
This table lists the permissions that can be given to Partner Portal users.
Create Read Update Delete
Accounts
Approvals
Assets
Campaigns
Cases
Contacts
Custom Objects
Documents
Ideas
Knowledge
Leads
Opportunities
Price Books
Products
Solutions
Questions and Answers
Database.com User Licenses
User License
Database.com Admin
Description Default Number of
Available Licenses
Designed for users who need to administer Database.com, or make changes to Database.com schemas or other metadata using the point-and-click tools in the Database.com Console.
Database.com
Edition: 3
112
Manage Users
User License
Database.com User
Database.com Light User
Data.com User Licenses
Data.com User
Data.com List User
User License Types
Description
Designed for users who need API access to data stored in
Database.com.
Default Number of
Available Licenses
Database.com
Edition: 3
Enterprise Edition and Unlimited
Edition: 0
Contact salesforce.com to obtain
Database.com User
Licenses
Designed for users who need only API access to data, need to belong to Chatter groups (but no other groups), and don't need to belong to roles or queues. Access to data is determined by organization-wide sharing defaults.
Database.com
Edition: 0
Enterprise Edition and Unlimited
Edition: 0
Contact salesforce.com to obtain
Database.com Light
User Licenses
Designed to allow users to add or export a limited number of
Data.com records per month. The default number of records per license is 300, but it can be adjusted based on your agreement. Additions expire at the end of each month, as determined by your organization's default time zone.
Designed to allow users to share record additions from a pool.
All Data.com List users work from the organization’s Pool
Record Limit, so if one Data.com List user reaches the limit, other users of that type will not be able to add records.
See Also:
113
Manage Users Viewing Feature Licenses
Viewing Feature Licenses
Available in: Enterprise, Unlimited, and Developer Editions
To view feature licenses:
User Permissions Needed
“View Setup and Configuration”
You may have more than one type of feature license available to assign to the users in your organization. A feature license entitles a user to an additional Salesforce feature, such as Marketing or Connect Offline.
To view a list of the feature licenses your organization has purchased, click Your Name > Setup > Company Profile > Company
Information. This page lists the following for each type of feature license:
• Status
indicates the status of the license.
• Total Licenses indicates the number of licenses for which your company is billed and that are available to you.
• Used Licenses is the number of licenses that you have assigned to users.
•
Remaining Licenses
is the number of unused licenses.
Additionally, if Checkout is enabled for your organization, you can click Buy More Licenses to go to Checkout to buy additional feature licenses; see Checkout User Guide for instructions.
The following feature licenses are available:
• Marketing User
• Offline User
• Apex Mobile User
• Salesforce CRM Content User
• Knowledge User
• Service Cloud User
• Chatter Answers User
• Live Agent User
• Force.com Flow User
• Site.com Contributor User
• Site.com Publisher User
editing a user's personal information
. For information on purchasing feature licenses, contact salesforce.com.
See Also:
114
Manage Users About Passwords
About Passwords
Password policies available in: All Editions
To set password policies:
To reset user passwords and unlock users:
User Permissions Needed
“Manage Users”
“Reset User Passwords and Unlock Users”
There are several settings you can configure to ensure that your users’ passwords are strong and secure:
• Password policies—set various password and login policies, such as specifying an amount of time before all users’ passwords
expire, the level of complexity required for passwords, and so on. See Setting Password Policies
on page 115.
• User password expiration—expire the passwords for all the users in your organization, except for users with “Password
Never Expires” permission. See
Expiring Passwords on page 119.
•
User password resets—reset the password for specified users. See Resetting Passwords on page 118.
• Login attempts and lockout periods—if a user is locked out of Salesforce due to too many failed login attempts, you can
unlock them. See Editing Users on page 95.
Password Requirements
A password cannot contain your User Name and cannot match your first or last name.
For all editions, a new organization has the following default password requirements:
• A password must contain at least eight characters.
• A password must contain at least one alphabetic character and one number.
• The answer to the question posed if you forget your password cannot contain your password.
• The last three passwords are remembered and cannot be reused when you are changing your password.
The password policies, including these defaults, can be updated for all editions except for Personal Edition.
Setting Password Policies
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To set password policies:
User Permissions Needed
“Manage Users”
For your organization’s security, you can set various password and login policies.
115
Manage Users About Passwords
Note:
User passwords cannot exceed 16,000 bytes.
Logins are limited to 3,600 per hour per user. This limit applies to organizations created after Summer ’08.
1. Click
Your Name
> Setup > Security Controls > Password Policies.
2. Customize the password settings.
Field
User passwords expire in
Enforce password history
Minimum password length
Password complexity requirement
Password question requirement
Description
The length of time until all user passwords expire and must be changed. Users with the “Password Never Expires” permission are not affected by this setting. The default is
90 days
. This setting is not available for Self-Service portals.
Save users’ previous passwords so that they must always reset their password to a new, unique password. Password history is not saved until you set this value. The default is 3 passwords remembered
. You cannot select
No passwords remembered unless you select Never expires
for the
User passwords expire in
field.
This setting is not available for Self-Service portals.
The minimum number of characters required for a password.
When you set this value, existing users aren’t affected until the next time they change their passwords. The default is
8 characters
.
The requirement for which types of characters must be used in a user’s password.
Complexity levels:
•
No restriction
—allows any password value and is the least secure option.
• Must mix alpha and numeric —requires at least one alphabetic character and one number. This is the default.
•
Must mix alpha, numeric, and special characters —requires at least one alphabetic character, one number, and one of the following characters: ! #
$ % - _ = + < > .
The values are
Cannot contain password
, meaning that the answer to the password hint question cannot contain the password itself; or
None
, the default, for no restrictions on the answer. The user’s answer to the password hint question is required. This setting is not available for
Self-Service portals, Customer Portals, or partner portals.
116
Manage Users About Passwords
Field
Maximum invalid login attempts
Lockout effective period
Description
The number of login failures allowed for a user before they become locked out. This setting is not available for
Self-Service portals.
The duration of the login lockout. The default is 15 minutes.
This setting is not available for Self-Service portals.
Note: If users are locked out, they must wait until the lockout period expires. Alternatively, a user with the “Reset Passwords and Unlock Users” permission can unlock them by clicking
Your Name
> Setup
> Manage Users > Users, selecting the user, then clicking Unlock. This button is only available when a user is locked out.
3. Customize the forgotten password and locked account assistance information.
Note: This setting is not available for Self-Service portals, Customer Portals, or partner portals.
Field
Message
Help link
Description
When set, this custom message appears in the Account
Lockout email and at the bottom of the Confirm Identity screen for users resetting their passwords. You can customize it with the name of your internal help desk or a system administrator. For the lockout email, the message only appears for accounts that need an administrator to reset them. Lockouts due to time restrictions get a different system email message.
If set, this link displays with the text defined in the Message field. In the Account Lockout email, the URL displays just as it is typed into the Help link field, so the user can see where the link takes them. This is a security feature because the user is not within a Salesforce organization.
On the Confirm Identity password screen, the
Help link
URL combines with the text in the Message field to make a clickable link. Security isn’t an issue since the user is in a
Salesforce organization when changing passwords.
Valid protocols:
• http
• https
• mailto:
117
Manage Users About Passwords
4. Specify an alternative home page for users with the “API Only User” permission. After completing user management tasks such as resetting a password, API-only users are redirected to the URL specified here, rather than to the login page.
5. Click Save.
See Also:
Resetting Passwords
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To reset passwords:
User Permissions Needed
“Reset Passwords and Unlock Users”
To reset a user’s password:
1. Click
Your Name
> Setup > Manage Users > Users.
2. Select the checkbox next to the user’s name. Optionally, to change the passwords for all currently displayed users, check the box in the column header to select all rows.
3. Click Reset Password to have a new password emailed to the user.
A password created this way doesn’t expire, but users must change the password the first time they log in.
Tips on Resetting Passwords
Consider the following when resetting passwords:
• Only an administrator can reset Single Sign-On user passwords; Single Sign-On users cannot reset their own passwords.
• Resetting users' passwords might cause them to activate their computers to successfully log in to Salesforce.
• Resetting locked-out users' passwords automatically unlocks their accounts as well.
• When users lose their passwords, they can click the Forgot your password? link on a failed login page to receive a new password via email. They must correctly answer a previously defined security question before they can reset their password and log in. You can customize part of the page where the user answers the security question with additional information about where to go to for help.
Note: If the user has not defined a security question, or fails to answer correctly when trying to login, the password is not reset.
See Also:
118
Manage Users Controlling Login Access
Expiring Passwords
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To expire all passwords:
User Permissions Needed
“Manage Users”
To expire passwords for all users, except those with the “Password Never Expires” permission:
1. Click Your Name > Setup > Security Controls > Expire All Passwords.
2. Select the
Expire all user passwords
checkbox.
3. Click Save.
The next time each user logs in, he or she will be prompted to reset his or her password.
Tips on Expiring Passwords
Consider the following when expiring passwords:
• After you expire passwords, users might need to activate their computers to successfully log in to Salesforce..
• You can expire passwords for all users any time you want to enforce extra security for your organization..
See Also:
Controlling Login Access
Available in: All Editions
Granting administrator access available in: Enterprise, Unlimited, Developer, and Database.com Editions
To control login access policies:
User Permissions Needed
“Manage Users”
1. Choose Your Name > Setup > Security Controls > Login Access Policies.
2. To allow administrators to log in as any user in the organization without first asking end-users to grant login access to them, enable Administrators Can Log in as Any User. This option is only available if salesforce.com has enabled it for your organization. To request this feature, contact salesforce.com.
3. To prevent users from granting access to a publisher (to comply with regulatory or privacy concerns, for example), click
Available to Administrators Only for that publisher.
119
Manage Users Controlling Login Access
4. Click Save.
Consider these implementation restrictions.
• Users cannot grant login access to managed packages that are licensed to your entire organization. Only administrators with the “Manage Users” permission enabled on their profile can grant access to these publishers.
• Login access is only available for certain managed packages. If the package is not listed, it is not available for granting login access.
See Also:
Logging In as Another User
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To log in as another user who has granted you access: “Modify All Data”
To assist other users, administrators can log in to Salesforce as another user. Depending on your organization settings, individual users may need to first grant login access to administrators.
To log in as another user:
1. Click Your Name > Setup > Manage Users > Users.
2. Click the Login link next to the user name. This link is only available for users who have granted login access to an administrator, or in organizations where administrators can log in as any user.
3. Click User’s Name > Logout to return to your administrator account.
See Also:
120
Manage Users Delegating Administrative Duties
Delegating Administrative Duties
Available in: Enterprise, Unlimited, and Developer, and Database.com Editions
To delegate administration:
To be a delegated administrator:
User Permissions Needed
“Customize Application”
“View Setup and Configuration”
Use delegated administration to assign limited administrative privileges to selected non-administrator users in your organization.
Delegated administrators can perform the following tasks:
• Creating and editing users and resetting passwords for users in specified roles and all subordinate roles, including setting quotas, creating default opportunity teams, and creating personal groups for those users
• Unlocking non-portal users
• Assigning users to specified profiles
• Logging in as a user who has granted login access to their administrator
• Managing custom objects created by an administrator
For example, you may want to allow the manager of the Customer Support team to create and edit users in the Support
Manager role and all subordinate roles. This allows the administrator to focus on tasks other than managing users for every department that uses Salesforce.
To create delegated groups, click Your Name > Setup > Security Controls > Delegated Administration, then click New.
To manage your delegated groups:
• Click Edit next to a group to modify it.
• Select a group and click Delete to remove it.
• Select a group and click Remove next to the user in the Delegated Administrators related list to remove a user from that delegated group.
Note: To delegate administration of particular objects, use object permissions, such as “View All” and “Modify All.”
See Also:
Defining Delegated Administrators
Delegating User Administration
Delegating Custom Object Administration
121
Manage Users Delegating Administrative Duties
Defining Delegated Administrators
Available in: Enterprise, Unlimited, and Developer, and Database.com Editions
To delegate administration:
To be a delegated administrator:
User Permissions Needed
“Customize Application”
“View Setup and Configuration”
A delegated administration group is a group of users who have the same administrative privileges. These groups are not related to public groups used for sharing. To define a delegated administration group:
1. Click
Your Name
> Setup > Security Controls > Delegated Administration.
2. Click New.
3. Enter a group name.
4. To allow the users in this group to log in as users in the role hierarchy that they administer, select Enable Group for
Login Access
. Depending on your organization settings, individual users may need to grant login access to allow their administrators to log in as them.
5. Click Save.
6. To specify the users in this delegated group, in the Delegated Administrators related list, click Add.
7. Click to find and add users to the group. The users must have the “View Setup and Configuration” permission.
8. Click Save.
See Also:
Delegating Administrative Duties
Delegating User Administration
Available in: Enterprise, Unlimited, and Developer, and Database.com Editions
To delegate administration:
To be a delegated administrator:
User Permissions Needed
“Customize Application”
“View Setup and Configuration”
Enable delegated administrators to manage users in specified roles and all subordinate roles, assign specified profiles to those users, and log in as users who have granted login access to administrators.
1. Click
Your Name
> Setup > Security Controls > Delegated Administration.
122
Manage Users Delegating Administrative Duties
2. Select the name of an existing delegated administration group.
3. Click Add in the User Administration related list.
4. Use the magnifying glass lookup icon to find and add roles. Delegated administrators can create and edit users in these roles and all subordinated roles.
5. Click Save.
6. Click Add in the Assignable Profiles related list.
7. Use the magnifying glass lookup icon to find and add profiles. Delegated administrators can assign these profiles to the users they create and edit. Note that profiles with the “Modify All Data” permission cannot be assigned by delegated administrators.
Note: If a user is a member of more than one delegated administration group, be aware that he or she can assign any of the assignable profiles to any of the users in roles he or she can manage.
8. Click Save.
9. See Delegating Custom Object Administration
on page 123 to specify what custom objects the delegated administrators can manage.
To remove roles or profiles from the list of items the delegated administrators can use, click Remove next to the role or profile.
See Also:
Delegating Administrative Duties
Delegating Custom Object Administration
Available in: Enterprise, Unlimited, and Developer, and Database.com Editions
To delegate administration:
To be a delegated administrator:
User Permissions Needed
“Customize Application”
“View Setup and Configuration”
Enable delegated administrators to manage custom objects that have been created by an administrator.
1. Click
Your Name
> Setup > Security Controls > Delegated Administration.
2. Select the name of an existing delegated administration group.
3. From the detail page of the delegated administration group, click Add in the Custom Object Administration related list.
4. Use the magnifying glass lookup icon to find and add custom objects. Delegated administrators can customize nearly every aspect of a custom object, including creating a custom tab for it.
5. Click Save. Click Save & More to add additional custom objects.
To remove a custom object from the list of items the delegated administrators can manage, click Remove next to the custom object.
123
Manage Users Tags Settings
Notes on Delegated Administration of Custom Objects
• Delegated administrators can customize nearly every aspect of the custom object, including creating a custom tab for it.
However, they cannot create or modify relationships on the object or set organization-wide sharing defaults.
• Delegated administrators need to have access to custom objects if they need to access the merge fields on those objects from formulas.
See Also:
Delegating Administrative Duties
Tags Settings
Tag settings available in: All Editions
To modify tag settings:
User Permissions Needed
“Customize Application”
Administrators set up and manage personal and public tags by:
•
for accounts, activities, assets, campaigns, cases, contacts, contracts, dashboards, documents, events, leads, notes, opportunities, reports, solutions, tasks, and any custom objects (except relationship group members)
•
for their users
•
Deleting personal tags for deactivated users
Enabling Tags
Tag settings available in: All Editions
To modify tag settings:
User Permissions Needed
“Customize Application”
1. Click Your Name > Setup > Customize > Tags > Tag Settings.
2. Select Enable Personal Tags and Enable Public Tags to allow users to add personal and public tags to records.
Deselect both options to disable tags.
3. Specify which objects and page layouts should display tags in a tag section at the top of record detail pages. The tag section is the only way that a user can add tags to a record.
124
Manage Users Tags Settings
For example, if you only select account page layouts, users in your organization can only tag account records. Additionally, if you only select account page layouts for personal tags and not public tags, users can only tag account records with personal tags.
4. Click Save.
Use these tips when enabling tags.
• When you enable tags, you can also add them to a page layout by editing the page layout directly.
• Search results and the Tags page don't display custom objects that don't have an associated tab, even if tags are enabled for the custom object. If you want custom object records to appear in search results or on the Tags page, you must create an associated tab. The tab doesn't have to be visible to users.
• Customer Portal users can't view the tags section of a page, even if it is included in a page layout.
See Also:
Adding Tags to the Sidebar
Tag settings available in: All Editions
To modify tag settings:
User Permissions Needed
“Customize Application”
for your organization, you can add the Tags component to your users' sidebar. This component allows users to navigate to the Tags page where they can browse, search, and manage their tags. It also lists each user's most recently used tags. To add this component:
1. Click Your Name > Setup > Customize > Home > Home Page Layouts.
2. Next to a home page layout that you want to modify, click Edit.
3. Select the
Tags
checkbox and click Next.
4. Arrange the Tags component on your page layout as desired, and click Save.
Tip: If you want the Tags component to appear on all pages and not just the Home tab, click
Your Name
> Setup
> Customize > User Interface, and select Show Custom Sidebar Components on All Pages .
See Also:
125
Manage User Access to Data Securing Data Access
Deleting Personal Tags for Deactivated Users
Personal Tag Cleanup available in: All Editions
To delete personal tags for deactivated users:
User Permissions Needed
“Customize Application”
Your organization can have a maximum of 5,000,000 personal and public tags applied to records across all users. If your organization is approaching this limit, you can delete personal tags for deactivated users.
1. Click
Your Name
> Setup > Customize > Tags > Personal Tag Cleanup.
2. Select one or more deactivated users and click Delete.
You can't restore personal tags after you delete them.
See Also:
M
ANAGE
U
SER
A
CCESS TO
D
ATA
Securing Data Access
The available data management options vary according to which Salesforce Edition you have.
Choosing the data set that each user or group of users can see is one of the key decisions that affects data security. You need to find a balance between limiting access to data, thereby limiting risk of stolen or misused data, versus the convenience of data access for your users.
Note: Who Sees What: Overview (4:33 minutes)
Watch a demo on controlling access to and visibility of your data.
To enable users to do their job without exposing data that they do not need to see, Salesforce provides a flexible, layered sharing design that allows you to expose different data sets to different sets of users.
• To specify the objects that users can access, you can assign permission sets and profiles.
• To specify the fields that users can access, you can use field-level security.
126
Manage User Access to Data Securing Data Access
• To specify the individual records that users can view and edit, you can set your organization-wide sharing settings, define a role hierarchy, and create sharing rules.
Tip: When implementing security and sharing rules for your organization, make a table of the various types of users in your organization. In the table, specify the level of access to data that each type of user needs for each object and for fields and records within the object. You can refer to this table as you set up your security model.
The following describes these security and sharing settings:
Object-Level Security (Permission Sets and Profiles)
Object-level security—or object permissions—provide the bluntest way to control data. Using object permissions you can prevent a user from seeing, creating, editing, or deleting any instance of a particular type of object, such as a lead or opportunity. Object permissions let you hide whole tabs and objects from particular users, so that they don’t even know that type of data exists.
You specify object permissions in permission sets and profiles. Permission sets and profiles are collections of settings and permissions that determine what a user can do in the application, similar to a group in a Windows network, where all of the members of the group have the same folder permissions and access to the same software.
Profiles are typically defined by a user’s job function (for example, system administrator or sales representative). A profile can be assigned to many users, but a user can be assigned to only one profile. You can use permission sets to grant additional permissions and access settings to users. It’s easy to manage users’ permissions and access with permission sets, because you can assign multiple permission sets to a single user.
Field-Level Security (Permission Sets and Profiles)
In some cases, you may want users to have access to an object, but limit their access to individual fields in that object.
Field-level security—or field permissions—control whether a user can see, edit, and delete the value for a particular field on an object. They let you protect sensitive fields without having to hide the whole object from users. Field permissions are also controlled in permission sets and profiles.
Unlike page layouts, which only control the visibility of fields on detail and edit pages, field permissions control the visibility of fields in any part of the app, including related lists, list views, reports, and search results. To ensure that a user can’t access a particular field, use field permissions. No other settings provide the same level of protection for a field.
Note: Field-level security doesn’t prevent searching on the values in a field. When search terms match on field values protected by field-level security, the associated records are returned in the search results without the protected fields and their values.
Record-Level Security (Sharing)
After setting object- and field-level access permissions, you may want to configure access settings for the actual records themselves. Record-level security lets you give users access to some object records, but not others. Every record is owned by a user or a queue. The owner has full access to the record. In a hierarchy, users higher in the hierarchy always have the same access to users below them in the hierarchy. This access applies to records owned by users, as well as records shared with them.
To specify record-level security, set your organization-wide sharing settings, define a hierarchy, and create sharing rules.
• Organization-wide sharing settings—The first step in record-level security is to determine the organization-wide sharing settings for each object. Organization-wide sharing settings specify the default level of access users have to each others’ records.
You use organization-wide sharing settings to lock down your data to the most restrictive level, and then use the other record-level security and sharing tools to selectively give access to other users. For example, let’s say users have
127
User Permissions and Access Overview of User Permissions and Access object-level permissions to read and edit opportunities, and the organization-wide sharing setting is Read-Only. By default, those users can read all opportunity records, but can’t edit any unless they own the record or are granted additional permissions.
• Role hierarchy—Once you’ve specified organization-wide sharing settings, the first way you can give wider access to records is with a role hierarchy. Similar to an organization chart, a role hierarchy represents a level of data access that a user or group of users needs. The role hierarchy ensures that users higher in the hierarchy always have access to the same data as people lower in their hierarchy, regardless of the organization-wide default settings. Role hierarchies don’t have to match your organization chart exactly. Instead, each role in the hierarchy should represent a level of data access that a user or group of users needs.
You can also use a territory hierarchy to share access to records. A territory hierarchy grants users access to records based on criteria such as zip code, industry, revenue, or a custom field that is relevant to your business. For example, you could create a territory hierarchy in which a user with the “North America” role has access to different data than users with the “Canada” and “United States” roles.
Note: Although it’s easy to confuse permission sets and profiles with roles, they control two very different things. Permission sets and profiles control a user’s object and field access permissions. Roles primarily control a user’s record-level access through role hierarchy and sharing rules.
• Sharing rules—Sharing rules let you make automatic exceptions to organization-wide sharing settings for particular sets of users, to give them access to records they don’t own or can’t normally see. Sharing rules, like role hierarchies, are only used to give additional users access to records—they can’t be stricter than your organization-wide default settings.
• Manual sharing—Sometimes it’s impossible to define a consistent group of users who need access to a particular set of records. In those situations, record owners can use manual sharing to give read and edit permissions to users who would not have access to the record any other way. Although manual sharing isn’t automated like organization-wide sharing settings, role hierarchies, or sharing rules, it gives record owners the flexibility to share particular records with users that need to see them.
• Apex managed sharing—If sharing rules and manual sharing don’t give you the control you need, you can use Apex managed sharing. Apex managed sharing allows developers to programmatically share custom objects. When you use Apex managed sharing to share a custom object, only users with the “Modify All Data” permission can add or change the sharing on the custom object's record, and the sharing access is maintained across record owner changes.
U
SER
P
ERMISSIONS AND
A
CCESS
Overview of User Permissions and Access
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User permissions and access settings specify what users can do within an organization. For example, permissions determine a user's ability to edit an object record, view the Setup menu, empty the organizational Recycle Bin, or reset a user's password.
Access settings determine other functions, such as access to Apex classes, app visibility, and the hours when users can log in.
128
Manage User Access to Data Overview of User Permissions and Access
Permissions and access settings are specified in user profiles and permission sets. Every user is assigned only one profile, but can also have multiple permission sets.
When determining access for your users, it's a good idea to use profiles to assign the minimum permissions and access settings for specific groups of users, then use permission sets to grant additional permissions.
Because you can assign many permission sets to users and permission sets are reusable, you can distribute access among more logical groupings of users, regardless of their primary job function. For example, you can create a permission set that gives read access to a custom object and assign it to a large group of users, and create another permission set that gives edit access to the object and assign it to only a few users. You can assign these permission sets to various types of users, regardless of their profiles.
The following table shows the types of permissions and access settings that are specified in profiles and permission sets. Some profile settings aren't included in permission sets.
In Profiles?
In Permission Sets?
Permission or Setting Type
Assigned apps
Tab settings
Record type assignments
Page layout assignments
Object permissions
Field permissions
User permissions (app and system)
Apex class access
Visualforce page access
Service provider access (if Salesforce is enabled as an identity provider)
Desktop client access
Login hours
Login IP ranges
See Also:
Revoking Permissions and Access
129
User Permissions and Access User Profiles Overview
Revoking Permissions and Access
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
You can use profiles and permission sets to grant access, but not to deny access. Any permission granted from either a profile or permission set is honored. For example, if “Transfer Record” isn't enabled in Jane Smith's profile, but is enabled in two of her permission sets, she can transfer records regardless of whether she owns them. To revoke a permission, you must remove all instances of the permission from the user. You can do this with the following actions—each has possible consequences.
Action Consequence
Disable a permission or remove an access setting in the profile and any permission sets that are assigned to the user.
The permission or access setting is disabled for all other users assigned to the profile or permission sets.
If a permission or access setting is enabled in the user's profile, assign a different profile to the user.
The user may lose other permissions or access settings associated with the profile or permission sets.
AND
If the permission or access setting is enabled in any permission sets that are assigned to the user, remove the permission set assignments from the user.
To resolve the consequence in either case, consider all possible options. For example, you can clone the assigned profile or any assigned permission sets where the permission or access setting is enabled, disable the permission or access setting, and assign the cloned profile or permission sets to the user. Another option is to create a base profile with the least number of permissions and settings that represents the largest number of users possible, then create permission sets that layer additional access.
See Also:
Overview of User Permissions and Access
User Profiles Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
A profile contains user permissions and access settings that control what users can do within their organization.
Note: Who Sees What: Object Access (5:51 minutes)
Watch how you can grant users access to objects using profiles.
130
Manage User Access to Data User Profiles Overview
Depending on which profile user interface is enabled in your organization, you can:
•
View and edit profiles in the enhanced profile user interface
•
View and edit profiles in the original profile user interface
You can also use a list view to edit multiple profiles .
Profiles control:
• Which standard and custom apps users can view
• Which tabs users can view
• Which record types are available to users
• Which page layouts users see
• Object permissions that allow users to create, read, edit, and delete records
• Which fields within objects users can view and edit
• Permissions that allow users to manage the system and apps within it
• Which Apex classes and Visualforce pages users can access
• Which desktop clients users can access
• The hours during which and IP addresses from which users can log in
• Which service providers users can access (if Salesforce is enabled as an identity provider)
Note: Chatter customers (users with the Chatter External User profile) can only see groups they belong to and people in those groups; they can't see any Salesforce information. If your organization uses a custom domain or IP restrictions, it's recommended that users with the Chatter External User log in using single sign-on.
In Contact Manager, Group, and Professional Edition organizations, you can assign standard profiles to your users, but you can't view or edit the standard profiles or create custom profiles. In Enterprise, Unlimited, and Developer Edition organizations, you can use standard profiles, or create, edit, and delete custom profiles. For standard profiles, only certain settings can be changed.
Each standard or custom profile belongs to exactly one user license type.
See Also:
Standard Profiles
The standard profiles available vary according to the Edition you have.
There are standard profiles in every organization. In Enterprise, Unlimited, and Developer Edition, you can use standard profiles or create, edit, and delete custom profiles. In organizations where you can't create custom profiles (such as Contact
Manager, Group, and Professional Edition), you can assign standard profiles to your users, but you can't view or edit them.
131
Manage User Access to Data
Profile Name
System Administrator
Standard Platform User
Standard Platform One App User
Standard User
Partner User
High Volume Customer Portal and
Authenticated Website
Both user licenses are high-volume portal users
Customer Portal User
Customer Portal Manager
Solution Manager
Marketing User
User Profiles Overview
Available Permissions
Can configure and customize the application. Has access to all functionality that does not require an additional license.
For example, administrators cannot manage campaigns unless they also have a Marketing User license. Can manage price books and products. Can edit any quota, override forecasts, and view any forecast.
Can use custom Force.com AppExchange apps developed in your organization or installed from AppExchange. In addition, can use core platform functionality such as accounts, contacts, reports, dashboards, and custom tabs.
Can use one custom AppExchange app developed in your organization or installed from AppExchange. The custom app is limited to five tabs. In addition, can use core platform functionality such as accounts, contacts, reports, dashboards, and custom tabs.
Can create and edit most major types of records, run reports, and view the organization's setup. Can view, but not manage, campaigns. Can create, but not review, solutions. Can edit personal quota and override forecasts.
Can only log in via a partner portal.
Can only log in via a Customer Portal.
Can only log in via a Customer Portal. Can view and edit data they directly own or data owned by or shared with users below them in the Customer Portal role hierarchy; and they can view and edit cases where they are listed in the Contact Name field.
Can only log in via a Customer Portal. Can view and edit data they directly own or data owned by or shared with users below them in the Customer Portal role hierarchy; and they can view and edit cases where they are listed in the
Contact Name field.
Can review and publish solutions. Also has access to the same functionality as the Standard User.
Can manage campaigns, import leads, create letterheads, create
HTML email templates, manage public documents, and update campaign history via the import wizards. Also has access to the same functionality as the Standard User.
132
Manage User Access to Data
Profile Name
Contract Manager
Read Only
Chatter Only User
Chatter Free User
Chatter External User
Chatter Moderator User
User Profiles Overview
Available Permissions
Can create, edit, activate, and approve contracts. This profile can also delete contracts as long as they are not activated. Can edit personal quota and override forecasts.
Can view the organization's setup, run and export reports, and view, but not edit, other records.
Can only log in to Chatter. Can access all standard Chatter people, profiles, groups, and files. Additionally, they can:
• View Salesforce accounts and contacts
• Use Salesforce CRM Content, Ideas, and Answers
• Modify up to ten custom objects
Note: You must expose the tabs for the standard
Salesforce objects that the Chatter Only user profile can access, as they are hidden by default for these users.
Professional Edition organizations must have Profiles enabled to perform these tasks. Contact your sales representative for more information.
Only available with the Chatter Only user license.
For more information on Chatter Plus users, see Chatter Plus
Frequently Asked Questions .
Can only log in to Chatter. Can access all standard Chatter people, profiles, groups, and files.
Only available with the Chatter Free user license.
Can only log into Chatter and access groups they've been invited to and interact with members of those groups. Only available with the Chatter External user license.
Can only log in to Chatter. Can access all standard Chatter people, profiles, groups, and files. Additionally, this user can:
• Activate and deactivate other Chatter Free users and moderators
• Grant and revoke moderator privileges
• Delete posts and comments that they can see
Note: Changing a user's profile from Chatter
Moderator User to Chatter Free User removes moderator privileges in Chatter.
Only available with the Chatter Free user license.
133
Manage User Access to Data
Profile Name
Site.com Only User
User Profiles Overview
Available Permissions
Can only log in to the Site.com app. Each Site.com Only user also needs a Site.com Publisher feature license to create and publish sites, or a Site.com Contributor feature license to edit the site's content..
Additionally, this user can:
• Use one custom app with up to 20 custom objects
• Access the Content app, but not the Accounts and
Contacts objects
• Create unlimited custom tabs
Only available with the Site.com Only user license.
See Also:
Viewing Profile Lists
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The Customer Portal and partner portals are not available in Database.com
To view profiles, and print profile lists:
To delete profile list views:
To delete custom profiles:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
“Manage Users”
AND
“Customize Application”
A profile contains user permissions and access settings that control what users can do within their organization. To view the profiles in your organization, click Your Name > Setup > Manage Users > Profiles.
Viewing Enhanced Profile Lists
If enhanced profile list views are enabled for your organization, you can use additional tools to customize, navigate, manage, and print profile lists.
• Show a filtered list of profiles by selecting a view from the drop-down list.
• Delete a view by selecting it from the drop-down list and clicking Delete.
134
Manage User Access to Data User Profiles Overview
•
Create a list view or edit an existing view
.
•
• Print the list view by clicking .
•
Refresh the list view after creating or editing a view by clicking .
•
Edit permissions directly in the list view .
• View or edit a profile by clicking its name.
• Delete a custom profile by clicking Del next to its name.
Viewing the Basic Profile List
•
• View or edit a profile by clicking its name.
• Delete a custom profile by clicking Del next to its name.
See Also:
Editing Multiple Profiles with Profile List Views
Creating and Editing Profile List Views
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To create, edit, and delete profile list views:
User Permissions Needed
“Manage Users”
If enhanced profile list views
are enabled for your organization, you can create profile list views to show a set of profiles with the fields you choose. For example, you could create a list view of all profiles in which “Modify All Data” is enabled.
1. In the Profiles page, click Create New View, or select a view and click Edit.
2. Enter the view name.
3. Under Specify Filter Criteria, specify the conditions that the list items must match, such as Modify All Data equals
True .
a. Type a setting name, or click the lookup icon to search for and select the setting you want.
b. Choose a filter operator.
c. Enter the value that you want to match.
d. To specify another filter condition, click Add New. You can specify up to 25 filter condition rows.
To remove a filter condition row and clear its values, click the remove row icon .
4. Under Select Columns to Display, specify the profile settings that you want to appear as columns in the list view.
a. From the Search drop-down list, select the type of setting you want to search for.
b. Enter part or all of a word in the setting you want to add and click Find.
135
Manage User Access to Data User Profiles Overview
Note: If the search finds more than 500 values, no results appear. Use the preceding steps to refine your search criteria and show fewer results.
c. To add or remove columns, select one or more column names and click the Add or Remove arrow.
d. Use the Top, Up, Down, and Bottom arrows to arrange the columns in the sequence you want.
You can add up to 15 columns in a single list view.
5. Click Save, or if you're cloning an existing view, rename it and click Save As.
See Also:
Editing Multiple Profiles with Profile List Views
Editing Multiple Profiles with Profile List Views
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To edit multiple profiles from the list view:
User Permissions Needed
“Manage Users”
AND
“Customize Application”
If
are enabled for your organization, you can change permissions in up to 200 profiles directly from the list view, without accessing individual profile pages. Editable cells display a pencil icon ( ) when you hover over the cell, while non-editable cells display a lock icon ( ). In some cases, such as in standard profiles, the pencil icon appears but the setting is not actually editable.
Warning: Use care when editing profiles with this method. Because profiles affect a user's fundamental access, making mass changes may have a widespread effect on users in your organization.
To change permissions in one or more profiles:
1. Select or create a list view that includes the profiles and permissions you want to edit.
2. To edit multiple profiles, select the checkbox next to each profile you want to edit. If you select profiles on multiple pages,
Salesforce remembers which profiles are selected.
3. Double-click the permission you want to edit. For multiple profiles, double-click the permission in any of the selected profiles.
4. In the dialog box that appears, enable or disable the permission. In some cases, changing a permission may also change other permissions. For example, if “Customize Application” and “View Setup and Configuration” are disabled and you enable “Customize Application,” then “View Setup and Configuration” is also enabled. In this case, the dialog box lists the affected permissions.
5. To change multiple profiles, select All n
selected records (where n
is the number of profiles you selected).
6. Click Save.
136
Manage User Access to Data User Profiles Overview
Note:
• For standard profiles, inline editing is available only for the “Single Sign-On” and “Affected By Divisions” permissions.
• If you edit multiple profiles, only those profiles that support the permission you are changing will change. For example, if you use inline editing to add “Modify All Data” to multiple profiles, but because of its user license the profile doesn't have “Modify All Data,” the profile won't change.
If any errors occur, an error message appears, listing each profile in error and a description of the error. Click the profile name to open the profile detail page. The profiles you've clicked appear in the error window in gray, strike-through text.
Note: To view the error console, you must have pop-up blockers disabled for the Salesforce domain.
Any changes you make are recorded in the setup audit trail.
See Also:
Cloning Profiles
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To create profiles:
User Permissions Needed
“Manage Users”
Tip: If you’re cloning a profile to enable certain permissions or access settings for one or more users, you might be
.
1. Click
Your Name
> Setup > Manage Users > Profiles.
2. In the Profiles list page, do one of the following:
• Click New Profile, then select an existing profile that’s similar to the one you want to create.
• If enhanced profile list views are enabled, click Clone next to a profile that’s similar to the one you want to create.
• Click the name of a profile that’s similar to the one you want to create, then in the profile page, click Clone.
A new profile uses the same user license as the profile it was cloned from.
3. Enter a profile name.
137
Manage User Access to Data User Profiles Overview
4. Click Save.
See Also:
Viewing a Profile's Assigned Users
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To view users that are assigned to a profile:
To create and edit users:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
To view all users that are assigned to a profile from the profile overview page, click Assigned Users (in the enhanced profile user interface) or View Users (in the original profile user interface). From the assigned users page, you can:
•
•
Reset passwords for selected users
•
• View a user's detail page by clicking the name, alias, or username
• View or edit a profile by clicking the profile name
• If Google Apps ™ is enabled in your organization, export users to Google and create Google Apps accounts by clicking
Export to Google Apps
See Also:
138
Manage User Access to Data User Profiles Overview
Viewing and Editing Object Permissions in Permission Sets and Profiles
Object permissions specify the type of access that users have to objects.
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To view object permissions:
To edit object permissions:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
AND
“Customize Application”
1. Click Your Name > Setup > Manage Users, then click Permission Sets or Profiles.
2. Select a permission set or profile.
3. Depending on which interface you're using, do one of the following:
• Permission sets or enhanced profile user interface—In the Find Settings... box, enter the name of the object and select it from the list. Click Edit, then scroll to the Object Permissions section.
• Original profile user interface—Click Edit, then scroll to the Standard Object Permissions or Custom Object Permissions section.
4. Specify the object permissions. For more information, see
Object Permissions on page 180.
5. Click Save.
See Also:
Viewing and Editing Tab Settings in Permission Sets and Profiles
Tab settings specify whether a tab appears in the All Tabs page or is visible in a tab set.
Available in: Enterprise, Unlimited, and Developer Editions
To view tab settings:
To edit tab settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
1. Click Your Name > Setup > Manage Users, then click Permission Sets or Profiles.
139
Manage User Access to Data User Profiles Overview
2. Select a permission set or profile.
3. Do one of the following:
• Permission sets or enhanced profile user interface—In the Find Settings... box, enter the name of the tab you want and select it from the list, then click Edit.
• Original profile user interface—Click Edit, then scroll to the Tab Settings section.
4.
.
5. (Original profile user interface only) To reset users’ tab customizations to the tab visibility settings that you specify, select
Overwrite users' personal tab customizations.
6. Click Save.
Note: If Salesforce CRM Content is enabled for your organization but the Salesforce CRM Content User checkbox isn’t enabled on the user detail page, the Salesforce CRM Content app has no tabs.
See Also:
Tab Settings
Available in: Enterprise, Unlimited, and Developer Editions
Tab settings specify whether a tab appears in the All Tabs page or is visible in its associated app. Tab settings labels in permission sets differ from the labels in profiles.
Enabled Settings in Permission Sets
Available
Available
None
and Visible
Enabled Setting in Profiles
Default Off
Default On
Tab Hidden
Description
The tab is available on the All Tabs page.
Individual users can customize their display to make the tab visible in any app.
The tab is available on the All Tabs page and appears in the visible tabs for its associated app. Individual users can customize their display to hide the tab or make it visible in other apps.
The tab isn’t available on the All Tabs page or visible in any apps.
Note: If a user has another permission set or profile with enabled settings for the same tab, the most permissive setting applies. For example, if permission set A has no settings enabled for the Accounts tab, but permission set B
140
Manage User Access to Data User Profiles Overview enables the Available setting for the Accounts tab, and permission sets A and B are assigned to a user, the user sees the Accounts tab on the All Tabs page.
See Also:
Viewing and Editing Tab Settings in Permission Sets and Profiles
Enhanced Profile User Interface Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The enhanced profile user interface provides a streamlined experience for managing profiles. With it, you can easily navigate, search, and modify settings for a profile.
You can enable the enhanced profile user interface in the User Interface settings page
. Your organization can only use one profile user interface at a time.
Note: You can't use the enhanced profile user interface if:
• You use Microsoft ® Internet Explorer ® 6 or earlier to manage your profiles (unless you've installed the Google
Chrome Frame ™ plug-in for Internet Explorer).
• Your organization uses category groups on guest profiles used for sites.
• Your organization delegates partner portal administration to portal users.
See Also:
Working in the Enhanced Profile User Interface Overview Page
141
Manage User Access to Data User Profiles Overview
Working in the Enhanced Profile User Interface Overview Page
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Assigned apps, standard objects, tabs, and Visualforce are not available in Database.com
To view profiles:
To delete profiles and edit profile properties:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
In the enhanced profile user interface, the profile overview page provides an entry point for all of the settings and permissions for a single profile. To open the profile overview page, click
Your Name
> Setup > Manage Users > Profiles and click the profile you want to view.
From the profile overview page, you can:
•
Search for an object, permission, or setting
•
• If it's a custom profile that's not assigned to any users, delete the profile by clicking Delete
• Change the profile name or description by clicking Edit Properties
•
View a list of users who are assigned to the profile
• Click any of the links on the page to view or edit permissions and settings.
◊ Assigned Apps
◊ Object Settings (tab settings, record types and page layout settings, object permissions, and field permissions)
◊ App Permissions
◊ Apex Class Access
◊ Visualforce Page Access
◊ Data Category Visibility (if you've enabled data categories)
◊ System Permissions
◊ Desktop Client Access
◊ Login Hours
◊ Login IP Ranges
◊ Service Providers (if Salesforce is enabled as an identity provider)
See Also:
Enhanced Profile User Interface Overview
142
Manage User Access to Data User Profiles Overview
App and System Settings in the Enhanced Profile User Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Database.com Edition doesn't include assigned apps, tabs, record types, page layouts, Visualforce, and desktop clients
In the enhanced profile user interface, administrators can easily navigate, search, and modify settings for a single profile.
Permissions and settings are organized into pages under app and system categories, which reflect the rights users need to administer and use app and system resources.
App Settings
Apps are sets of tabs that users can change by selecting the drop-down menu in the header. All underlying objects, components, data, and configurations remain the same, regardless of the selected app. In selecting an app, users navigate in a set of tabs that allows them to efficiently use the underlying functionality for app-specific tasks. For example, let's say you do most of your work in the sales app, which includes tabs like Accounts and Opportunities. To track a new marketing campaign, rather than adding the Campaigns tab to the sales app, you select Marketing from the app drop-down to view your campaigns and campaign members.
In the enhanced profile user interface, the Apps section of the overview page contains settings that are directly associated with the business processes that the apps enable. For example, customer service agents may need to manage cases, so the “Manage
Cases” permission is in the Call Center section of the App Permissions page. Some app settings aren't related to app permissions.
For example, to enable the Time-Off Manager app from the AppExchange, users need access to the appropriate Apex classes and Visualforce pages, as well as the object and field permissions that allow them to create new time-off requests. The Apps section contains links to these pages:
• Assigned Apps
• Object Settings, which include:
◊ Tab settings
◊ Record types and page layout settings
◊ Object permissions
◊ Field permissions
• App Permissions
• Apex Class Access
• Visualforce Page Access
Note: Regardless of the currently selected app, all of a user's permissions are respected. For example, although the
“Import Leads” permission is under the Sales category, a user can import leads even while in the Call Center app.
System Settings
Some system functions apply to an organization and not to any single app. For example, login hours and login IP ranges control a user's ability to log in, regardless of which app the user accesses. Other system functions apply to all apps. For example, the “Run Reports” and “Manage Dashboards” permissions allow managers to create and manage reports in all apps. In some cases, such as with “Modify All Data,” a permission applies to all apps, but also includes non-app functions, like the ability to download the Data Loader.
In the enhanced profile user interface, the System section of the overview page contains links to these pages:
• System Permissions
143
Manage User Access to Data User Profiles Overview
• Desktop Client Access
• Login Hours
• Login IP Ranges
• Service Providers (if Salesforce is enabled as an identity provider)
See Also:
Enhanced Profile User Interface Overview
Searching in the Enhanced Profile User Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The following items don't appear in searches when using the enhanced profile user interface with Database.com: standard objects, assigned apps, tabs, Visualforce page access settings, and desktop client access settings.
To find permissions and settings in a profile:
User Permissions Needed
“View Setup and Configuration”
On any of the profile pages, type at least three consecutive letters of an object, tab, permission, or setting name in the Find
Settings... box. The search terms aren't case-sensitive. As you type, suggestions for results that match your search terms appear in a list. Click an item in the list to go to its settings page.
You can search for:
Item
Assigned apps
Objects
Fields
Tabs
Apex class access settings
Visualforce page access settings
App and system permissions
Desktop client access settings
Login hours and login IP ranges
Example
Type sales in the Find Settings box, then select Sales from the list.
Type an existing object’s name. For example, let’s say you have an Albums custom object, type albu , then select Albums .
Type the name of the object that contains the field. For example, let’s say your Albums object contains a Description field. To find the
Description field for albums, type albu , select Albums , and scroll down to
Description
under Field Permissions.
Type rep , then select Reports .
Type apex , then select Apex Class Access .
Type VISU , then select
Visualforce Page Access
.
Type api , then select
API Enabled
.
Type des , then select Desktop Client Access .
Type log , then select Login Hours or Login IP Ranges .
Or type ip r , then select
Login IP Ranges
.
144
Manage User Access to Data User Profiles Overview
Item
Service providers (available only if Salesforce is enabled as an identity provider)
Example
Type serv , then select
Service Providers
.
If no results appear in a search:
• The permission, object, tab, or setting you're searching for may not be available in the current organization.
• The item you're searching for may not be available for the user license that's associated with the current profile. For example, a profile with the High Volume Customer Portal license doesn't include the “Modify All Data” permission.
• Be sure your search terms have at least three consecutive characters that match the name of the item you want to find.
• Be sure the search term is spelled correctly.
See Also:
Enhanced Profile User Interface Overview
Specifying Record Types and Page Layout Assignments in the Enhanced Profile User Interface
Available in: Enterprise, Unlimited, and Developer Editions
To edit object permissions and settings:
User Permissions Needed
“Manage Users”
AND
“Customize Application”
In the enhanced profile user interface, Record Types and Page Layout Assignments settings determine the record type and page layout assignment mappings that are used when users view records. They also determine which record types are available when users create or edit records.
To specify record types and page layout assignments:
1. Click Your Name > Setup > Manage Users > Profiles.
2. Select a profile.
3. In the Find Settings... box, enter the name of the object you want and select it from the list.
4. Click Edit.
5. In the Record Types and Page Layout Assignments section, make changes to the settings as needed.
Setting
Record Types
Description
Lists all existing record types for the object.
--Master- is a system-generated record type that's used when a record has no custom record type associated with it. When
--Master--
is assigned, users
145
Manage User Access to Data User Profiles Overview
Setting
Page Layout Assignment
Assigned Record Types
Default Record Type
Description can't set a record type to a record, such as during record creation. All other record types are custom record types.
The page layout to use for each record type. The page layout determines the buttons, fields, related lists, and other elements that users with this profile see when creating records with the associated record type. Since all users can access all record types, every record type must have a page layout assignment, even if the record type isn't specified as an assigned record type in the profile.
Record types that are checked in this column are available when users with this profile create records for the object. If
--Master--
is selected, you can't select any custom record types; and if any custom record types are selected, you can't select
--Master--
.
The default record type to use when users with this profile create records for the object.
The Record Types and Page Layout Assignments settings have some variations for the following objects or tabs.
Object or Tab
Accounts
Cases
Home
Variation
If your organization uses person accounts, the accounts object additionally includes
Business Account Default Record Type and Person Account Default Record
Type settings, which specify the default record type to use when the profile's users create business or person account records from converted leads.
The cases object additionally includes Case Close settings, which show the page layout assignments to use for each record type on closed cases. That is, the same record type may have different page layouts for open and closed cases. With this additional setting, when users close a case, the case may have a different page layout that exposes how it was closed.
You can't specify custom record types for the home tab. You can only select a page layout assignment for the --Master-- record type.
6. Click Save.
See Also:
Working in the Enhanced Profile User Interface Overview Page
146
Manage User Access to Data User Profiles Overview
Viewing and Editing Login Hours in the Enhanced Profile User Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To view login hour settings:
To edit login hour settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
For each profile, you can specify the hours when users can log in.
1. Click Your Name > Setup > Manage Users > Profiles.
2. Select a profile and click its name.
3. In the profile overview page, scroll down to Login Hours and click Edit.
4. Set the days and hours when users with this profile can log in to the organization.
To allow users to log in at any time, click Clear all times. To prohibit users from using the system on a specific day, set the start and end times to the same value.
If users are logged in when their login hours end, they can continue to view their current page, but they can’t take any further action.
Note: The first time login hours are set for a profile, the hours are based on the organization’s Default Time
Zone
as specified at
Your Name
> Setup > Company Profile > Company Information. After that, any changes to the organization’s Default Time Zone won’t change the time zone for the profile’s login hours. As a result, the login hours are always applied at those exact times even if a user is in a different time zone or if the organization’s default time zone is changed.
Depending on whether you’re viewing or editing login hours, the hours may appear differently. On the Login Hours edit page, hours are shown in your specified time zone. On the profile overview page, they appear in the organization’s original default time zone.
See Also:
Enhanced Profile User Interface Overview
147
Manage User Access to Data User Profiles Overview
Restricting Login IP Ranges in the Enhanced Profile User Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To view login IP ranges:
To edit login IP ranges:
To delete login IP ranges:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
“Modify All Data”
You can control login access on a user’s profile by specifying a range of IP addresses. When you define IP address restrictions for a profile, any login from a restricted IP address is denied.
1. Click
Your Name
> Setup > Manage Users > Profiles.
2. Select a profile and click its name.
3. In the profile overview page, click Login IP Ranges.
4. Use any of these methods to change login IP address ranges for the profile.
• If you want to add ranges, click Add IP Ranges. Enter a valid IP address in the
IP Start Address
and a higher
IP address in the IP End Address field. The start and end addresses define the range of allowable IP addresses from which users can log in. To allow logins from a single IP address, enter the same address in both fields. For example, to allow logins from only 125.12.3.0, enter 125.12.3.0 as both the start and end addresses.
• If you want to edit or remove ranges, click Edit or Delete for that range.
Both IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the IPv4-mapped IPv6 address space
::ffff:0:0
to
::ffff:ffff:ffff
, where
::ffff:0:0
is
0.0.0.0
and
::ffff:ffff:ffff
is
255.255.255.255.
A range can’t include IP addresses inside of the IPv4-mapped IPv6 address space if it also includes
IP addresses outside of the IPv4-mapped IPv6 address space. Ranges such as
255.255.255.255
to
::1:0:0:0
or
:: to ::1:0:0:0 are not allowed. You can set up IPv6 addresses in all organizations, but IPv6 is only enabled for login in sandbox organizations from the Spring ’12 release and later.
Important:
• Partner User profiles are limited to 5 IP addresses. If you want to increase this limit, contact salesforce.com.
• The Salesforce Mobile app can bypass IP range definitions set up for profiles. Salesforce Mobile initiates a secure connection to Salesforce over the mobile carrier’s network, but the mobile carrier’s IP addresses might be outside of the IP ranges allowed on the user’s profile. To prevent bypassing IP definitions set on a user’s
profile, disable Salesforce Mobile
on page 476 for that user.
148
Manage User Access to Data User Profiles Overview
Working with Profiles in the Original Profile Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The settings that are available on the profile detail page vary according to your Edition.
To view a profile, click Your Name > Setup > Manage Users > Profiles, then select the profile you want.
On the profile detail page, you can:
•
•
Create a profile based on this profile
• For custom profiles only, click Delete to delete the profile
•
View the users who are assigned to this profile
Editing Profiles in the Original Profile Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To edit profiles:
User Permissions Needed
“Manage Users”
AND
“Customize Application”
You can edit all settings in a custom profile. In standard profiles, you can edit all settings except name, description, object permissions, field permissions, and user permissions.
1. Click Your Name > Setup > Manage Users > Profiles.
2. Select the profile you want to edit.
3. On the profile detail page, click Edit to change any of the following settings:
• For custom profiles only, the name and description
• App visibility settings
• Connected Apps accessible to this profile
• Tab visibility settings
• For custom profiles only, administrative and general permissions
• For custom profiles only, object permissions
Note: Editing some permissions may automatically cause other permissions to be enabled or disabled. For example, enabling “View All Data” automatically enables “Read” for all objects. Likewise, enabling “Transfer
Leads” automatically enables “Read” and “Create” on leads.
149
Manage User Access to Data User Profiles Overview
Tip: If enhanced profile list views are enabled for your organization, you can change permissions for multiple profiles from the list view.
• Desktop client access settings
You can also view or edit the following settings from the profile detail page:
Setting
Console layouts for all profiles
Page layouts
Access to fields in each object
Record types
Login hours
Login IP address ranges
Executable Apex classes
Executable Visualforce pages
Procedure to View or Edit
Under the Console Settings section, click Edit.
Under the Page Layouts section, click View Assignment next to an object name.
Under the Field-Level Security section, click View next to an object name.
Under the Record Type Settings section, click Edit next to a tab name. The Edit link is available only if record types exist for the object.
Under the Login Hours section, click Edit.
Under the Login IP Ranges section, click New, or click Edit next to an existing IP range.
Under the Enabled Apex Class Access section, click Edit.
Under the Enabled Visualforce Page Access section, click
Edit.
See Also:
Assigning Page Layouts in the Original Profile User Interface
Viewing and Editing Desktop Client Access in the Original Profile User Interface
Assigning Record Types to Profiles in the Original Profile User Interface
Viewing and Editing Login Hours in the Original Profile User Interface
Restricting Login IP Addresses in the Original Profile User Interface
150
Manage User Access to Data User Profiles Overview
Assigning Page Layouts in the Original Profile User Interface
Available in: Enterprise, Unlimited, and Developer Editions
To assign page layouts:
User Permissions Needed
“Manage Users”
1. Click
Your Name
> Setup > Manage Users > Profiles.
2. Select a profile.
3. Click View Assignment next to any tab name in the Page Layouts section.
4. Click Edit Assignment.
5. Use the table to specify the page layout for each profile. The table displays the page layout assignments for each profile. If your organization uses record types, a matrix displays a page layout selector for each profile and record typeSelected page layout assignments are highlighted. Page layout assignments you change are italicized until you save your changes.
6. If necessary, select another page layout from the
Page Layout To Use
drop-down list and repeat the previous step for the new page layout.
7. Click Save.
See Also:
Working with Profiles in the Original Profile Interface
Viewing and Editing Desktop Client Access in the Original Profile User Interface
Available in: Enterprise, Unlimited, and Developer Editions
To view desktop client access settings:
To edit desktop client access settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
Connect for Outlook, Connect Offline, Connect for Office, and Connect for Lotus Notes are desktop clients that integrate
Salesforce with your PC. As an administrator, you can control which desktop clients your users can access as well as whether users are automatically notified when updates are available.
Note: To access desktop clients, users must also have the “API Enabled” permission.
1. Click
Your Name
> Setup > Manage Users > Profiles.
151
Manage User Access to Data User Profiles Overview
2. Click Edit next to a profile name, and scroll to the Desktop Integration Clients section at the bottom of the page.
See Also:
Working with Profiles in the Original Profile Interface
Assigning Record Types to Profiles in the Original Profile User Interface
Available in: Enterprise, Unlimited, and Developer Editions
To assign record types to profiles:
User Permissions Needed
“Customize Application”
After creating record types and including picklist values in them, add record types to user profiles and assign a default record type for each profile. When you add a record type to a profile, users with that profile can assign that record type to records they create or edit.
Note: Any user can view records having any record type, even if the record type is not associated with their profile.
A profile can be associated with several record types. For example, a user who creates opportunities for both hardware and software sales can have both “Hardware” and “Software” record types available when creating opportunities if both record types have been added to the user’s profile.
1. Click
Your Name
> Setup > Manage Users > Profiles.
2. Select a profile. The record types available for that profile are listed in the Record Type Settings section.
3. Click Edit next to the appropriate type of record.
4. Select a record type from the Available Record Types list and add it to the Selected Record Types list to make it available to users with that profile.
Master is a system-generated record type that's used when a record has no custom record type associated with it. When
Master
is assigned, users can't set a record type to a record, such as during record creation. All other record types are custom record types.
5. From the Default drop-down list, choose a default record type.
If your organization uses person accounts, this setting also controls which account fields display in the
Quick Create area of the accounts home page.
6. If your organization uses person accounts, set additional options for the default record types for both person accounts and business accounts. These settings are used when defaults are needed for both kinds of accounts, such as when converting leads.
• From the Business Account Default Record Type drop-down list, choose a default record type for business accounts.
• From the
Person Account Default Record Type
, choose a default record type for person accounts.
7. Click Save.
152
Manage User Access to Data User Profiles Overview
Options in the Record Type Settings section are blank wherever no record types exist. For example, if you have two record types for opportunities but no record types for accounts, the Edit link only displays for opportunities. In this example, the picklist values and default value for the master are available in all accounts.
Note: If your organization uses person accounts, you can view the record type defaults for business accounts and person accounts in the Account Record Type Settings section of the profile detail page. Also, clicking Edit in that section is an alternative way of opening the page where you set record type defaults for accounts.
See Also:
Working with Profiles in the Original Profile Interface
Viewing and Editing Login Hours in the Original Profile User Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To set login hours:
User Permissions Needed
“Manage Users”
For each profile, you can specify the hours when users can log in.
1. Click Your Name > Setup > Manage Users > Profiles, and select a profile.
2. Click Edit in the Login Hours related list.
3. Set the days and hours when users with this profile can use the system.
To allow users to log in at any time, click Clear All Times. To prohibit users from using the system on a specific day, set the start and end times to the same value.
If users are logged in when their login hours end, they can continue to view their current page, but they can’t take any further action.
4. Click Save.
Note: The first time login hours are set for a profile, the hours are based on the organization’s
Default Time
Zone as specified at Your Name > Setup > Company Profile > Company Information. After that, any changes to the organization’s
Default Time Zone
won’t change the time zone for the profile’s login hours. As a result, the login hours are always applied at those exact times even if a user is in a different time zone or if the organization’s default time zone is changed.
Depending on whether you're viewing or editing login hours, the hours may appear differently. On the profile detail page, hours are shown in your specified time zone. On the Login Hours edit page, they appear in the organization's default time zone.
See Also:
Working with Profiles in the Original Profile Interface
Restricting Login IP Addresses in the Original Profile User Interface
153
Manage User Access to Data User Profiles Overview
Restricting Login IP Addresses in the Original Profile User Interface
Available in: All Editions
To view login IP ranges:
To edit login IP ranges:
To delete login IP ranges:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
“Modify All Data”
You can control login access on a user’s profile by specifying a range of IP addresses. When you define IP address restrictions for a profile, any login from a restricted IP address is denied.
1. The procedure you use to restrict the range of valid IP addresses on profiles depends on your Edition:
• If you’re using Enterprise, Unlimited, or Developer editions, click Your Name > Setup > Manage Users > Profiles, and select a profile.
• If you’re using Professional, Group, or Personal editions, click Your Name > Setup > Security Controls > Session
Settings.
2. Click New in the Login IP Ranges related list.
3. Enter a valid IP address in the
IP Start Address
and a higher IP address in the
IP End Address
field.
The start and end addresses define the range of allowable IP addresses from which users can log in. To allow logins from a single IP address, enter the same address in both fields. For example, to allow logins from only 125.12.3.0, enter 125.12.3.0
as both the start and end addresses.
• Partner User profiles are limited to 5 IP addresses. If you want to increase this limit, contact salesforce.com.
• The Salesforce Mobile app can bypass IP range definitions set up for profiles. Salesforce Mobile initiates a secure connection to Salesforce over the mobile carrier’s network, but the mobile carrier’s IP addresses might be outside of the IP ranges allowed on the user’s profile. To prevent bypassing IP definitions set on a user’s profile,
on page 476 for that user.
4. Click Save.
Both IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the IPv4-mapped IPv6 address space
::ffff:0:0
to
::ffff:ffff:ffff
, where
::ffff:0:0
is
0.0.0.0
and
::ffff:ffff:ffff
is
255.255.255.255.
A range can’t include IP addresses inside of the IPv4-mapped IPv6 address space if it also includes IP addresses outside of the IPv4-mapped IPv6 address space. Ranges such as
255.255.255.255
to
::1:0:0:0
or
::
to
::1:0:0:0
are not allowed. You can set up IPv6 addresses in all organizations, but IPv6 is only enabled for login in sandbox organizations from the Spring ’12 release and later.
Note: Cache settings on static resources are set to private when accessed via a Force.com site whose guest user's profile has restrictions based on IP range or login hours. Sites with guest user profile restrictions cache static resources
154
Manage User Access to Data User Profiles Overview only within the browser. Also, if a previously unrestricted site becomes restricted, it can take up to 45 days for the static resources to expire from the Salesforce cache and any intermediate caches.
See Also:
Restricting Login IP Ranges for Your Organization
Viewing and Editing Login Hours in the Original Profile User Interface
Working with Profiles in the Original Profile Interface
Viewing and Editing Assigned Apps in Profiles
Assigned app settings specify the apps that users can select in the Force.com app menu.
Available in: Enterprise, Unlimited, and Developer Editions
To edit app visibility settings:
User Permissions Needed
“Manage Users”
Every profile must have at least one visible app, except profiles associated with Customer Portal users because apps are not available to them.
To specify app visibility:
1. Click
Your Name
> Setup > Manage Users > Profiles.
2. Select a profile.
3. Depending on which user interface you're using, do one of the following:
• Enhanced profile user interface—Click Assigned Apps, then click Edit.
• Original profile user interface—Click Edit, then scroll to the Custom App Settings section.
4. Select one default app. The default app appears when users log in for the first time.
5. Select Visible for any other apps you want to make visible.
See Also:
155
User Permissions and Access Permission Sets Overview
Permission Sets Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Visualforce is not available in Database.com
A permission set is a collection of settings and permissions that give users access to various tools and functions. The settings and permissions in permission sets are also found in profiles, but permission sets extend users' functional access without changing their profiles. For example, to give users access to a custom object, create a permission set, enable the required permissions for the object, and assign the permission set to the users. You never have to change profiles, or create a profile for a single use case. While users can have only one profile, they can have multiple permission sets.
Permission sets include settings for:
• Assigned apps
• Object settings, which include:
◊ Tab settings
◊ Object permissions
◊ Field permissions
• App permissions
• Apex class access
• Visualforce page access
• System permissions
• Service providers (only if you've enabled Salesforce as an identity provider)
Note:
• Some user licenses restrict the number of custom apps or tabs a user can access. Salesforce calculates the total allowed number of custom tabs and assigned apps from settings in a user’s assigned profile plus any assigned permission sets. For users with a license that restricts the number of apps or tabs, you can't assign more than the allotted limit through their assigned profile and permission sets. For example, a user with the Force.com App
Subscription user license with access to one Force.com Light App can access only that app’s custom tabs.
• In Group and Professional Editions, permission sets may be included in installed packages, where they can be viewed and assigned to users but not edited.
See Also:
Working in a Permission Set's Overview Page
156
Manage User Access to Data Permission Sets Overview
Creating Permission Sets
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To create permission sets:
User Permissions Needed
“Manage Users”
You can either clone an existing permission set or create a new one. A cloned permission set starts with the same user license and enabled permissions as the permission set it is cloned from, while a new permission set starts with no user license selected and no permissions enabled. You can create up to 1,000 permission sets.
1. Click Your Name > Setup > Manage Users > Permission Sets.
2. Do one of the following:
• To create a permission set with no permissions enabled, click New.
• To create a permission set based on an existing set, click Clone next to the set you want to copy. You can also select the permission set and click Clone in the overview page or one of the settings pages.
Note: Clone a permission set only if the new one should have the same user license as the original. In a cloned permission set, you can't select a different license.
3. Enter a label, API name, and description.
The API name is a unique name used by the Force.com API and managed packages. It must begin with a letter and use only alphanumeric characters and underscores. It can't include spaces, end with an underscore, or have two consecutive underscores.
4. If this is a new permission set, select a user license option. If you plan to assign this permission set to multiple users with different licenses, select --None-. If only users with one type of license will use this permission set, select the user license that’s associated with them. For more information, see
About User Licenses in Permission Sets on page 158.
If you’re cloning a permission set, you can’t select a user license. If the User License field is blank, no user license is associated with the permission set.
5. Click Save.
The permission set overview page appears. From here you can navigate to the permissions you want to add or change.
See Also:
Working in a Permission Set's Overview Page
157
Manage User Access to Data Permission Sets Overview
About User Licenses in Permission Sets
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When creating a permission set, you can select a specific user license or --None-.
If you’re selecting a specific license, select the license that matches the users who will use the permission set. For example, if you plan to assign this permission set to users with the Salesforce license, select Salesforce.
If you plan to assign this permission set to multiple users with different licenses, select --None-, for no user license. With this option, you can assign the permission set to any users whose license allows the enabled permissions. For example, if you plan to assign the permission set to users with the Salesforce license as well as users with the Salesforce Platform license, select
--None-.
Note:
• Permission sets with no user license don’t include all possible permissions and settings.
• You can only assign a permission set with no license to users whose licenses allow the enabled permissions and settings. For example, if you create a permission set with no user license and enable “Author Apex,” you can’t assign that permission set to users with the Salesforce Platform user license because the license doesn’t allow that permission.
See Also:
Using Permission Set Lists
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To view permission sets, and print permission set lists:
To delete permission sets and permission set list views:
“View Setup and Configuration”
“Manage Users”
To view the permission sets in your organization, click Your Name > Setup > Manage Users > Permission Sets. In the permission sets list page, you can:
• Show a filtered list of permission sets by selecting a view from the drop-down list
•
Create a list view or edit an existing view
• Delete a list view by selecting it from the drop-down list and clicking Delete
•
Create or clone a permission set
158
Manage User Access to Data Permission Sets Overview
•
• Print a list view by clicking .
Refresh the list view by clicking
•
Edit permissions directly in a list view
•
• If it's not assigned to any users, remove a permission set by clicking Del
See Also:
Creating and Editing Permission Set List Views
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To create, edit, and delete permission set list views: “Manage Users”
You can create and edit permission set list views to show a list of permission sets with specific fields and permissions. For example, you could create a list view of all permission sets in which “Modify All Data” is enabled.
1. In the Permission Sets page, click Create New View, or select a view and click Edit.
2. Enter the view name.
3. Under Specify Filter Criteria, specify the conditions that the list items must match, such as Modify All Data equals
True .
a. Type a setting name, or click to search for and select the setting you want.
b. Choose a filter operator.
c. Enter the value that you want to match.
Tip: To show only permission sets with no user license, enter
User License
for the
Setting
, set the
Operator
to equals , and enter "" in the
Value
field.
d. To specify another filter condition, click Add Row. You can specify up to 25 filter condition rows.
To remove a filter condition row and clear its values, click .
4. Under Select Columns to Display, specify the settings that you want to appear as columns in the list view. You can add up to 15 columns.
a. From the Search drop-down list, select a setting type.
b. Enter part or all of a word in the setting you want to add and click Find.
Note: If the search finds more than 500 values, no results appear. Refine your search criteria to show fewer results.
159
Manage User Access to Data Permission Sets Overview
c. To add or remove columns, select one or more column names and click the Add or Remove arrow.
d. Use the Top, Up, Down, and Bottom arrows to arrange the columns in the sequence you want.
5. Click Save, or if you're cloning an existing view, rename it and click Save As.
See Also:
Editing Permission Sets from a List View
Editing Permission Sets from a List View
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To edit multiple permission sets from the list view: “Manage Users”
AND
“Customize Application”
You can change permissions in up to 200 permission sets directly from the list view, without accessing individual permission sets.
Note: Use care when editing permission sets with this method. Making mass changes may have a widespread effect on users in your organization.
1. Select or create a list view that includes the permission sets and permissions you want to edit.
2. To edit multiple permission sets, select the checkbox next to each one you want to edit. If you select permission sets on multiple pages, the selections on each page are remembered.
3. Double-click the permission you want to edit. For multiple permission sets, double-click the permission in any of the selected permission sets.
4. In the dialog box that appears, enable or disable the permission. In some cases, changing a permission may also change other permissions. For example, if “Manage Cases” and “Transfer Cases” are enabled in a permission set and you disable
“Transfer Cases,” then “Manage Cases” is also disabled. In this case, the dialog box lists the affected permissions.
5. To change multiple permission sets, select All n selected records (where n
is the number of permission sets you selected).
6. Click Save.
If you edit multiple permission sets, only those that support the permission you are changing will change. For example, if you use inline editing to enable “Modify All Data” in a permission set, but because of its user license the permission set doesn't have “Modify All Data,” the permission set won't change.
If any errors occur, the error message lists each permission set and a description of the error. Click the permission set name to open its overview page. The permission sets you've clicked appear in the error window in gray, strike-through text.
160
Manage User Access to Data Permission Sets Overview
Any changes you make are recorded in the setup audit trail.
See Also:
Working in a Permission Set's Overview Page
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Visualforce is not available in Database.com
To view permission sets:
User Permissions Needed
“View Setup and Configuration”
To delete permission sets and edit permission set properties: “Manage Users”
A permission set's overview page provides an entry point for all of the permissions in a permission set. To open a permission set overview page, click Your Name > Setup > Manage Users > Permission Sets and select the permission set you want to view.
From the permission set overview page, you can:
•
Search for permissions and settings
•
Create a permission set based on the current permission set
• If it's not assigned to any users, remove the permission set by clicking Delete
• Change the permission set label, API name, or description by clicking Edit Properties
• View a list of users who are assigned to the permission set by clicking click Assigned Users
• View or edit:
◊ Assigned apps
◊ Assigned Connected Apps
◊ Object settings (tab settings, object permissions, and field permissions)
◊ App permissions
◊ Apex class access settings
◊ Visualforce page access settings
◊ Visibility of data categories, if you've enabled them
◊ System permissions
161
Manage User Access to Data
◊ Service providers (if you've enabled Salesforce as an identity provider)
Permission Sets Overview
See Also:
About App and System Settings in Permission Sets
About App and System Settings in Permission Sets
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
In permission sets, permissions and settings are organized into app and system categories, which reflect the rights users need to administer and use system and app resources.
App Settings
Apps are sets of tabs that users can change by selecting the drop-down menu in the header. All underlying objects, components, data, and configurations remain the same, regardless of the selected app. In selecting an app, users navigate in a set of tabs that allows them to efficiently use the underlying functionality for app-specific tasks. For example, let's say you do most of your work in the sales app, which includes tabs like Accounts and Opportunities. To track a new marketing campaign, rather than adding the Campaigns tab to the sales app, you select Marketing from the app drop-down to view your campaigns and campaign members.
The Apps section of the permission sets overview page contains settings that are directly associated with the business processes the apps enable. For example, customer service agents might need to manage cases, so the “Manage Cases” permission is in the Call Center section of the App Permissions page. Some app settings aren't related to app permissions. For example, to enable the Time-Off Manager app from the AppExchange, users need access to the appropriate Apex classes and Visualforce pages, as well as the object and field permissions that allow them to create new time-off requests. The Apps section contains links to:
• Assigned apps
• Object settings, which include:
◊ Tab settings
◊ Object permissions
◊ Field permissions
• Apex class access settings
• Visualforce page access settings
System Settings
Some system functions apply to an organization and not to any single app. For example, “View Setup and Configuration” allows users to view setup and administrative settings pages. Other system functions apply to all apps. For example, the “Run
Reports” and “Manage Dashboards” permissions allow managers to create and manage reports in all apps. In some cases, such as with “Modify All Data,” a permission applies to all apps, but also includes non-app functions, like the ability to download the Data Loader.
In the permission sets overview page, the System section contains links to:
162
Manage User Access to Data Permission Sets Overview
• System permissions
• Service providers (if you've enabled Salesforce as an identity provider)
Using a Permission Set's Assigned Users Page
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To view users that are assigned to a permission set: “View Setup and Configuration”
To view all users that are assigned to a permission set, from the permission set overview page, click Assigned Users. From the assigned users page, you can:
•
•
Reset passwords for selected users
•
• View a user's detail page by clicking the name, alias, or username
• View or edit a profile by clicking the profile name
• If Google Apps ™ is enabled in your organization, export users to Google and create Google Apps accounts by clicking
Export to Google Apps
See Also:
Searching Permission Sets
Available in: Enterprise, Professional, Developer, and Database.com Editions
Visualforce is not available in Database.com
To search permission sets:
User Permissions Needed
“View Setup and Configuration”
On any of the detail pages, type at least three consecutive letters of an object, setting, or permission name in the Find
Settings... box. The search terms aren't case-sensitive. As you type, suggestions for results that match your search terms appear in a list. Click an item in the list to go to its settings page. You can search for:
Item
Assigned apps
Example
Type sales in the Find Settings box, then select Sales from the list.
163
Manage User Access to Data Permission Sets Overview
Item
Objects
Fields
Tabs
Apex class access settings
Visualforce page access settings
App and System permissions
Service providers (available only if Salesforce is enabled as an identity provider)
Example
Type an existing object’s name. For example, let’s say you have an Albums custom object, type albu , then select Albums .
Type the name of the object that contains the field. For example, let’s say your Albums object contains a Description field. To find the
Description field for albums, type albu , select
Albums
, and scroll down to
Description
under Field Permissions.
Type rep , then select Reports .
Type apex , then select
Apex Class Access
.
Type VISU , then select
Visualforce Page Access
.
Type api
, then select
API Enabled
.
Type serv , then select Service Providers .
If no results appear in a search:
• The permission, object, or setting you're searching for may not be available in the current organization.
• The item you're searching for may not be available for the user license that's associated with the current permission set.
For example, a permission set with the Standard Platform User license doesn't include the “Modify All Data” permission.
• Be sure your search terms have at least three consecutive characters that match the object, setting, or permission name.
• Be sure the search term is spelled correctly.
See Also:
Viewing and Editing Assigned Apps in Permission Sets
Assigned app settings specify the apps that users can select in the Force.com app menu.
Available in: Enterprise, Unlimited, and Developer Editions
To view assigned app settings:
To edit assigned app settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Users”
Unlike profiles, you can’t assign a default app in permission sets. You can only specify whether apps are visible.
To assign apps:
164
Manage User Access to Data Permission Sets Overview
1. Click Your Name > Setup > Manage Users > Permission Sets.
2. Select a permission set, or create one.
3. On the permission set overview page, click Assigned Apps.
4. Click Edit.
5. To assign apps, select them from the Available Apps list and click Add. To remove apps from the permission set, select them from the Enabled Apps list and click Remove.
6. Click Save.
See Also:
Assigning Permission Sets
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To view users that are assigned to a permission set: “View Setup and Configuration”
To assign permission sets: “Manage Users”
From the user detail page, you can assign permission sets or remove a permission set assignment.
1. Click
Your Name
> Setup > Manage Users > Users.
2. Select a user.
3. In the Permission Set Assignments related list, click Edit Assignments.
4. To assign a permission set, select it from the Available Permission Sets box and click Add. To remove a permission set assignment, select it from the Enabled Permission Sets box and click Remove.
Note: The Permission Set Assignments page shows permission sets with no associated license and permission sets that match the user's license. For example, if a user's license is Chatter Only, you can assign permission sets with the Chatter Only license and permission sets with no associated license to that user.
If you assign a permission set with no associated user license, all of its enabled settings and permissions must be allowed by the user’s license, or the assignment will fail.
5. Click Save.
See Also:
About User Licenses in Permission Sets
165
User Permissions and Access About Field Accessibility
F
IELD
A
CCESS
About Field Accessibility
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Page layouts are not available in Database.com
Several factors help control whether users can view and edit specific fields in Salesforce.
• Page layouts—You can set whether fields are visible, required, editable, or read only.
• Field-level security—You can further restrict users' access to fields by setting whether those fields are visible, editable, or read only. These settings override any field properties set in the page layout if the field-level security setting is more restrictive.
Note: Field-level security doesn’t prevent searching on the values in a field. When search terms match on field values protected by field-level security, the associated records are returned in the search results without the protected fields and their values.
• Permissions—Some user permissions override both page layouts and field-level security settings. For example, users with the “Edit Read Only Fields” permission can always edit read-only fields regardless of any other settings.
• Universally required fields—A custom field can be made universally required, which overrides any less-restrictive settings on page layouts or field-level security.
After setting these items, you can confirm users' access to specific fields using the
See Also:
Modifying Field Access Settings
Checking Field Accessibility for a Particular Field
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To view field accessibility:
User Permissions Needed
“View Setup and Configuration”
1. Navigate to the fields area of the appropriate object:
• For standard objects, click
Your Name
> Setup > Customize, select the appropriate object, and click Fields.
166
Manage User Access to Data About Field Accessibility
• For custom task and event fields, click
Your Name
> Setup > Customize > Activities > Activity Custom Fields.
• For standard task and event fields, click Your Name > Setup > Customize > Activities, then click Task Fields or
Event Fields.
• For custom objects, click
Your Name
> Setup > Create > Objects, and select an object.
• For Knowledge validation status picklists, click Your Name > Setup > Customize > Knowledge > Validation Statuses.
2. Select a field and click View Field Accessibility.
3. Confirm that the field access is correct for different profiles and record types.
4. Hover your mouse over any field access setting to see whether the field is required, editable, hidden, or read only based on the page layout or field-level security.
5. Click any field access setting to change the field's accessibility.
For advanced options to check field accessibility by a specific profile, record type, or field, click Your Name > Setup > Security
Controls > Field Accessibility. From this page, you need to choose a particular tab to view and then select whether you want to check access by profiles, record types, or fields.
Note: In this user interface, you can't check access for permission sets.
Field-level security doesn't prevent searching on the values in a field. To set up your organization to prevent users from searching and retrieving records that match a value in a field hidden by field-level security, contact Customer
Support.
See Also:
Modifying Field Access Settings
Available in: Enterprise, Unlimited, and Developer, and Database.com Editions
To view field accessibility:
To change field accessibility:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Users”
From the field accessibility grid, you can click any field access setting to change the field’s accessibility in the page layout or in field-level security. The Access Settings page then lets you modify the field access settings.
• In the Field-Level Security section of the page, specify the field's access level for the profile.
167
Manage User Access to Data Field-Level Security Overview
Access Level
Users can read and edit the field.
Users can read but not edit the field.
Users can’t read or edit the field.
Enabled Settings
Visible
Visible and Read-Only
None
We recommend that you use field-level security to control users’ access to fields rather than creating multiple page layouts to control field access.
• In the Page Layout section of the page, you can:
◊ Select the
Remove or change editability
radio button and then change the field access properties for the page layout. These changes will affect all profile and record type combinations that currently use this page layout.
◊ Alternatively, you can select the
Choose a different page layout
radio button to assign a different page layout to the profile and record type combination.
See Also:
Field-Level Security Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Note: Who Sees What: Field-level Security (3:58 minutes)
Watch how you can restrict access to specific fields on a profile by profile basis.
Field-level security settings let administrators restrict users’ access to view and edit specific fields in:
• Detail and edit pages
• Related lists
• List views
• Reports
• Connect Offline
• Email and mail merge templates
• Custom links
• The partner portal
• The Salesforce Customer Portal
• Synchronized data
• Imported data
168
Manage User Access to Data Field-Level Security Overview
The fields that users see on detail and edit pages are a combination of page layouts and field-level security settings. The most restrictive field access settings of the two always apply. For example, if a field is required in the page layout and read-only in the field-level security settings, the field-level security overrides the page layout and the field will be read-only for the user.
Important: Field-level security doesn’t prevent searching on the values in a field. When search terms match on field values protected by field-level security, the associated records are returned in the search results without the protected fields and their values.
You can define field-level security in any of the following ways:
•
For multiple fields on a single permission set or profile
•
For a single field on all profiles
After setting field-level security for users, you can:
• Create page layouts to organize the fields on detail and edit pages.
Tip: Use field-level security as the means to restrict users’ access to fields; then use page layouts primarily to organize detail and edit pages within tabs. This reduces the number of page layouts for you to maintain.
• Verify users’ access to fields by checking the field accessibility.
• Customize search layouts to set the fields that display in search results, in lookup dialog search results, and in the key lists on tab home pages.
Note: Roll-up summary and formula fields are always read-only on detail pages and not available on edit pages. They may also be visible to users even though they reference fields that your users cannot see. Universally required fields always display on edit pages regardless of field-level security.
The relationship group wizard allows you to create and edit relationship groups regardless of field-level security.
See Also:
Administrator tip sheet: Tips & Hints for Page Layouts and Field-Level Security
Setting Field Permissions in Permission Sets and Profiles
Field permissions specify the access level for each field in an object.
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To set field-level security:
User Permissions Needed
“Customize Application”
1. Click
Your Name
> Setup > Manage Users, then click Permission Sets or Profiles.
2. Select a permission set or profile.
3. Depending on which interface you're using, do one of the following:
169
User Permissions and Access User Permissions
• Permission sets or enhanced profile user interface—In the Find Settings... box, enter the name of the object you want and select it from the list. Click Edit, then scroll to the Field Permissions section.
• Original profile user interface—In the Field-Level Security section, click View next to the object you want to modify, and then click Edit.
4. Specify the field's access level.
5. Click Save.
Setting Field-Level Security for a Single Field on All Profiles
Available in: Enterprise, Unlimited and Developer Editions
To set field-level security:
User Permissions Needed
“Customize Application”
1. Select Your Name > Setup > Customize, click a tab or activity link, and click Fields.
2. Select the field you want to modify.
3. Click Set Field-Level Security.
4. Specify the field's access level.
5. Click Save.
P
ERMISSIONS
R
EFERENCE
User Permissions
The user permissions available vary according to which Edition you have.
The following table lists all user permissions in alphabetical order. In permission sets and the enhanced profile user interface, these permissions are listed in the App Permissions or System Permissions pages. In the original profile user interface, they are listed under Administrative Permissions and General User Permissions.
You can enable user permissions in permission sets and profiles.
Permission Name
Activate Contracts
Description
Change contract status to Activated.
Profiles
System Administrator
Contract Manager
170
Manage User Access to Data User Permissions
Permission Name
Activate Orders
Affected by Divisions
API Enabled
API Only User
Approve Contracts
Description
Change order status to Activated.
Filter search results, list views, and reports by division.
Access any Salesforce API.
Access Salesforce only through a Salesforce API.
Approve or reject a contract from a related list.
Profiles
System Administrator
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
System Administrator
None
System Administrator
Contract Manager
Author Apex
Background Report Export
Bulk API Hard Delete
Chatter Internal User
Convert Leads
Create and Customize Reports
Create Apex classes and triggers.
Run reports in the background, and export results as a CSV or Excel file on completion.
Delete records in the Bulk API without storing them in the
Recycle Bin, making them eligible for immediate deletion..
Use all Chatter features.
System Administrator
System Administrator
None
System Administrator
Standard User
Solution Manager
Marketing User
Read Only
Contract Manager
Chatter Moderator User
Chatter Free User
Convert leads into accounts, contacts, and opportunities.
Create, edit, and delete reports.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
System Administrator
Standard User
Solution Manager
Marketing User
171
Manage User Access to Data User Permissions
Permission Name
Create and Own New Chatter
Groups
Create and Share Links to
Chatter Files
Description
Create and become owner of groups in Chatter
Share a Chatter file with anyone by creating a file link and sending it via email or IM.
Profiles
Read Only
Contract Manager
System Administrator
Standard User
Chatter Moderator User
Chatter Free User
Solution Manager
Marketing User
Contract Manager
Partner User
Customer Portal User
Customer Portal Manager
Standard
System Administrator
Standard User
Solution Manager
Marketing User
Read Only
Contract Manager
System Administrator Create and Upload Change
Sets
Create AppExchange
Packages
Create Libraries
Customize Application
Data Export
Data Residency Option
Admin
Delegated Portal User
Administrator
Delete Activated Contracts
Deliver Uploaded Files and
Personal Content
Create and upload a change set.
Create packages that can be distributed through AppExchange.
Use outbound change sets.
System Administrator
Create Salesforce CRM Content libraries.
System Administrator
Customize the organization using App Setup menu options.
System Administrator
Run the data export service.
System Administrator
Install the Data residency Option (DRO) software, documentation, and patches.
None
Manage portal users who belong to the same portal account.
None
Delete contracts, regardless of their status.
Enables non-Content users to create content deliveries, and enables Salesforce CRM Content users to create content deliveries using documents in their personal libraries.
System Administrator
System Administrator
Standard User
172
Manage User Access to Data User Permissions
Permission Name
Deploy Change Sets
Download AppExchange
Packages
Drag-and-Drop Dashboard
Builder
Edit Activated Orders
Edit Case Comments
Edit Events
Edit Forecasts
Edit HTML Templates
Description Profiles
Solution Manager
Marketing User
Read Only
Contract Manager
Deploy change sets sent from another organization.
System Administrator
Install or uninstall AppExchange packages as system administrators.
System Administrator
Create, edit, and delete dashboards through the drag-and-drop dashboard builder interface.
System Administrator
Create, edit, and delete activated orders.
System Administrator
Edit their own case comments but not other user's comments.
None
Create, edit, and delete events.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
In Forecasts (Classic), create, edit, and delete forecasts.
System Administrator
This permission is not available for Customizable Forecasts and the Forecasts product released in Winter ‘12. If you migrate to Customizable Forecasts, custom profiles that have the “Edit Forecasts” permission get the “Edit Personal Quota” and “Override Forecasts” permissions.
Standard User
Solution Manager
Marketing User
Contract Manager
Create, edit, and delete HTML email templates.
Edit Opportunity Product
Sales Prices
Edit Personal Quota
Change the sales price on opportunity line items.
In Customizable Forecasts, change your individual quota amount.
System Administrator
Marketing User
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
System Administrator
Standard User
Solution Manager
Marketing User
173
Manage User Access to Data User Permissions
Permission Name
Edit Read Only Fields
Edit Self-Service Users
Edit Tasks
Export Reports
Import Leads
Description
Edit fields that are read only due to page layouts or field-level security.
System Administrator
Enable and disable contacts for Self-Service and Customer
Portal access.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
Create, edit, and delete tasks.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
Use Export Details and Printable View to export reports.
Profiles
Contract Manager
Import leads and update campaign history.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
System Administrator
Marketing User
Import Personal Contacts Import personal accounts and contacts.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
Import Solutions Import solutions for the organization.
System Administrator
Solution Manager
Insert System Field Values for
Chatter Feeds
Set the
CreatedById
or
CreatedDate
for a Chatter post or comment from the API when creating the record.
Invite Customers to Chatter Invite customers to Chatter.
System Administrator
System Administrator
Standard User
174
Manage User Access to Data User Permissions
Permission Name Description Profiles
Solution Manager
Marketing User
Read Only
Contract Manager
Chatter Moderator User
Chatter Free User
Chatter External User
Is Single Sign-On Enabled
Log in to Subscriber
Organization
Manage Analytic Snapshots
Manage Articles
Delegate username and password authentication to a corporate database instead of the Salesforce user database.
None
Log in to subscriber organizations to perform package support using the Subscriber Support Tab.
System Administrator
Create, edit, and delete analytic snapshots.
System Administrator
Create, edit, assign, publish, archive, and translate Salesforce
Knowledge articles.
None
Purchase additional licenses and features.
System Administrator
Create, edit, and delete authentication providers.
Create, edit, and delete business holidays.
System Administrator
System Administrator
Manage Billing
Manage Auth. Providers
Manage Business Hours
Holidays
Manage Call Centers
Manage Cases
Create, import, edit, and delete a call center configuration.
System Administrator
Administer case settings, including Email-to-Case and mass transfer of cases.
System Administrator
Manage Categories
Manage Connections
Manage Chatter Messages Access all users' messages sent in Chatter.
None
Manage Content Permissions Create, edit, and delete library permissions in Salesforce CRM
Content.
System Administrator
Manage Content Properties
Manage Content Types
Define and modify solution categories settings.
System Administrator
Allows a user to create and update connections and templates in Salesforce to Salesforce.
System Administrator
Create, edit, and delete custom fields in Salesforce CRM
Content.
Create, edit, and delete content types in Salesforce CRM
Content.
Create and edit custom report types.
System Administrator
System Administrator
System Administrator Manage Custom Report
Types
Manage Dashboards
Manage Data Categories
Create, edit, and delete the user's personal dashboards.
Create, edit, and delete data categories.
System Administrator
System Administrator
175
Manage User Access to Data User Permissions
Permission Name
Manage Data Integrations
Description
Monitor or abort Bulk API jobs.
Manage Dynamic Dashboards Create, edit, and delete dynamic dashboards.
Manage Email Client
Configurations
Manage Entitlements
Create, edit, and delete Outlook configurations for
Salesforce for Outlook.
Enable, create, and update entitlement management items.
Manage Force.com Flow
Manage Leads
Manage Letterheads
Create, edit, delete, and manage flows.
Change the status of multiple leads in a list view.
Create, edit, and delete letterheads for HTML emails.
Profiles
System Administrator
System Administrator
System Administrator
System Administrator
System Administrator
System Administrator
System Administrator
Marketing User
System Administrator Manage Mobile
Configurations
Manage Package Licenses
Manage Partners
Manage Public Documents
Manage Salesforce Mobile users and devices.
Manage package licenses in subscriber organizations.
Create partner accounts and partner users.
Create, edit, and delete folders for public documents.
System Administrator
System Administrator
System Administrator
Marketing User
Manage Public List Views
Manage Public Reports
Manage Public Templates
Create, edit, and delete public list views.
Create, edit, and delete public reports.
System Administrator
System Administrator
Create, edit, and delete text emails, mail merge templates, and folders for public email templates.
System Administrator
Marketing User
Manage Published Solutions Create, edit, and delete publicly accessible solutions.
System Administrator
Solution Manager
Manage Quotas In the Forecasts product first released in Winter ’12, upload quota information through the API and edit quota information.
This permission is not available for Forecasts (Classic) and
Customizable Forecasts.
System Administrator
Manage Remote Access
Manage Salesforce CRM
Content
Manage, create, edit and delete remote access applications.
Create, edit, and delete libraries and library memberships.
System Administrator
System Administrator
Manage Salesforce Knowledge Manage Salesforce Knowledge settings, and create, edit, and delete article types.
System Administrator
Manage Self-Service Portal Manage Self-Service portal settings and reports.
System Administrator
176
Manage User Access to Data User Permissions
Permission Name Description
Manage Sharing Calculation
Deferral
Suspend and resume sharing calculations.
Manage Synonyms
Manage Territories
Manage Translation
Manage Users
Mass Edits from Lists
Create, edit, and delete synonym groups.
Manage territory configurations.
Manage translated labels in the Translation Workbench.
Profiles
System Administrator
System Administrator
System Administrator
System Administrator
Create, edit, and deactivate users, and manage security settings, including profiles and roles.
System Administrator
Edit multiple records simultaneously from a list with inline editing.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
Standard Platform User
Standard Platform One App
User
Mass Email
Moderate Chatter
Send mass emails to contacts and leads.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
Deactivate Chatter Free users, assign moderator privileges to
Chatter Free users, and remove posts.
System Administrator
Chatter Moderator User
Modify All Data
Override Forecasts
Create, edit, and delete all organization data, regardless of sharing settings.
Override forecasts of direct reports.
System Administrator
Password Never Expires
Portal Super User
Prevent the user's password from expiring.
Allows Customer Portal users to view and edit all cases for their account.
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
None
None
177
Manage User Access to Data User Permissions
Permission Name
Products Show in Offline
Report Builder
Description Profiles
Make products and price books available in Connect Offline.
System Administrator
Standard User
Solution Manager
Marketing User
Read Only
Contract Manager
Create, edit, and delete reports through the drag-and-drop report builder interface.
System Administrator
Unlock user accounts that are locked, and reset user passwords.
System Administrator Reset User Passwords and
Unlock Users
Run Flows
Run Reports
Schedule Dashboards
Schedule Reports
Send Email
Send Outbound Messages
Run flows.
Run reports and dashboards.
Send outbound messages to an external Web service API.
None
System Administrator
Standard User
Solution Manager
Marketing User
Read Only
Contract Manager
System Administrator Schedule when dashboards refresh, and send email notifications that include refreshed dashboards in HTML format.
Schedule reports to run and have the results emailed to
Salesforce users.
Send email to a single contact or lead.
System Administrator
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
System Administrator
Standard User
Solution Manager
Marketing User
Read Only
Contract Manager
178
Manage User Access to Data User Permissions
Permission Name
Send Stay-in-Touch Requests
Description
Send Stay-in-Touch update emails.
Profiles
Standard Platform User
Standard Platform One App
User
System Administrator
Standard User
Solution Manager
Marketing User
Contract Manager
Show Custom Sidebar On All
Pages
Display a custom sidebar on all pages in Salesforce. If the
Show Custom Sidebar Components on All Pages user interface setting is selected, the “Show Custom Sidebar
On All Pages” permission is not available.
SubmitOrders Submit orders for approval.
None
System Administrator
Tag Manager
Transfer Cases
Transfer Leads
Transfer Record
Manage the configuration of private and public tags.
Change a case's owner.
Change a lead's owner.
Change the owner of most records.
System Administrator
System Administrator
System Administrator
System Administrator
Upload AppExchange
Packages
Use Case Feed
Use Team Reassignment
Wizards
View All Data
View All Forecasts
Upload packages to AppExchange for distribution. Use outbound change sets.
Use Case Feed to manage cases.
System Administrator
None
Mass reassign account team and opportunity team members.
System Administrator
View Content in Portals
View Data Categories
View Encrypted Data
View all organizational data, regardless of sharing settings.
In Customizable Forecasts and the Forecasts product first released in Winter ’12, view any user’s forecast, regardless of the forecast hierarchy.
System Administrator
View Salesforce CRM Content from a portal.
View the Data Categories page.
View the value of encrypted fields in plain text.
None
System Administrator
None
View My Team's Dashboards View dashboards owned by people under them in the role hierarchy.
View Setup and Configuration View the App Setup and Administrative Settings pages.
System Administrator
System Administrator
System Administrator
Standard User
Solution Manager
179
Manage User Access to Data
Permission Name Description
Object Permissions
Profiles
Marketing User
Read Only
Contract Manager
Object Permissions
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Standard Objects are not available in Database.com
Object permissions either respect or override sharing rules and settings. You can enable object permissions in permission sets and custom profiles. The following permissions specify the access that users have to objects.
Permission
Read
Create
Edit
Delete
View All
Modify All
Description
Users can only view records of this type.
Users can read and create records.
Users can read and update records.
Users can read, edit, and delete records.
Respects sharing
Respects sharing
Users can view all records associated with this object, regardless of sharing settings.
Overrides sharing
Users can read, edit, delete, transfer, and approve all records associated with this object, regardless of sharing settings.
Overrides sharing
Note: “Modify All” on documents allows access to all shared and public folders, but not the ability to edit folder properties or create new folders. To edit folder properties and create new folders, users must have the “Manage Public Documents” permission.
Respects or Overrides
Sharing?
Respects sharing
Respects sharing
See Also:
“View All” and “Modify All” Permissions Overview
180
Manage User Access to Data Object Permissions
“View All” and “Modify All” Permissions Overview
Available in: All Editions
The “View All” and “Modify All” permissions ignore sharing rules and settings, allowing administrators to quickly grant access to records associated with a given object across the organization. “View All” and “Modify All” may be preferable alternatives to the “View All Data” and “Modify All Data” permissions. Be aware of the following distinctions between the permission types.
Permissions
View All
Modify All
View All Data
Modify All Data
Used for
Delegation of object permissions
Managing all data in an organization; for example, data cleansing, deduplication, mass deletion, mass transferring, and managing record approvals
Users who Need them
Delegated administrators who need to manage records for specific objects
Administrators of an entire organization
“View All” and “Modify All” are not available for ideas, price books, article types, and products.
“View All” and “Modify All” allow for delegation of object permissions only. To delegate user administration and custom
object administration duties, define delegated administrators
.
See Also:
Comparing Security Models
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Salesforce user security is an intersection of
permissions. In some cases, such as in end-user record level access, it is advantageous to use sharing to provide access to records. In other cases, such as when delegating record administration tasks like transferring records, cleansing data, deduplicating records, mass deleting records, and delegating workflow approval processes, it is advantageous to override sharing and use permissions to provide access to records.
The “Read,” “Create,” “Edit,” and “Delete” permissions respect sharing settings, which control access to data at the record level. The “View All” and “Modify All” permissions override sharing settings for specific objects. Additionally, the “View All
Data” and “Modify All Data” permissions override sharing settings for all objects.
The following table describes the differences between the security models.
181
Manage User Access to Data Object Permissions
Target audience
Where managed
Permissions that Respect Sharing
End-users
“Read,” “Create,” “Edit,” and “Delete” object permissions;
Sharing settings
Permissions that Override Sharing
Delegated data administrators
“View All” and “Modify All”
Record access levels
Ability to transfer
Private, Read-Only, Read/Write,
Read/Write/Transfer/Full Access
“View All” and “Modify All”
Respects sharing settings, which vary by object
Available on all objects with “Modify All”
Ability to approve records, or edit and unlock records in an approval process
Ability to report on all records
None Available on all objects with “Modify All”
Available with a sharing rule that states: the records owned by the public group
“Entire Organization” are shared with a specified group, with Read-Only access
Available on all objects with “View All”
Object support Available on all objects except products, documents, solutions, ideas, notes, and attachments
Available on most objects via object permissions
Note: “View All” and “Modify
All” are not available for ideas, price books, article types, and products.
Group access levels determined by
Private record access
Ability to manually share records
Ability to manage all case comments
Roles, Roles and Subordinates, Roles and
Internal Subordinates, Roles, Internal and Portal Subordinates, Queues, Teams, and Public Groups
Profile or permission sets
Not available Available on private contacts, opportunities, and notes and attachments with “View All” and “Modify All”
Available on all objects with “Modify All” Available to the record owner and any user above the record owner in the role hierarchy
Not available Available with “Modify All” on cases
182
Sharing Field Permissions
Field Permissions
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Field permissions specify the access level for each field in an object. In permission sets and the enhanced profile user interface, the setting labels differ from those in the original profile user interface and in field-level security pages for customizing fields.
Access Level
Users can read and edit the field.
Users can read but not edit the field.
Users can't read or edit the field.
Enabled Settings in Permission Sets and Enhanced Profile User Interface
Read and Edit
Read
None
Enabled Settings in Original Profile and Field-Level Security Interfaces
Visible
Visible and Read-Only
None
See Also:
S
HARING
Overview of Sharing Settings
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Teams are not available in Database.com
In Salesforce, you can control access to data at many different levels. For example, you can control the access your users have to objects with object permissions. Within objects, you can control the access users have to fields using field-level security. To control access to data at the record level, use sharing settings.
Organization-Wide Defaults
Your organization-wide default sharing settings give you a baseline level of access for each object and enable you to extend that level of access using hierarchies or sharing rules. For example, you can set the organization-wide default for leads to Private if you only want users to view and edit the leads they own. Then, you can create lead sharing rules to extend access of leads to particular users or groups.
183
Manage User Access to Data Overview of Sharing Settings
Sharing Rules
Sharing rules represent the exceptions to your organization-wide default settings. If you have organization-wide sharing defaults of Public Read Only or Private, you can define rules that give additional users access to records they do not own. You can create sharing rules based on record owner or field values in the record.
Tip: Sometimes it’s impossible to define a consistent group of users who need access to a particular set of records.
In those situations, record owners can use manual sharing to give read and edit permissions to users who would not have access to the record any other way. Although manual sharing isn’t automated like organization-wide sharing settings, role hierarchies, or sharing rules, it gives record owners the flexibility to share particular records with users that need to see them.
Apex Managed Sharing
Apex managed sharing allows developers to programmatically share custom objects. When you use Apex managed sharing to share a custom object, only users with the “Modify All Data” permission can add or change the sharing on the custom object's record, and the sharing access is maintained across record owner changes.
Other Methods for Allowing Access to Records
In addition to sharing settings, there are a few other ways to allow multiple users access to given records:
Map category groups to roles
Control access to data categories by mapping them to user roles.
Queues
Queues help your teams manage leads, cases, service contracts, and custom objects. Once records are placed in a queue manually or through an automatic case or lead assignment rule, records remain there until they're assigned to a user or taken by one of the queue members. Any queue member or users above them in the role hierarchy can take ownership of records in a queue. Use queues to route lead, case, and custom object records to a group.
Teams
For accounts, opportunities, and cases, record owners can use teams to allow other users access to their records. A team is a group of users that work together on an account, sales opportunity, or case. Record owners can build a team for each record that they own. The record owner adds team members and specifies the level of access each team member has to the record, so that some team members can have read-only access and others can have read/write access. The record owner can also specify a role for each team member, such as “Executive Sponsor.” In account teams, team members also have access to any contacts, opportunities, and cases associated with an account.
Note: A team member may have a higher level of access to a record for other reasons, such as a role or sharing rule. In this case, the team member has the highest access level granted, regardless of the access level specified in the team.
See Also:
About Organization-Wide Sharing Defaults
184
Sharing About Organization-Wide Sharing Defaults
About Organization-Wide Sharing Defaults
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions.
Customer Portal is not available in Database.com
Administrators can use organization-wide sharing settings to define the default sharing settings for an organization.
Organization-wide sharing settings specify the default level of access to records and can be set separately for accounts (including assets and contracts), activities, contacts, campaigns, cases, leads, opportunities, calendars, price books, and custom objects.
For most objects, organization-wide sharing settings can be set to Private, Public Read Only, or Public Read/Write.
Note: Setting an object to Private makes those records visible to record owners and those above them in the role hierarchy.
In environments where the organization-wide sharing setting for an object is Private or Public Read Only, an administrator can grant users additional access to records by setting up a role hierarchy or defining sharing rules. However, sharing rules can only be used to grant additional access—they cannot be used to restrict access to records beyond what was originally specified with the organization-wide sharing defaults.
Important: If your organization uses a Customer Portal, before you enable contacts to access the portal, set the organization-wide sharing defaults on accounts, contacts, contracts, assets, and cases to Private. This ensures that by default your customers can view only their own data. You can still grant your Salesforce users Public Read/Write access by creating sharing rules in which all internal users share with all internal users.
By default, Salesforce uses hierarchies, like the role or territory hierarchy, to automatically grant access of records to users above the record owner in the hierarchy.
Use the Grant Access Using Hierarchies checkbox to disable access to records to users above the record owner in the hierarchy for custom objects in Professional, Enterprise, Unlimited, and Developer Edition. If you deselect this checkbox for a custom object, only the record owner and users granted access by the organization-wide defaults receive access to the records.
Note:
Starting in Summer ’12, custom objects can have separate organization-wide defaults for external and internal users, enabling admins to set default access for external users to Private while still allowing Public Read/Write or Public
Read Only access for internal users. See
Separate Organization-Wide Defaults for more information.
See Also:
Setting Your Organization-Wide Sharing Defaults
Sharing Default Access Settings
Default Organization-Wide Sharing Settings
185
Manage User Access to Data About Organization-Wide Sharing Defaults
Setting Your Organization-Wide Sharing Defaults
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Solutions, Service Contracts, Documents, Forecasts, Reports, and Dashboards are not available in Database.com
To set default sharing access:
User Permissions Needed
“Manage Users”
AND
“Customize Application”
Note: Who Sees What: Organization-Wide Defaults (6:36 minutes)
Watch how you can restrict access to records owned by other users.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. Click Edit in the Organization-Wide Defaults area.
3. For each object, select the default access you want to use. If you have a portal enabled with separate organization-wide defaults, see
Separate Organization-Wide Defaults
.
4. To disable automatic access using your hierarchies, deselect Grant Access Using Hierarchies for any custom object that does not have a default access of Controlled by Parent.
Note: If Grant Access Using Hierarchies is deselected, users that are higher in the role or territory hierarchy don’t receive automatic access. However, some users—such as those with the “View All” and “Modify All” object permissions and the “View All Data” and “Modify All Data” system permissions—can still access records they don’t own.
Updating the organization-wide defaults automatically runs sharing recalculation to apply any access changes to your records.
If you have a lot of data, the update can take longer. You’ll receive a notification email when the recalculation completes and you can refresh the Sharing Settings page to see your changes. To view the update status, go to
Your Name
> Setup > Security
Controls > View Setup Audit Trail.
Limitations
The organization-wide sharing default setting can’t be changed for some objects:
• Solutions are always Public Read/Write.
• Service contracts are always Private.
• The ability to view or edit a document, report, or dashboard is based on a user’s access to the folder in which it’s stored.
• Users can only view the forecasts of other users who are placed below them in the role hierarchy, unless forecast sharing is enabled.
• When a custom object is on the detail side of a master-detail relationship with a standard object, its organization-wide default is set to Controlled by Parent and it is not editable.
186
Manage User Access to Data About Organization-Wide Sharing Defaults
• The organization-wide default settings can’t be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom object Invoice__c (represented as
Invoice__share
in the code), you can’t change the object’s organization-wide sharing setting from private to public.
See Also:
Sharing Default Access Settings
About Organization-Wide Sharing Defaults
Sharing Default Access Settings
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Only Custom Objects are available in Database.com
To set default sharing access:
User Permissions Needed
“Manage Users”
You can use organization-wide defaults to set the default level of record access for the following objects.
• Accounts and their associated contracts and assets
• Activities
• Calendars
• Campaigns
• Cases
• Contacts
• Custom objects
• Leads
• Opportunities
• Price books
• Service contracts
You can assign the following access levels to accounts, campaigns, cases, contacts, contracts, leads, opportunities, users, and custom objects.
Field
Controlled by Parent
Description
A user can perform an action (such as view, edit, or delete) on a contact based on whether he or she can perform that same action on the record associated with it.
187
Manage User Access to Data About Organization-Wide Sharing Defaults
Field
Private
Public Read Only
Public Read/Write
Public Read/Write/Transfer
Public Full Access
Description
For example, if a contact is associated with the Acme account, then a user can only edit that contact if he or she can also edit the Acme account.
Only the record owner, and users above that role in the hierarchy, can view, edit, and report on those records.
For example, if Tom is the owner of an account, and he is assigned to the role of Western Sales, reporting to Carol (who is in the role of VP of Western Region Sales), then Carol can also view, edit, and report on Tom’s accounts.
All users can view and report on records but not edit them.
Only the owner, and users above that role in the hierarchy, can edit those records.
For example, Sara is the owner of ABC Corp. Sara is also in the role Western Sales, reporting to Carol, who is in the role of VP of Western Region Sales. Sara and Carol have full read/write access to ABC Corp. Tom (another Western Sales
Rep) can also view and report on ABC Corp, but cannot edit it.
All users can view, edit, and report on all records.
For example, if Tom is the owner of Trident Inc., all other users can view, edit, and report on the Trident account.
However, only Tom can alter the sharing settings or delete the Trident account.
All users can view, edit, transfer, and report on all records.
Only available for cases or leads.
For example, if Alice is the owner of ACME case number
100, all other users can view, edit, transfer ownership, and report on that case. But only Alice can delete or change the sharing on case 100.
All users can view, edit, transfer, delete, and report on all records. Only available for campaigns.
For example, if Ben is the owner of a campaign, all other users can view, edit, transfer, or delete that campaign.
Note: To use cases effectively, set the organization-wide default for Account, Contact, Contract, and Asset to Public
Read/Write.
You can assign the following access levels to personal calendars.
188
Manage User Access to Data About Organization-Wide Sharing Defaults
Field
Hide Details
Hide Details and Add Events
Show Details
Show Details and Add Events
Full Access
Description
Others can see whether the user is available at given times, but can not see any other information about the nature of events in the user’s calendar.
In addition to the sharing levels set by Hide Details, users can insert events in other users’ calendars.
Users can see detailed information about events in other users’ calendars.
In addition to the sharing levels set by Show Details, users can insert events in other users’ calendars.
Users can see detailed information about events in other users’ calendars, insert events in other users’ calendars, and edit existing events in other users’ calendars.
Note: Regardless of the organization-wide defaults that have been set for calendars, all users can invite all other users to events.
You can assign the following access levels to price books.
Field
Use
View Only
No Access
Description
All users can view price books and add them to opportunities.
Users can add any product within that price book to an opportunity.
All users can view and report on price books but only users with the “Edit” permission on opportunities or users that have been manually granted use access to the price book can add them to opportunities.
Users cannot see price books or add them to opportunities.
Use this access level in your organization-wide default if you want only selected users to access selected price books. Then, manually share the appropriate price books with the appropriate users.
You can assign the following access levels to activities.
Field
Private
Description
Only the activity owner, and users above the activity owner in the role hierarchy, can edit and delete the activity; users with read access to the record to which the activity is associated can view and report on the activity.
189
Manage User Access to Data
Field
Controlled by Parent
About Organization-Wide Sharing Defaults
Description
A user can perform an action (such as view, edit, transfer, and delete) on an activity based on whether he or she can perform that same action on the records associated with the activity.
For example, if a task is associated with the Acme account and the John Smith contact, then a user can only edit that task if he or she can also edit the Acme account and the John Smith record.
See Also:
Setting Your Organization-Wide Sharing Defaults
Default Organization-Wide Sharing Settings
Available in: Professional, Enterprise, Unlimited,Developer, and Database.com Editions.
Except for Custom Objects, all object types are not available in Database.com
The default organization-wide sharing settings are:
Object
Account
Activity
Asset
Calendar
Campaign
Case
Contact
Contract
Custom Object
Lead
Opportunity
Price Book
Default Access
Public Read/Write
Private
Public Read/Write
Hide Details and Add Events
Public Full Access
Public Read/Write/Transfer
Controlled by Parent
Public Read/Write
Public Read/Write
Public Read/Write/Transfer
Public Read Only
Use
190
Manage User Access to Data
Object
Service Contract
Default Access
Private
About Organization-Wide Sharing Defaults
See Also:
About Organization-Wide Sharing Defaults
Setting Your Organization-Wide Sharing Defaults
Separate Organization-Wide Defaults
Available in: Professional, Enterprise, Unlimited, and Developer Editions
Note: Separate Organization-Wide Defaults for External Users is available through a pilot program. For more information on enabling this feature for your organization, contact salesforce.com.
Starting in Summer ’12, custom objects can have separate organization-wide defaults for internal and external users, therefore simplifying your sharing rules configuration and improving recalculation performance.
External users include:
• Authenticated Website users
• Service Cloud Portal users
• Customer Portal users
• Partner Portal users
• Guest users
Previously, if your organization wanted Public Read Only or Public Read/Write access for internal users but Private for external users, you would have to set the default access to Private and create a sharing rule to share records with all internal users.
With separate organization-wide defaults, you can achieve similar behavior by setting Default Internal Access to Public Read
Only or Public Read/Write and Default External Access to Private. Setting the default internal access as Public Read Only or Public Read/Write also speeds up performance for reports, list views, searches, and API queries.
Enable separate organization-wide defaults by clicking Your Name > Setup > Security Controls > Sharing Settings and clicking the Enable External Sharing Model button.
Note: The Default External Access level must be more restrictive or equal to the Default Internal Access level.
For example, you can have a custom object with Default External Access set to Private and Default Internal Access set to Public Read Only .
If you want to disable separate organization-wide defaults, each of your custom objects must be set to the same Default
External Access and Default Internal Access levels before you can disable this feature. This button may be grayed out if at least one of your custom objects has different internal and external access levels. If you have soft-deleted a custom object with different external and internal defaults, you have to undelete the custom object to change the defaults to the same levels or hard-delete the custom object before you can disable the feature.
191
Sharing Controlling Access Using Hierarchies
For details, see the Separate Organization-Wide Defaults for External Users tip sheet.
Controlling Access Using Hierarchies
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Territories are not available in Database.com
To set default sharing access:
User Permissions Needed
“Manage Users”
AND
“Customize Application”
To change the Grant Access Using Hierarchies option:
“Manage Users”
AND
“Customize Application”
Beyond setting the organization-wide sharing defaults for each object, your organization can specify whether users have access to the data owned by or shared with their subordinates in the hierarchy. For example, the role hierarchy automatically grants record access to users above the record owner in the hierarchy. The
Grant Access Using Hierarchies
option in the organization-wide defaults determines the access users have to records that they do not own, including records they do not have sharing access to but someone below them in the hierarchy does. By default, the
Grant Access Using Hierarchies option is enabled for all objects, and it can only be changed for custom objects.
To control sharing access using hierarchies for any custom object, click
Your Name
> Setup > Security Controls > Sharing
Settings and Edit in the Organization Wide Defaults section. Deselect Grant Access Using Hierarchies if you want to prevent users from gaining automatic access to data owned by or shared with their subordinates in the hierarchies.
Implementation Notes
• Regardless of your organization's sharing settings, users can gain access to records they do not own through other means such as user permissions like “View All Data,” sharing rules, or manual sharing of individual records.
• The
Grant Access Using Hierarchies
option is always selected on standard objects and is not editable.
• If you disable the Grant Access Using Hierarchies option, sharing with a role or territory and subordinates only shares with the users directly associated with the role or territory selected. Users in roles or territories above them in the hierarchies will not gain access.
• If your organization disables the
Grant Access Using Hierarchies
option, activities associated with a custom object are still visible to users above the activity’s assignee in the role hierarchy.
• If a master-detail relationship is broken by deleting the relationship, the former detail custom object's default setting is automatically reverted to Public Read/Write and
Grant Access Using Hierarchies
is selected by default.
• The Grant Access Using Hierarchies option affects which users gain access to data when something is shared with public groups, personal groups, queues, roles, or territories. For example, the View All Users option displays group members and people above them in the hierarchies when a record is shared with them using a sharing rule or manual sharing and the
Grant Access Using Hierarchies
option is selected. When the
Grant Access Using
192
Manage User Access to Data Controlling Access Using Hierarchies
Hierarchies
option is not selected, some users in these groups no longer have access. The following list covers the access reasons that depend on the Grant Access Using Hierarchies option.
These reasons always gain access:
Group Member
Queue Member
Role Member
Member of Subordinate Role
Territory Member
Member of Subordinate Territory
These reasons only gain access when using hierarchies:
Manager of Group Member
Manager of Queue Member
Manager of Role
Manager of Territory
User Role Manager of Territory
Best Practices
• When you deselect Grant Access Using Hierarchies , notify users of the changes in report results that they can expect due to losing visibility of their subordinates' data. For example, selecting My team's... in the View drop-down list returns records owned by the user; it will not include records owned by their subordinates. To be included in this type of report view, records from subordinates must be explicitly shared with that user by some other means such as a sharing rule or a manual share. So, if no records are shared with you manually, the My... and My team's... options in the View drop-down list return the same results. However, choosing the Activities with... any custom object report type when creating a custom report returns activities assigned to you as well as your subordinates in the role hierarchy.
See Also:
193
Sharing Overview of Roles
Overview of Roles
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To create, edit, and delete roles:
To assign users to roles:
User Permissions Needed
“Manage Users”
“Manage Users”
Note: Who Sees What: Record Access via the Role Hierarchy (7:29 minutes)
Watch how you can open up access to records using the role hierarchy if your organization-wide defaults are more restrictive than Public Read/Write.
Depending on your sharing settings, roles can control the level of visibility that users have into your organization’s data. Users at any given role level can view, edit, and report on all data owned by or shared with users below them in the hierarchy, unless your organization’s sharing model for an object specifies otherwise. Specifically, in the Organization-Wide Defaults related list, if the Grant Access Using Hierarchies option is disabled for a custom object, only the record owner and users granted access by the organization-wide defaults receive access to the object's records.
Working with Roles
To view and manage your organization's roles, click
Your Name
> Setup > Manage Users > Roles.
• Choose one of the following list view options:
Show in tree view
See a visual representation of the parent-child relationships between your roles. Click Expand All to see all roles, or
Collapse All to see only top-level roles. To expand or collapse an individual node, click the plus (+) or minus (-) icon.
Show in sorted list view
See a list that you can sort alphabetically by role name, parent role (Reports to), or report display name. If your organization has a large number of roles, use this view for easy navigation and filtering.
To show a filtered list of items, select a predefined list from the
View
drop-down list, or click Create New View to define your own custom views. To edit or delete any view you created, select it from the View drop-down list and click Edit.
Show in list view
See a list of roles and their children, grouped alphabetically by the name of the top-level role. The columns are not sortable. This view is not available for hierarchies with more than 1,000 roles.
• To create a role, click New Role or Add Role, depending whether you are viewing the list view or tree view of roles, then edit the role fields as needed. You can create up to 500 roles for your organization.
•
To edit a role, click Edit next to a role name, then update the role fields as needed.
• To delete a role, click Delete next to the role name.
•
To assign other users to a role , click Assign next to the role name.
194
Manage User Access to Data Overview of Roles
• To view detailed information about a role, click a role name. If you are a Salesforce Knowledge user, you can modify category visibility settings on the role detail page.
Tip: To simplify user management in organizations with large numbers of users, enable delegated administrators to manage users in specified roles and all subordinate roles.
Notes on Roles
• Every user must be assigned to a role, or their data will not display in opportunity reports, forecast roll-ups, and other displays based on roles. If your organization uses territory management, forecasts are based on the territory hierarchy rather than the role hierarchy.
• All users that require visibility to the entire organization should belong to the highest level in the hierarchy.
• It is not necessary to create individual roles for each title at your company, rather you want to define a hierarchy of roles to control access of information entered by users in lower level roles.
• When you change a user’s role, any relevant sharing rules are evaluated to add or remove access as necessary.
• When an account owner is not assigned a role, the sharing access for related contacts is Read/Write, provided the organization-wide default for contacts is not Controlled by Parent. Sharing access on related opportunities and cases is
No Access.
Assigning Users to Roles
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To assign users to roles:
User Permissions Needed
“Manage Users”
To quickly assign users to a particular role:
1. Click Your Name > Setup > Manage Users > Roles.
2. Click Assign next to the name of the desired role.
Note: You can also access this page by clicking Assign Users to Role from the Users in Role related list. Large organizations should consider assigning roles via the SOAP API for efficiency.
3. Make a selection from the drop-down list to show the available users.
4. Select a user on the left, and click Add to assign the user to this role.
Note: Removing a user from the Selected Users list deletes the role assignment for that user.
See Also:
195
Manage User Access to Data Overview of Roles
Role Fields
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To create or edit roles:
User Permissions Needed
“Manage Users”
The following fields (listed in alphabetical order) make up a role entry. Some of these fields may not be visible or editable depending on your organization's permissions and sharing settings.
Field
Case Access
Contact Access
Label
Modified By
Opportunity Access
Partner Role
Role Name
Role Name as displayed on reports
Description
Specifies whether users can access other users’ cases that are associated with accounts the users own. This field is not visible if your organization’s sharing model for cases is Public
Read/Write.
Specifies whether users can access other users’ contacts that are associated with accounts the users own. This field is not visible if your organization’s sharing model for contacts is
Public Read/Write or Controlled by Parent.
The name used to refer to the role or title of position in any user interface pages, for example, Western Sales VP.
The name of the user who last modified this role's details, and the date and time that the role was modified.
Specifies whether users can access other users’ opportunities that are associated with accounts the users own. This field is not visible if your organization’s sharing model for opportunities is Public Read/Write.
Indicates whether this role is associated with a partner account.
This field is available only when a Customer Portal or partner portal is enabled for the organization.
If this checkbox is selected, you cannot edit the role. The default number of roles in portal accounts is three. You can reduce the number of roles or add roles to a maximum of three.
The unique name used by the API and managed packages.
The name must begin with a letter and use only alphanumeric characters and underscores. The name cannot end with an underscore or have two consecutive underscores.
A role name that appears in reports. When editing a role, if the
Role Name
is long, you can enter an abbreviated name in this field.
196
Sharing
Field
Sharing Groups
This role reports to
About Groups
Description
These groups are automatically created and maintained. The
Role group contains all users in this role plus all users in roles above this role. The Role and Subordinates group contains all users in this role plus all users in roles above and below this role in the hierarchy. The Role and Internal Subordinates group (available if Customer Portals or partner portals are enabled for your organization) contains all users in this role plus all users in roles above and below this role, excluding
Customer Portal and partner portal users.
The role above this role in the hierarchy.
See Also:
About Groups
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Groups are sets of users. They can contain individual users, other groups, the users in a particular role or territory, or the users in a particular role or territory plus all of the users below that role or territory in the hierarchy.
There are two types of groups:
• Public groups—Only administrators can create public groups. They can be used by everyone in the organization.
• Personal groups—Each user can create groups for their personal use.
You can use groups in the following ways:
• To set up default sharing access via a sharing rule
• To share your records with other users
• To specify that you want to synchronize contacts owned by others users
• To add multiple users to a Salesforce CRM Content library
• To assign users to specific actions in Salesforce Knowledge
See Also:
197
Manage User Access to Data About Groups
Group Member Types
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
The member types that are available vary depending on your Edition.
To create or edit a public group:
To create or edit another user’s personal group:
User Permissions Needed
“Manage Users”
“Manage Users”
When you create or edit a group, you can select the following types of members from the
Search
drop-down list. Depending on your organization settings, some types may not be available.
Member Type
Customer Portal Users
Partner Users
Personal Groups
Portal Roles
Description
All of your Customer Portal users. This is only available when a Customer Portal is enabled for your organization.
All of your partner users. This is only available when a partner portal is enabled for your organization.
All of your own groups. This is only available when creating other personal groups.
All roles defined for your organization’s partner portal or
Customer Portal. This includes all users in the specified portal role, except high-volume portal users.
Note: A portal role name includes the name of the account that it’s associated with, except for person accounts, which include the user
.
Portal Roles and Subordinates
Public Groups
Roles
All roles defined for your organization’s partner portal or
Customer Portal. This includes all of the users in the specified portal role plus all of the users below that role in the portal role hierarchy, except for high-volume portal users.
Note: A portal role name includes the name of the account that it’s associated with, except for person accounts, which include the user
.
All public groups defined by your administrator.
All roles defined for your organization. Adding a role to a group includes all of the users in that role, but does not include portal roles.
198
Manage User Access to Data
Member Type
Roles and Internal Subordinates
Roles and Subordinates
Roles, Internal and Portal Subordinates
Users
About Groups
Description
Adding a role and its subordinate roles includes all of the users in that role plus all of the users in roles below that role. This doesn't include portal roles or users.
Adding a role and its subordinate roles includes all of the users in that role plus all of the users in roles below that role. This is only available when no portals are enabled for your organization.
Adding a role and its subordinate roles includes all of the users in that role plus all of the users in roles below that role. This is only available when a partner or Customer Portal is enabled for your organization. This includes portal users.
All users in your organization. This doesn't include portal users.
See Also:
Creating and Editing Groups
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To create or edit a public group:
To create or edit another user’s personal group:
User Permissions Needed
“Manage Users”
“Manage Users”
Only administrators can create and edit public groups, but anyone can create and edit their own personal groups.
To create or edit a group:
1. Click the control that matches the type of group:
• For personal groups, click
Your Username
> Setup > My Personal Information > My Groups. The Personal Groups related list is also available on the user detail page.
• For public groups, click
Your Username
> Setup > Manage Users > Public Groups.
2. Click New, or click Edit next to the group you want to edit.
3. Enter the following:
Field Description
199
Manage User Access to Data About Groups
Label
Group Name
(public groups only)
The name used to refer to the group in any user interface pages.
The unique name used by the API and managed packages. The name must begin with a letter and use only alphanumeric characters and underscores. The name cannot end with an underscore or have two consecutive underscores.
Grant Access Using Hierarchies
(public groups only)
Select Grant Access Using Hierarchies to allow automatic access to records using your role or territory hierarchies. When selected, any records shared with users in this group are also shared with users higher in the hierarchy.
Note: If Grant Access Using Hierarchies is deselected, users that are higher in the role or territory hierarchy don’t receive automatic access. However, some users—such as those with the “View All” and “Modify All” object permissions and the
“View All Data” and “Modify All Data” system permissions—can still access records they don’t own.
Search
Selected Members
From the Search drop-down list, select the type of member to add. If you don’t see the member you want to add, enter keywords in the search box and click Find.
Note: For account owners to see child records owned by high-volume portal users, they must be members of any portal share groups with access to the portal users' data.
Select members from the Available Members box, and click Add to add them to the group.
4. Click Save.
Note: When you edit groups, roles, and territories, sharing rules are usually automatically reevaluated to add or remove access as needed. If these changes affect too many records at once, a message appears warning that the sharing rules won't be automatically reevaluated, and you must manually recalculate them.
See Also:
200
Sharing Sharing Rules Overview
Viewing Group Lists
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To edit a public group:
User Permissions Needed
“Manage Users”
1. Click the control that matches the type of group:
• For personal groups, click
Your Name
> Setup > My Personal Information > My Groups.
• For public groups, click
Your Name
> Setup > Manage Users > Public Groups.
2. Click the name of a group in the Groups related list to display the group's detail page.
• To edit the group membership, click Edit.
• To delete the group, click Delete.
• To view group members, see the Group Members related list.
• To view group members and users who have equivalent access because they are higher in the role or territory hierarchy, click View All Users to display the All Users in Group related list. Click View Group Members to return to the Group
Members related list.
See Also:
Sharing Rules Overview
Account and contact sharing rules are available in: Professional, Enterprise, Unlimited, and Developer Editions
Account territory, case, lead, opportunity, and custom object sharing rules are available in: Enterprise, Unlimited, and
Developer Editions
Campaign sharing rules are available in Professional Edition for an additional cost, and Enterprise, Unlimited, and
Developer Editions
Only custom object sharing rules are available in Database.com
Note: Who Sees What: Record Access via Sharing Rules (4:27 minutes)
Watch how you can grant access to records using sharing rules.
201
Manage User Access to Data Sharing Rules Overview
With sharing rules, you can make automatic exceptions to your organization-wide sharing settings for defined sets of users.
For example, use sharing rules to extend sharing access to users in public groups, roles, or territories. Sharing rules can never be stricter than your organization-wide default settings. They simply allow greater access for particular users.
You can create the following types of sharing rules.
Type
Account territory sharing rules
Based on
Account owner or other criteria, including account record types or field values
Territory assignment
Set Default Sharing Access for
Accounts and their associated contracts, assets, opportunities, cases, and optionally, contacts
Accounts and their associated cases, contacts, contracts, and opportunities
Campaign owner or other criteria, including campaign record types or field values
Individual campaign records
Case owner or other criteria, including case record types or field values
Individual cases and associated accounts
Contact owner or other criteria, including contact record types or field values
Individual contacts and associated accounts
Custom object owner or other criteria, including custom object record types or field values
Individual custom object records
Individual leads Lead owner or other criteria, including lead record types or field values
Opportunity owner or other criteria, including opportunity record types or field values
Individual opportunities and their associated accounts
Note:
• You can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
• Developers can use Apex to programmatically share custom objects (based on record owners, but not other criteria).
This does not apply to User Sharing.
See Also:
Criteria-Based Sharing Rules Overview
202
Manage User Access to Data Sharing Rules Overview
Criteria-Based Sharing Rules Overview
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Accounts, Opportunities, Cases, and Contacts are not available in Database.com
Criteria-based sharing rules determine whom to share records with based on field values in records. For example, let’s say you use a custom object for job applications, with a custom picklist field named “Department.” You can create a criteria-based sharing rule that shares all job applications in which the Department field is set to “IT” with all IT managers in your organization.
Note:
• Although criteria-based sharing rules are based on values in the records and not the record owners, a role or territory hierarchy still allows users higher in the hierarchy to access the records.
• You can’t use Apex to create criteria-based sharing rules. Also, criteria-based sharing cannot be tested using Apex.
• You can use the Metadata API to create criteria-based sharing rules starting in API version 24.0.
• You can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
You can create criteria-based sharing rules for accounts, opportunities, cases, contacts, leads, campaigns, and custom objects.
You can create up to 50 criteria-based sharing rules per object.
• Record types
• These field types:
◊ Auto Number
◊ Checkbox
◊ Date
◊ Date/Time
◊ Number
◊ Percent
◊ Phone
◊ Picklist
◊ Text
◊ Text Area
◊ URL
◊ Lookup Relationship (to user ID or queue ID)
203
Manage User Access to Data Sharing Rules Overview
Note: Text and Text Area are case-sensitive. For example, a criteria-based sharing rule that specifies “Manager” in a text field won’t share records with “manager” in the field. To create a rule with several common cases of a word, enter each value separated by a comma.
See Also:
Sharing Rule Categories
Account and contact sharing rules are available in: Professional, Enterprise, Unlimited, and Developer Editions
Account territory, case, lead, and opportunity, sharing rules are available in: Enterprise, Unlimited, and Developer Editions
Campaign sharing rules are available in Professional Edition for an additional cost, and Enterprise, Unlimited, and
Developer Editions
Custom object sharing rules are available in: Enterprise, Unlimited, Developer, and Database.com Editions.
Partner Portals and Customer Portals are not available in Database.com
When you define a sharing rule, you can choose from the following categories in the owned by members of
and
Share with drop-down lists. Depending on the type of sharing rule and the features enabled for your organization, some categories may not appear.
Note: You can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
Category
Queues
Public Groups
Roles
Portal Roles
Description
All records owned by the queue, excluding records owned by individual members of the queue. Available only in the owned by members of list.
All public groups defined by your administrator.
If a partner portal or Customer Portal is enabled for your organization, the All Partner
Users or All Customer Portal Users group displays. These groups includes all users allowed to access your partner portal or Customer Portal, except for high-volume portal users.
All roles defined for your organization. This includes all of the users in the specified role.
All roles defined for your organization’s partner portal or Customer Portal. This includes all users in the specified portal role, except high-volume portal users.
A portal role name includes the name of the account that it’s associated with, except for person accounts, which include the user
.
204
Manage User Access to Data Sharing Rules Overview
Category
Roles and Subordinates
Portal Roles and Subordinates
Roles and Internal Subordinates
Roles, Internal and Portal
Subordinates
Territories
Territories and Subordinates
Description
All roles defined for your organization. This includes all of the users in the specified role plus all of the users in roles below that role, including partner portal and Customer Portal roles that contain users with a portal license type.
Portal roles are only included in this category if a partner portal or Customer Portal is enabled for your organization.
The Roles, Internal and Portal Subordinates data set category is only available in your organization after you create at least one role in the role hierarchy.
All roles defined for your organization’s partner portal or Customer Portal. This includes all of the users in the specified portal role plus all of the users below that role in the portal role hierarchy, except for high-volume portal users.
A portal role name includes the name of the account that it’s associated with, except for person accounts, which include the user
.
All roles defined for your organization. This includes all of the users in the specified role plus all of the users in roles below that role, excluding partner portal and Customer Portal roles.
This category only displays if a partner portal or Salesforce Customer Portal is enabled for your organization.
The Roles and Internal Subordinates data set category is only available in your organization after you create at least one role in the role hierarchy and enable a portal.
All roles defined for your organization. This includes all of the users in the specified role plus all of the users in roles below that role, including partner portal and Customer Portal roles.
This category only displays if a partner portal or Salesforce Customer Portal is enabled for your organization.
The Roles and Internal Subordinates data set category is only available in your organization after you create at least one role in the role hierarchy and enable a portal.
All territories defined for your organization.
All territories defined for your organization. This includes the specified territory plus all territories below it.
See Also:
205
Manage User Access to Data Sharing Rules Overview
Creating Lead Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Lead sharing rules are based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 lead sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Lead Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
• Based on record owner —In the owned by members of line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
9. Click Save.
See Also:
206
Manage User Access to Data Sharing Rules Overview
Editing Lead Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Lead Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
See Also:
207
Manage User Access to Data Sharing Rules Overview
Creating Account Sharing Rules
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Account sharing rules can be based on the record owner or on other criteria, including record type and certain field values.
You can define up to 300 account sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Account Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
• Based on record owner —In the owned by members of line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select a setting for Default Account, Contract and Asset Access .
9. In the remaining fields, select the access settings for the records associated with the shared accounts.
Access Setting
Private
(available for associated contacts, opportunities, and cases only)
Read Only
Read/Write
Description
Users can’t view or update records, unless access is granted outside of this sharing rule.
Users can view, but not update, records.
Users can view and update records.
208
Manage User Access to Data Sharing Rules Overview
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
10. Click Save.
See Also:
Editing Account Sharing Rules
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click Your Name > Setup > Security Controls > Sharing Settings.
2. In the Account Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select a setting for Default Account, Contract and Asset Access .
6. In the remaining fields, select the access settings for the records associated with the shared accounts.
Access Setting
Private
(available for associated contacts, opportunities, and cases only)
Read Only
Read/Write
Description
Users can’t view or update records, unless access is granted outside of this sharing rule.
Users can view, but not update, records.
Users can view and update records.
209
Manage User Access to Data Sharing Rules Overview
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
7. Click Save.
See Also:
Creating Account Territory Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Account territory sharing rules are based on territory assignment. You can define up to 300 account territory sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Account Territory Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. In the Accounts in Territory line, select Territories or Territories and Subordinates from the first drop-down list and a territory from the second drop-down list.
6. In the Share with line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
7. Select a setting for
Default Account, Contract and Asset Access
.
8. In the remaining fields, select the access setting for the records associated with the shared account territories.
Access Setting
Private
(available for associated contacts, opportunities, and cases only)
Read Only
Read/Write
Description
Users can’t view or update records, unless access is granted outside of this sharing rule.
Users can view, but not update, records.
Users can view and update records.
210
Manage User Access to Data Sharing Rules Overview
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
9. Click Save.
See Also:
Editing Account Territory Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For account territory sharing rules, you can edit the sharing access settings, but no other settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Account Territory Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. Select the sharing access setting for users.
Access Setting
Private
(available for associated contacts, opportunities, and cases only)
Read Only
Read/Write
Description
Users can’t view or update records, unless access is granted outside of this sharing rule.
Users can view, but not update, records.
Users can view and update records.
Note:
Contact Access
is not available when the organization-wide default for contacts is set to Controlled by Parent.
211
Manage User Access to Data Sharing Rules Overview
5. Click Save.
See Also:
Creating Contact Sharing Rules
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Contact sharing rules can be based on the record owner or on other criteria, including record type and certain field values.
You can define up to 300 contact sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click
Your Name
> Setup > Security Controls > Sharing Settings.
3. In the Contact Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
•
Based on record owner
—In the owned by members of
line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
212
Manage User Access to Data Sharing Rules Overview
9. Click Save.
See Also:
Editing Contact Sharing Rules
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Contact Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
See Also:
213
Manage User Access to Data Sharing Rules Overview
Creating Opportunity Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Opportunity sharing rules can be based on the record owner or on other criteria, including record type and certain field values.
You can define up to 300 opportunity sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Opportunity Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
• Based on record owner —In the owned by members of line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users. For owner-based rules or criteria-based rules with ownership as criteria, the
Opportunity Access
level applies to opportunities owned by the group, role, or territory members, regardless of the associated account.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
214
Manage User Access to Data Sharing Rules Overview
9. Click Save.
See Also:
Editing Opportunity Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Opportunity Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users. For owner-based rules or criteria-based rules with ownership as criteria, the
Opportunity Access level applies to opportunities owned by the group, role, or territory members, regardless of the associated account.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
See Also:
215
Manage User Access to Data Sharing Rules Overview
Creating Case Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Case sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 case sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Case Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
• Based on record owner —In the owned by members of line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
9. Click Save.
See Also:
216
Manage User Access to Data Sharing Rules Overview
Editing Case Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Case Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
See Also:
217
Manage User Access to Data Sharing Rules Overview
Creating Campaign Sharing Rules
Available in: Professional Edition for an additional cost, and Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Campaign sharing rules can be based on the record owner or on other criteria, including record type and certain field values.
You can define up to 300 campaign sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Campaign Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
• Based on record owner —In the owned by members of line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Full Access
Description
Users can view, but not update, records.
Users can view and update records.
Any user in the selected group, role, or territory can view, edit, transfer, delete, and share the record, just like the record’s owner.
With a Full Access sharing rule, users can also view, edit, delete, and close activities associated with the record if the organization-wide sharing setting for activities is Controlled by Parent.
218
Manage User Access to Data Sharing Rules Overview
9. Click Save.
See Also:
Editing Campaign Sharing Rules
Available in: Professional Edition for an additional cost, and Enterprise, Unlimited, and Developer Editions
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Campaign Sharing Rules related list, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Full Access
Description
Users can view, but not update, records.
Users can view and update records.
Any user in the selected group, role, or territory can view, edit, transfer, delete, and share the record, just like the record’s owner.
With a Full Access sharing rule, users can also view, edit, delete, and close activities associated with the record if the organization-wide sharing setting for activities is Controlled by Parent.
219
Manage User Access to Data Sharing Rules Overview
6. Click Save.
See Also:
Creating Quick Text Sharing Rules
Available in: Enterprise, Unlimited, and Developer Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
To create Quick Text sharing rules:
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Quick Text Sharing Rules related list, click New.
4. Enter the Label Name and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule
Name is a unique name used by the API and managed packages.
5. In the
Quick Text: owned by members of
line, specify the users who own the data by selecting a category from the first drop-down list and a set of users from the second drop-down list.
6. In the Share with line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
7. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
8. Click Save.
See Also:
220
Manage User Access to Data Sharing Rules Overview
Creating Custom Object Sharing Rules
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To create sharing rules:
User Permissions Needed
“Manage Users”
Custom object sharing rules can be based on the record owner or on other criteria, including record type and certain field values. You can define up to 300 custom object sharing rules, including up to 50 criteria-based sharing rules.
1. If you plan to include public groups in your sharing rule, confirm that the appropriate groups have been created.
2. Click Your Name > Setup > Security Controls > Sharing Settings.
3. In the Sharing Rules related list for the custom object, click New.
4. Enter the Label and Rule Name. The Label is the sharing rule label as it appears on the user interface. The Rule Name is a unique name used by the API and managed packages.
5. Select a rule type.
6. Depending on the rule type you selected, do the following:
• Based on record owner —In the owned by members of line, specify the users whose records will be shared: select a category from the first drop-down list and a set of users from the second drop-down list (or lookup field, if your organization has over 200 queues, groups, roles, or territories).
•
Based on criteria
—Specify the Field, Operator, and Value criteria that records must match to be included in the sharing rule. The fields available depend on the object selected, and the value is always a literal number or string. Click
Add Filter Logic... to change the default AND relationship between each filter.
Note: To use a field that’s not supported by criteria-based sharing rules, you can create a workflow rule or
Apex trigger to copy the value of the field into a text or numeric field, and use that field as the criterion.
7. In the
Share with
line, specify the users who should have access to the data: select a category from the first drop-down list and a set of users from the second drop-down list or lookup field.
8. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
9. Click Save.
See Also:
221
Manage User Access to Data Sharing Rules Overview
Editing Custom Object Sharing Rules
Available in: Enterprise,, Unlimited, Developer, and Database.com Editions.
To edit sharing rules:
User Permissions Needed
“Manage Users”
For sharing rules that are based on owner, you can edit only the sharing access settings. For sharing rules that are based on other criteria, you can edit the criteria and sharing access settings.
1. Click
Your Name
> Setup > Security Controls > Sharing Settings.
2. In the Sharing Rules related list for the custom object, click Edit next to the rule you want to change.
3. Change the Label and Rule Name if desired.
4. If you selected a rule that's based on owner, skip to the next step.
If you selected a rule that's based on criteria, specify the criteria that records must match to be included in the sharing rule.
The fields available depend on the object selected, and the value must be a literal number or string. Click Add Filter
Logic... to change the default AND relationship between each filter.
5. Select the sharing access setting for users.
Access Setting
Read Only
Read/Write
Description
Users can view, but not update, records.
Users can view and update records.
6. Click Save.
See Also:
222
Manage User Access to Data Sharing Rules Overview
Sharing Rule Considerations
Account and contact sharing rules are available in: Professional, Enterprise, Unlimited, and Developer Editions
Account territory, case, lead, opportunity, and custom object sharing rules are available in: Enterprise, Unlimited, and
Developer Editions
Campaign sharing rules are available in Professional Edition for an additional cost, and Enterprise, Unlimited, and
Developer Editions
Only custom object sharing rules are available in Database.com
Sharing rules allow you to selectively grant data access to defined sets of users. Review the following notes before using sharing rules:
Granting Access
• You can use sharing rules to grant wider access to data. You cannot restrict access below your organization-wide default levels.
• If multiple sharing rules give a user different levels of access to a record, the user gets the most permissive access level.
• Sharing rules automatically grant additional access to related records. For example, opportunity sharing rules give role or group members access to the account associated with the shared opportunity if they do not already have it.
Likewise, contact and case sharing rules provide the role or group members with access to the associated account as well.
• Users in the role hierarchy are automatically granted the same access that users below them in the hierarchy have from a sharing rule, provided that the object is a standard object or the Grant Access Using Hierarchies option is selected.
• Regardless of sharing rules, users can, at a minimum, view the accounts in their territories. Also, users can be granted access to view and edit the contacts, opportunities, and cases associated with their territories’ accounts.
Updating
• Once a sharing rule has been saved, you can’t change the Share with field settings when you edit the sharing rule.
• Sharing rules apply to all new and existing records that meet the definition of the source data set.
• Sharing rules apply to both active and inactive users.
• When you change the access levels for a sharing rule, all existing records are automatically updated to reflect the new access levels.
• When you delete a sharing rule, the sharing access created by that rule is automatically removed.
• When you modify which users are in a group, role, or territory, the sharing rules are reevaluated to add or remove access as necessary.
• When you transfer records from one user to another, the sharing rules are reevaluated to add or remove access to the transferred records as necessary.
• Making changes to sharing rules may require changing a large number of records at once. To process these changes efficiently, your request may be queued and you may receive an email notification when the process has completed.
• Lead sharing rules do not automatically grant access to lead information after leads are converted into account, contact, and opportunity records.
223
Sharing Sharing Considerations
Portal Users
• You can create rules to share records between most types of Customer Portal users and Salesforce users. Similarly, you can create sharing rules between Customer Portal users from different accounts as long as they have the Customer
Portal Manager user license. However, you can’t include high-volume portal users in sharing rules because they don’t have roles and can’t be in public groups.
• You can easily convert sharing rules that include Roles, Internal and Portal Subordinates to include Roles and Internal
Subordinates instead by using the Convert Portal User Access wizard. Furthermore, you can use this wizard to convert any publicly accessible report, dashboard, and document folders to folders that are accessible by all users except for portal users.
See Also:
Sharing Considerations
Your organization’s sharing model gives users access to records they do not own. The sharing model is a complex relationship between role hierarchies, user permissions, sharing rules, and exceptions for certain situations. Review the following notes before setting your sharing model:
Exceptions to Role Hierarchy-based Sharing
Users can always view and edit all data owned by or shared with users below them in the role hierarchy. Exceptions to this include:
• An option on your organization-wide default allows you to ignore the hierarchies when determining access to data.
• Contacts that are not linked to an account are always private. Only the owner of the contact and administrators can view it. Contact sharing rules do not apply to private contacts.
• Notes and attachments marked as private via the
Private
checkbox are accessible only to the person who attached them and administrators.
• Events marked as private via the
Private
checkbox are accessible only by the event owner. Other users cannot see the event details when viewing the event owner’s calendar. However, users with the “View All Data” or “Modify All Data” permission can see private event details in reports and searches, or when viewing other users’ calendars.
• Users above a record owner in the role hierarchy can only view or edit the record owner’s records if they have the “Read” or “Edit” object permission for the type of record
Deleting Records
• The ability to delete individual records is controlled by administrators, the record owner, users in a role hierarchy above the record owner, and any user that has been granted “Full Access.”
• If the sharing model is set to Public Read/Write/Transfer for cases or leads or Public Full Access for campaigns, any user can delete those types of records.
Adding Related Items to a Record
• You must have “Read/Write” access to a record to be able to add notes or attachments to the record.
• You must have at least “Read” access to a record to be able to add activities or other associated records to it.
224
Manage User Access to Data Sharing Considerations
Adding or Removing Sharing Access Manually
• The ability to manually extend the sharing access of individual records is controlled by administrators, the record owner, users in a role hierarchy above the record owner, and any user that has been granted “Full Access.”
• Changing your sharing model deletes any manual shares your users have created.
User Permissions and Object-Level Permissions
While your sharing model controls visibility to records, user permissions and object-level permissions control what users can do to those records.
• Regardless of the sharing settings, users must have the appropriate object-level permissions. For example, if you share an account, those users can only see the account if they have the “Read” permission on accounts. Likewise, users who have the “Edit” permission on contacts may still not be able to edit contacts they do not own if they are working in a Private sharing model.
• Administrators, and users with the “View All Data” or “Modify All Data” permissions, have access to view or edit all data.
Account Sharing
• To restrict users’ access to records they do not own that are associated with accounts they do own, set the appropriate access level on the role. For example, you can restrict a user’s access to opportunities they do not own yet are associated with accounts they do own using the
Opportunity Access
option.
• Regardless of the organization-wide defaults, users can, at a minimum, view the accounts in their territories. Also, users can be granted access to view and edit the contacts, opportunities, and cases associated with their territories’ accounts.
Apex Sharing
• The organization-wide default settings can’t be changed from private to public for a custom object if Apex code uses the sharing entries associated with that object. For example, if Apex code retrieves the users and groups who have sharing access on a custom object Invoice__c (represented as Invoice__share in the code), you can’t change the object’s organization-wide sharing setting from private to public.
Campaign Sharing
• In Enterprise, Unlimited, and Developer Editions, designate all users as Marketing Users when enabling campaign sharing.
This simplifies administration and troubleshooting because access can be controlled using sharing and profiles.
Note: Professional Edition customers cannot manage users this way because custom profiles are not enabled in
Professional Edition organizations.
• To segment visibility between business units while maintaining existing behavior within a business unit:
1. Set the campaign organization-wide default to Private.
2. Create a sharing rule to grant marketing users Public Full Access to all campaigns owned by users within their business unit.
3. Create a sharing rule to grant all non-marketing users in a business unit Read Only access to all campaigns owned by users in their business unit.
• When a single user, such as a regional marketing manager, owns multiple campaigns and needs to segment visibility between business units, share campaigns individually instead of using sharing rules. Sharing rules apply to all campaigns owned by a user and do not allow segmenting visibility.
• Create all campaign sharing rules prior to changing your organization-wide default to reduce the affect the change has on your users.
225
Sharing Viewing Sharing Overrides
• To share all campaigns in your organization with a group of users or a specific role, create a sharing rule that applies to campaigns owned by members of the “Entire Organization” public group.
• Minimize the number of sharing rules you need to create by using the “Roles and Subordinates” option instead of choosing a specific role.
• If campaign hierarchy statistics are added to the page layout, a user can see aggregate data for a parent campaign and all the campaigns below it in the hierarchy regardless of whether that user has sharing rights to a particular campaign within the hierarchy. Therefore, consider your organization’s campaign sharing settings when enabling campaign hierarchy statistics. If you do not want users to see aggregate hierarchy data, remove any or all of the campaign hierarchy statistics fields from the Campaign Hierarchy related list. These fields will still be available for reporting purposes.
• If the sharing model is set to Public Full Access for campaigns, any user can delete those types of records.
Campaign Member Sharing
Campaign member sharing is controlled by campaign sharing rules. Users that can see a campaign can also see associated campaign members.
Contact Sharing
• The organization-wide sharing default for contacts is not available to organizations that have person accounts enabled.
• If your organization-wide default for contacts is set to Controlled by Parent, the Contact Access options are not available when sharing related records like accounts; instead, all access to contacts is determined by the user's access to the contact's account.
Price Book Sharing
• Sharing on price books controls whether users can add the price book and its products to opportunities.
• User permissions control whether users can view, create, edit, and delete price books.
See Also:
Viewing Sharing Overrides
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To view sharing overrides:
User Permissions Needed
“View Setup and Configuration”
When you select an object in the Sharing Settings page, the page includes a Sharing Overrides related list, which shows any profiles that ignore sharing settings for that object.
To view the Sharing Overrides list, click
Your Name
> Setup > Security Controls > Sharing Settings, then select an object from the Manage Sharing Settings For list.
226
Sharing Recalculating Sharing Rules
For each profile, the list specifies the permissions that allow it to override sharing settings. The “View All Data” and “Modify
All Data” permissions override sharing settings for all objects in the organization, while the object permissions “View All” and
“Modify All” override sharing settings for the named object.
Note: The Sharing Overrides list doesn't show permissions granted through permission sets, which may also override sharing settings for an object.
To override sharing settings for specific objects, you can create or edit permission sets or profiles and enable the “View All” and “Modify All” object permissions. These permissions provide access to all records associated with an object across the organization, regardless of the sharing settings. Before setting these permissions, compare the different ways to control data access.
See Also:
S
HARING
C
ALCULATIONS
Recalculating Sharing Rules
Account and contact sharing rules are available in: Professional, Enterprise, Unlimited, and Developer Editions
Account territory, case, lead, and opportunity sharing rules are available in: Enterprise, Unlimited, and Developer Editions
Campaign sharing rules are available in Professional Edition for an additional cost, and Enterprise, Unlimited, and
Developer Editions
Custom object sharing rules are available in: Enterprise, Unlimited, Developer, and Database.com Editions.
To recalculate sharing rules:
User Permissions Needed
“Manage Users”
When you make changes to groups, roles, and territories, sharing rules are usually automatically reevaluated to add or remove access as necessary. Changes could include adding or removing individual users from a group, role, or territory, changing which role a particular role reports to, changing which territory a particular territory is subordinate to, or adding or removing a group from within another group. However, if these changes affect too many records at once, a message appears warning that the sharing rules won’t be automatically reevaluated, and you must manually recalculate them.
Note:
You don’t have to recalculate each time you edit or create a new sharing rule. The Recalculate buttons on the Sharing
Rules related lists should only be used if sharing rule updates have failed or are not working as expected. Administrators will receive a notification email if sharing rule updates have failed.
227
Manage User Access to Data Defer Sharing Calculations Overview
To manually recalculate an object’s sharing rules:
1. Click Your Name > Setup > Security Controls > Sharing Settings.
2. In the Sharing Rules related list for the object you want, click Recalculate.
Note: The Recalculate button is disabled when group membership or sharing rule calculations are deferred.
When sharing is recalculated, Salesforce also runs all Apex sharing recalculations.
Automatic sharing rule calculation is enabled by default. You can defer sharing rule calculation by suspending and resuming at your discretion.
See Also:
Defer Sharing Calculations Overview
Defer Sharing Calculations Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Note: The defer sharing calculation feature isn't enabled by default. To enable it for your organization, contact salesforce.com.
Performing a large number of configuration changes can lead to very long sharing rule evaluations or timeouts. To avoid these issues, an administrator can suspend these calculations and resume calculations during an organization's maintenance period.
Deferring sharing calculation is ideal if you make a large number of changes to roles, territories, groups, users, portal account ownership, or public groups participating in sharing rules, and want to suspend the automatic sharing calculation to a later time.
Group membership and sharing rule calculation are enabled by default.
If You can
Group membership and sharing rule calculation are enabled • Suspend, update, and resume group membership calculation. This suspends sharing rule calculation and requires a full recalculation of sharing rules.
• Suspend, update, and resume sharing rule calculation.
Group membership calculation is enabled and sharing rule calculation is suspended
Suspend, update, and, resume group membership calculation.
Group membership calculation is suspended and sharing rule calculation is enabled
Suspend, update, resume, and recalculate sharing rule calculation.
228
Manage User Access to Data Defer Sharing Calculations Overview
To suspend or resume group membership calculation, see
Managing Group Membership Calculations .
To suspend, resume, or recalculate sharing rule calculation, see Deferring Sharing Rule Calculations
.
See Also:
Managing Group Membership Calculations
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
User Permissions Needed
To defer (suspend and resume) sharing calculations: “Manage Users”
AND
“Manage Sharing Calculation Deferral”
When you make changes to roles, territories, groups, or users, or change ownership of portal accounts, group membership is automatically recalculated to add or remove access as necessary. Changes can include adding or removing a user from a group or changing a role to allow access to different sets of reports.
If you are making changes to groups that affect a lot of records, you may want to suspend automatic group membership calculation and resume at a later time. Note that you might experience sharing inconsistencies in your records if you don’t resume calculation.
To suspend or resume group membership calculation:
1. Click Your Name > Setup > Security Controls > Defer Sharing Calculations.
2. In the Group Membership Calculations related list, click Suspend.
Note: If sharing rule calculations are enabled, suspending group membership calculations also suspends sharing rule calculations. Resuming group membership calculations also requires full sharing rule recalculation.
3. Make your changes to roles, territories, groups, users, or portal account ownership.
4. To enable group membership calculation, click Resume.
See Also:
Defer Sharing Calculations Overview
229
Manage User Access to Data Defer Sharing Calculations Overview
Deferring Sharing Rule Calculations
Account and contact sharing rules are available in: Professional, Enterprise, Unlimited, and Developer Editions
Account territory, case, lead, and opportunity, sharing rules are available in: Enterprise, Unlimited, and Developer Editions
Campaign sharing rules are available in Professional Edition for an additional cost, and Enterprise, Unlimited, and
Developer Editions
Custom object sharing rules are available in: Enterprise, Unlimited, Developer, and Database.com Editions.
User Permissions Needed
To defer (suspend and resume) and recalculate sharing rules:: “Manage Users”
AND
“Manage Sharing Calculation Deferral”
Note: The defer sharing calculation feature isn't enabled by default. To enable it for your organization, contact salesforce.com.
To suspend, resume, or recalculate sharing rule calculation:
1. Click Your Name > Setup > Security Controls > Defer Sharing Calculations.
2. In the Sharing Rule Calculations related list, click Suspend.
3. Make changes to sharing rules, roles, territories, or public groups participating in sharing rules.
Note: Any changes to sharing rules require a full recalculation.
To enable sharing rule calculation, click Resume.
4. To manually recalculate sharing rules, click Recalculate.
Consider deferring your sharing calculations before performing massive updates to sharing rules. When sharing is recalculated,
Salesforce also runs all Apex sharing recalculations.
See Also:
Managing Group Membership Calculations
230
Sharing Built-in Sharing Behavior
Built-in Sharing Behavior
Sharing for accounts and contacts is available in: Professional, Enterprise, Unlimited, and Developer Editions
Sharing for cases and opportunities is available in Enterprise, Unlimited, and Developer Editions
Salesforce provides implicit sharing between accounts and child records (an opportunity, case, or contact), and for various groups of portal users.
Sharing between accounts and child entities
• Access to a parent account—If you have access to an account’s child record, you have implicit Read Only access to that account.
• Access to child entities—If you have access to a parent account, you can have access to the associated child entities.
The account owner's role determines the level of access to child entities.
Built-in sharing behavior for portal users
• Account and case access—An account’s portal user has Read Only access to the parent account and to all of the account’s contacts.
• Management access to data owned by Service Cloud portal users—Since Service Cloud portal users don't have roles, portal account owners can't access their data via the role hierarchy. To grant them access to this data, you can add account owners to the portal’s share group where the Service Cloud portal users are working. This step provides access to all data owned by Service Cloud portal users in that portal.
• Case access—If a portal user is a contact on a case, then the user has Read Only access on the case.
Group membership operations and sharing recalculation
Simple operations such as changing a user’s role, moving a role to another branch in the hierarchy, or changing a portal account’s owner can trigger a recalculation of sharing rules. Salesforce must check access to user’s data for people who are above the user’s new or old role in the hierarchy, and either add or remove shares to any affected records.
Note: These sharing behaviors simplify administration for data access but can impact the performance of mass data loads and updates. For best practices on designing record access in a large organization, see Designing Record Access for Enterprise Scale .
See Also:
Record Access FAQ
•
Why does a user have access to an account?
•
Why can’t a user see a record?
231
Manage User Access to Data Record Access FAQ
Why does a user have access to an account?
A user may have access to an account from:
• Record Ownership
• Implicit access from an associated child record such as a case, contact, or opportunity
• Organization-wide sharing defaults
• Role hierarchy
• Sharing rules
• Manual sharing
• Account team or territory
To find out why a user have access to the record, click the Sharing button on the account detail page to see a list of users who have access and for which reasons. Click Expand List to see all users who have access.
The following users don’t show up in the list even if they may have access:
• All users, if the organization-wide defaults are set to Public Read Only or Public Read/Write
• High-volume portal users
Note:
If the Sharing button does not appear, the organization-wide sharing defaults may have been set to Controlled by
Parent or Public Read. Otherwise, only the record owner, an administrator, or a user above the owner in the role hierarchy can see the Sharing Detail page.
Table 1: Troubleshooting guideline for user access to a record
Access Type
Record owner
Implicit access
Organization-wide sharing default
Role hierarchy
Sharing rules
Manual shares
Description
The record owner always gets access to his or her own record.
Corresponds to the “Associated record owner or sharing” entry in the Reason column of the Sharing
Detail page. The user may have access to a child record of an account (opportunity, case, or contact), which grants them Read access on that account. You cannot overwrite this access. For example, if the user has access to a case record, he or she has implicit Read access to the parent account record.
Check if the defaults for the account object are set to Private. If it is, the user may have gained access via other methods listed here. It must be set to Private if at least one of your users should not see a record.
The user may have inherited Read access from a subordinate in the role hierarchy. You can’t override this behavior for non-custom objects. If the user who has access is on a different branch of the hierarchy from the account owner, check the sharing rules, account teams, and account territory.
The user may have gotten access because he or she has been included in a relevant sharing rule. If the sharing rule uses public groups (or other categories such as roles) to grant access, check your public groups to see if the user has been included in the group.
The user may have gotten access through the Sharing button of the record. Only the record owner, an administrator, or a user above the owner in the role hierarchy can create or remove a manual share on the record.
232
Manage User Access to Data Record Access FAQ
Access Type Description
Account Teams and
Territory
The user may have been added to an Account Team by the account owner, an administrator, a user above the owner in the role hierarchy, or an account team member. If your organization uses territory management, check if the user who has access is higher in the territory hierarchy than the account owner. Managers gain the same access as their subordinates. Additionally, if the user is a member of
Group A, which is a member of Group B, he or she gets access to all accounts shared to Group B, at the same level of access as members of Group B.
See Also:
Why can’t a user see a record?
You may have set the organization-wide defaults for the object to Private, set up a role hierarchy and granted access using sharing rules, and so on. If you are not sure why a user can’t see a record, follow this troubleshooting flow.
1. Verify the user permission for the object.
Permission sets determine which app and what types of data users can see, and whether they can edit, create, or delete records. Make sure that you have assigned the right permissions to the user.
2. Check the role hierarchy.
Identify the user’s role in relation to the record owner. If User A cannot access a record owned by User B, they are most likely in different roles or in different branches of the role hierarchy.
3. Review the sharing rules.
You may have left out the user from the sharing rule. If User A should have gotten access in a sharing rule but did not, check the public group (or other categories such as roles or queues) that is used for that sharing rule.
4. Check your teams.
If your organization uses teams for accounts, opportunities, or cases, you may have missed the user when setting up the teams. Review your teams to determine if the user should have gotten access through a team.
5. Review your manual shares.
The user may have lost access because the record owner changed, causing the manual share to be dropped automatically.
The manual share could also have been removed using the Sharing button on the record detail page. Only the record owner, an administrator, or a user above the owner in the role hierarchy can create or remove a manual share on the record.
6. Check your territories if you’re using them.
The user may be missing from the territories or the record may not be under the correct territory where the user is a member.
Review your territories if the user should have gotten access through them.
See Also:
233
Manage User Access to Data Managing Folders
Managing Folders
Available in: All editions except Database.com
User Permissions Needed
To create, edit, or delete public document folders:
To create, edit, and delete public email template folders:
To create, edit, and delete public report folders:
To create, edit, and delete public dashboard folders:
“Manage Public Documents”
“Manage Public Templates”
“Manage Public Reports”
“Manage Dashboards” AND “View All Data”
A folder is a place where you can store reports, dashboards, documents, or email templates. Folders can be public, hidden, or shared, and can be set to read-only or read/write. You control who has access to its contents based on roles, permissions, public groups, and license types. You can make a folder available to your entire organization, or make it private so that only the owner has access.
• To access document folders, click the Documents tab.
• To access email template folders, click
Your Name
> Setup > Communication Templates > Email Templates.
To create a new folder, click Create New Folder.
To edit a folder, click Edit next to the folder name. Alternatively, select a folder name from the Folder drop-down list and click Edit.
Note: You can modify the contents of a folder only if the folder access level is set to Read/Write. Only users with the “Manage Public Documents” or “Manage Public Templates” can delete or change a Read Only folder. Regardless of permissions or folder settings, users can't edit any unfiled or personal folders.
See Also:
234
Manage User Access to Data Managing Folders
Creating and Editing Folders
Available in: All Editions except Database.com
Report folders not available in: Contact Manager, Group, and Personal Editions
User Permissions Needed
To create, edit, or delete public document folders:
To create, edit, and delete public email template folders:
To create, edit, and delete public report folders:
To create, edit, and delete public dashboard folders:
“Manage Public Documents”
“Manage Public Templates”
“Manage Public Reports”
“Manage Dashboards” AND “View All Data”
Click Create New Folder or Edit from most pages that list folders.
1. Enter a
Folder Label
. The label is used to refer to the folder on user interface pages.
2. If you have the “Customize Application” permission, enter a unique name to be used by the API and managed packages.
3. Choose a
Public Folder Access
option. Select read/write if you want users to be able to change the folder contents.
A read-only folder can be visible to users but they can't change its contents.
4. Select an unfiled report, dashboard, or template and click Add to store it in the new folder. Skip this step for document folders.
5. Choose a folder visibility option:
• This folder is accessible by all users, including portal users gives folder access to all users in your organization, including portal users.
•
This folder is accessible by all users, except for portal users gives folder access to all users in your organization, but denies access to portal users. This option is only available for report and dashboard folders in organizations with a partner portal or Customer Portal enabled. If you don't have a portal, you won't see it.
• This folder is hidden from all users makes the folder private.
•
This folder is accessible only by the following users
allows you to grant access to a desired set of users:
a. Choose “Public Groups”, “Roles,” “Roles and Subordinates,” “Roles, Internal and Portal Subordinates” (if you have portals enabled), “Territories,” or “Territories and Subordinates” from the
Search
drop-down list. The choices vary by Edition and whether your organization has territory management.
Note: When you share a folder with a group, managers of the group members have no access to the folder unless those managers are also members of the group.
b. If the
Available for Sharing
list does not immediately display the desired value, enter search criteria and click Find.
c. Select the desired value from the Available for Sharing list and click Add to move the value to the Shared
To
list.
235
Manage User Access to Data Managing Folders
6. Click Save.
See Also:
Deleting Folders
Available in: All Editions except Database.com
Report folders not available in: Contact Manager, Group, and Personal Editions
User Permissions Needed
To create, edit, or delete public document folders:
To create, edit, and delete public email template folders:
To create, edit, and delete public report folders:
To create, edit, and delete public dashboard folders:
“Manage Public Documents”
“Manage Public Templates”
“Manage Public Reports”
“Manage Dashboards” AND “View All Data”
You can only delete folders that are empty. Before you begin, remove all the documents, dashboards, templates, or reports from the folder you would like to delete.
1. Click Edit next to the folder name from any page that lists folders. On the Reports tab, click then Edit in the Folders pane.
2. Click Delete or then Delete.
3. Click OK to confirm.
See Also:
236
Manage User Access to Data Managing Folders
Filing Items in Folders
Available in: All Editions except Database.com
Report folders not available in: Contact Manager, Group, and Personal Editions
User Permissions Needed
To create, edit, or delete public document folders:
To create, edit, and delete public email template folders:
To create, edit, and delete public report folders:
To create, edit, and delete public dashboard folders:
“Manage Public Documents”
“Manage Public Templates”
“Manage Public Reports”
“Manage Dashboards” AND “View All Data”
To move a document, dashboard, report, or email template to a different folder:
1. Select the item to be stored in a folder.
2. Click Edit Properties.
3. Choose another folder.
4. Click Save.
Just like report folders contain reports and email template folders contain email templates, document folders can only contain documents. To store an attachment in a document folder, save the attachment to your computer and upload it to the document library.
Note: Email templates that are used by Web-to-Case, Web-to-Lead, assignment rules, or escalation rules must be marked as “Available for Use.”
See Also:
237
Import Your Data Importing Overview
I
MPORT
Y
OUR
D
ATA
Importing Overview
Your edition determines the types of objects you can import.
You can import data from ACT!, Outlook, and any program that can save data in the CSV (comma-separated values) format, such as Excel or GoldMine.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
The following table summarizes the kinds of records that can be imported.
Leads
Type of record
Business accounts and contacts owned by different users
Person accounts owned by you
Person accounts owned by different users
Campaign members
Import record limit
Business accounts and contacts owned by you
500 at a time
Which records can be imported?
Users with access
All users
50,000 at a time
50,000 at a time
50,000 at a time
50,000 at a time
Administrators;
Users with the “Modify All
Data” permission
Overview topic
All users
Administrators;
Users with the “Import Person
Accounts” permission
Administrators;
Users with “Read”, “Create”, and “Edit” on leads and the
“Import Leads” permission
50,000 for importing leads as new campaign members and updating the status of existing campaign members.
Administrators;
Marketing users (or users with the “Import Leads” permission and the “Edit” permission on campaigns) can import new leads as campaign members.
238
Import Your Data Importing Overview
Type of record
Custom objects
Solutions
Which records can be imported?
Import record limit Users with access
Users also need the “Read” permission on contacts to use the campaign update wizard to make existing leads and contacts campaign members.
50,000 at a time Administrators;
Users with the “Modify All
Data” permission
Overview topic
50,000 at a time Administrators;
Users with the “Import
Solutions” permission
These records cannot be imported via the import wizards.
Assets
Cases
Campaigns
Contracts
Documents
Opportunities
Products
For information on field accessibility and how different field type values are imported, see
on page
248.
Process for Importing Records
To import records into Salesforce, follow the steps in these topics:
1.
Creating Export Files for Import Wizards
2.
Preparing Your Data for Import
3.
Note: In addition to the record limits on each import, your import is also subject to the overall storage limits for your organization.
Although they are custom objects, relationship group members cannot be imported.
See Also:
Which Data Import/Export Tool Should I Use?
239
Import Your Data Which Data Import/Export Tool Should I Use?
Which Data Import/Export Tool Should I Use?
Salesforce offers the following tools and APIs to import and export data.
Use the table below to determine which tool you should use, based on how many records you need to import or export, whether you need to import or export, and whether the tool is internal or external to Salesforce.
Additional information Tool Editions supported
Number of records you can import or export
Import
Up to 50,000 Yes Import Wizard for Accounts and Contacts
Contact
Manager,
Group,
Professional,
Enterprise,
Unlimited, and
Developer
Editions
Import Wizard for Leads
Group,
Professional,
Enterprise,
Unlimited, and
Developer
Editions
Up to 50,000
Solution Import
Wizard
Professional,
Enterprise,
Unlimited, and
Developer
Editions
Custom Object
Import Wizard
Contact
Manager,
Group,
Professional,
Enterprise,
Unlimited, and
Developer
Editions
Data Export
Up to 50,000
Up to 50,000
Weekly export available in
Enterprise and
Unlimited
Editions.
Monthly export available in all editions, except
Database.com
No limit
Yes
Yes
Yes
No
No
No
No
Yes
Export
No
Internal or external to
Salesforce
Internal
Internal
Internal
Internal
Internal
An in-browser wizard that imports your personal and organization’s accounts and contacts.
An in-browser wizard that imports your organization’s
.
An in-browser wizard that imports your organization’s
.
An in-browser wizard that imports your organization’s
.
An in-browser wizard that exports data in .zip files that are up to 128 MB each on a monthly or weekly basis.
240
Import Your Data Which Data Import/Export Tool Should I Use?
Tool
Data Loader
Editions supported
Enterprise,
Unlimited,
Developer, and
Database.com
Editions
Number of records you can import or export
Import
Between 5,000 and 5 million
Yes
Export
Yes
Internal or external to
Salesforce
External
Third-party tools
Jitterbit Data
Loader
TM
for
Salesforce
(third-party tool)
Workbench
Varies
All editions
Over 5 million
Over 5 million
Varies
Yes
Enterprise,
Unlimited,
Developer, and
Database.com
Editions
One record at a time or a batch containing up to
10,000 records
Yes
Varies
Yes
Yes
External
External
External
Additional information
Data Loader is a client application for the bulk import or export of data. Use it to insert, update, delete, or export
Salesforce records.
See the AppExchange for available tools.
Free data migration tool offered by a salesforce.com, inc.
partner. Read more .
Workbench is a free, open source, community-supported tool (see the Help page in
Workbench). Salesforce.com
provides a hosted instance of
Workbench for demonstration purposes only—salesforce.com
recommends that you do not use this hosted instance of
Workbench to access data in a production database. If you want to use Workbench for your production database, you can download, host, and configure it using your own resources.
Read more .
Salesforce.com provides APIs that enable data integration with Salesforce. Use the table below to determine which API to use, based on how many records you need to import or export and the integration technologies required in your scenario.
API Additional information
REST API
Editions supported
Developer,
Enterprise,
Unlimited, and
Database.com
Editions
Number of records you can import or export
Integration scenarios where you have less than 200 records
Import
Yes
Export
Yes Use to access objects in your organization using REST. Read more .
241
Import Your Data Which Data Import/Export Tool Should I Use?
API
SOAP API
Bulk API
Editions supported
Developer,
Enterprise,
Unlimited, and
Database.com
Editions
Developer,
Enterprise,
Unlimited, and
Database.com
Editions
Number of records you can import or export
Integration scenarios where you have less than 200 records
Over a million
Import
Yes
Yes
Export
Yes
Yes
Additional information
Use to integrate your organization’s data with other applications using SOAP.
Read more .
Use to load or delete large numbers of records. Read more .
See Also:
What Is Imported for Business Accounts and Contacts?
Available in: All Editions except Database.com
Organization import not available in: Personal Edition, Database.com
The import wizards for contacts and business accounts allow you to match records in a variety of ways in order to prevent duplicates. Contacts can be matched by Salesforce ID, name, or email. Business accounts can be matched by Salesforce ID or by name and site. Matching by Salesforce ID is inclusive of both contacts and business accounts; if you match one by Salesforce
ID, the other will also be matched by Salesforce ID.
Matching by Name and Site
If you choose to match contacts by name and business accounts by name and site (which are the recommended options), the import wizards automatically create a business account for each unique business account name and site in the import file. They also create a separate contact for each contact name listed in the file. The contacts are then associated with the appropriate business accounts.
If the business account or contact already exists in the system, and you have read/write access to the record, the wizards add your import data to the existing data in Salesforce. In addition, if a business account or contact name in your import file is similar to an existing business account or contact name, the import data is added to the existing data in Salesforce.
Matching by Salesforce ID
You can also choose to match contacts and business accounts by Salesforce ID. With this selected, the Salesforce ID will be the criteria for de-duplication. That is, if you are matching by ID and a record in your source file has the same ID as a record in Salesforce, then that record will be updated in Salesforce. Note that record IDs are case-sensitive and must match exactly.
242
Import Your Data Which Data Import/Export Tool Should I Use?
Overwriting Existing Account Values
The wizards never overwrite your existing business account fields unless you check the
Overwrite existing account values checkbox in the wizard. With this box checked, you can insert or update existing business account fields with new data. However, you cannot use this checkbox to update existing field data with blank values. With this box unchecked, the wizard updates any empty business account fields, but does not touch any fields with existing data.
If you do not have read/write access to an existing business account or contact, the wizards create a new business account or contact owned by you. In addition, the wizards create new business accounts and contacts based on specific fields in your import file.
In Professional, Enterprise, Unlimited, and Developer Edition organizations, the import wizards can also import new business account and contact notes. The wizards do not import notes that are exact duplicates of existing contact or business account notes.
See Also:
Import My Organization’s Accounts and Contacts
Which Data Import/Export Tool Should I Use?
What Is Imported for Person Accounts?
Person account import available in: Enterprise, Unlimited, and Developer Editions
The import wizards for person accounts allow you to prevent the creation of duplicate records by matching records according to one of the following fields:
Account Name
,
Salesforce ID
, or
. In your import file, include a column for the field that you are using for record matching.
Note: Your administrator may have renamed “person account” to another term. If so, the import wizard will refer to the new name.
Matching by Name
When you select this option, the import wizard will detect existing records in Salesforce that have the same name. Note that this type of matching is not case-sensitive - for example, names that begin with a capital letter will be matched with the same name that begins with a lowercase letter. If necessary, scan and standardize your custom object names before performing the import to prevent unintended matches.
Matching by Salesforce ID
A Salesforce ID is a system-generated, case-sensitive string of 15 or 18 letters and numbers that uniquely identifies each
Salesforce record. When you select this option, the import wizard will detect existing records in Salesforce that have the same
Salesforce ID. Note that Salesforce IDs are case-sensitive and must match exactly. Salesforce IDs can be obtained by running reports that include the ID field of the record.
Matching by Email
With this option, person accounts in your import file will be matched with existing person accounts in Salesforce according to the exact value in the
field.
243
Import Your Data Which Data Import/Export Tool Should I Use?
Matching by External ID
An external ID is a custom field that has the “External ID” attribute, meaning that it contains unique record identifiers from a system outside of Salesforce. When you select this option, the import wizard will detect existing records in Salesforce that have the same external ID. Note that this operation is not case-sensitive - for example, “ABC” will be matched with “abc”.
However, there is an exception: if the custom field has the separate “Unique” attribute and the case-sensitive option for that attribute is selected, uppercase and lowercase letters will not be considered identical.
If necessary, scan and standardize your external ID values before performing the import to prevent unintended matches.
When matching by external ID, if the import wizard finds duplicate records, only the first three duplicate records are reported to you in the confirmation email.
Note: Only account custom fields with the “External ID” attribute are available for this step. While all custom contact fields are available on person account page layouts, custom contact fields with the “External ID” attribute are not available as matching fields during person account import.
Ignoring or Updating Matching Records
When the import wizard detects existing records in Salesforce that match according to the field you have chosen, you can choose one of the following actions:
• Do not update existing records and only insert new records - If there are records in your file that are new and do not match any existing records, then insert them into Salesforce. Also, ignore any records in your file that match an existing record, and do nothing to the existing record.
• Update existing records and do not insert any new records - If there are records in your file that match an existing record, then update the existing record. Also, ignore any records in your file that do not match an existing record, and do not insert them as new records.
• Update existing records and insert new records - If there are records in your file that are new and do not match any existing records, then insert them into Salesforce. Also, if there are records in your file that match an existing record, then update the existing record.
See Also:
Import My Organization's Person Accounts
Which Data Import/Export Tool Should I Use?
What is Imported for Leads?
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
You can import data into the standard lead fields and into any custom lead fields you may have, even if a particular field is hidden or read only in your page layout or field-level security settings for leads.
Importing Leads With Matching Types
You can choose whether to match leads in your import file with existing leads in Salesforce. Leads can be matched according to the following types: Salesforce ID, name, or email. Choosing a matching type sets the criteria for avoiding duplicate leads.
For example, if you are matching by email and a lead in your source file has the same email as a lead in Salesforce, then that
244
Import Your Data Which Data Import/Export Tool Should I Use?
lead will be updated in Salesforce. If you are not matching by email and a lead in your source file has the same email as a lead in Salesforce, then a new lead will be created.
The wizards never overwrite your existing lead fields unless you check the
Overwrite existing lead values
checkbox in the wizard. With this box checked, you can insert or update existing lead fields with new data. However, you cannot use this checkbox to update existing field data with blank values. With this box unchecked, the wizard updates any empty lead fields, but does not touch any fields with existing data.
Importing Leads Without Matching Types
If you choose a matching type of “None” in the lead import wizard, for each lead in your import file, the Import My
Organization’s Leads wizard creates a new lead in Salesforce. You can merge leads after they are imported.
See Also:
Import My Organization’s Leads
Which Data Import/Export Tool Should I Use?
What is Imported for Campaign Members?
Available in: Professional, Enterprise, Unlimited, and Developer Editions
• Import Leads Wizard - For each lead in your import file, this wizard imports the lead, associates the lead with a campaign, and inserts a Member Status value for the lead in that campaign. You can import data into the standard lead fields and into any custom lead fields, even if a particular field is hidden or read only in your page layout or field-level security settings.
If you have duplicate leads in your import file, the wizard does not merge them. In addition, if any of the imported leads match an existing lead, the wizard does not merge the duplicate data into one lead.
• Campaign Update Wizard - For each contact or lead in your import file, this wizard updates only the Member Status value of the matching contact or lead in Salesforce. You cannot add new leads or contacts, nor can you update any other fields in the existing lead or contact records.
See Also:
Which Data Import/Export Tool Should I Use?
245
Import Your Data Which Data Import/Export Tool Should I Use?
What Is Imported for Custom Objects?
Custom object import available in: Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Editions
To import custom objects:
User Permissions Needed
“Modify All Data”
The import wizard for custom objects allows you to prevent the creation of duplicate records by matching records according to one of the following fields: custom object name, Salesforce ID, or external ID. In your import file, include a column for the field that you are using for record matching.
Matching by Name
When you select this option, the import wizard will detect existing records in Salesforce that have the same name. Note that this type of matching is not case-sensitive - for example, names that begin with a capital letter will be matched with the same name that begins with a lowercase letter. If necessary, scan and standardize your custom object names before performing the import to prevent unintended matches.
Matching by Salesforce ID
A Salesforce ID is a system-generated, case-sensitive string of 15 or 18 letters and numbers that uniquely identifies each
Salesforce record. When you select this option, the import wizard will detect existing records in Salesforce that have the same
Salesforce ID. Note that Salesforce IDs are case-sensitive and must match exactly. Salesforce IDs can be obtained by running reports that include the ID field of the record.
Matching by External ID
An external ID is a custom field that has the “External ID” attribute, meaning that it contains unique record identifiers from a system outside of Salesforce. When you select this option, the import wizard will detect existing records in Salesforce that have the same external ID. Note that this operation is not case-sensitive - for example, “ABC” will be matched with “abc”.
However, there is an exception: if the custom field has the separate “Unique” attribute and the case-sensitive option for that attribute is selected, uppercase and lowercase letters will not be considered identical.
If necessary, scan and standardize your external ID values before performing the import to prevent unintended matches.
When matching by external ID, if the import wizard finds duplicate records, only the first three duplicate records are reported to you in the confirmation email.
Ignoring or Updating Matching Records
When the import wizard detects existing records in Salesforce that match according to the field you have chosen, you can choose one of the following actions:
• Do not update existing records and only insert new records - If there are records in your file that are new and do not match any existing records, then insert them into Salesforce. Also, ignore any records in your file that match an existing record, and do nothing to the existing record.
• Update existing records and do not insert any new records - If there are records in your file that match an existing record, then update the existing record. Also, ignore any records in your file that do not match an existing record, and do not insert them as new records.
246
Import Your Data Which Data Import/Export Tool Should I Use?
• Update existing records and insert new records - If there are records in your file that are new and do not match any existing records, then insert them into Salesforce. Also, if there are records in your file that match an existing record, then update the existing record.
Note: Custom objects with two master-detail relationships cannot be imported using the import wizard.
See Also:
Import My Organization's Custom Objects
Which Data Import/Export Tool Should I Use?
What Is Imported for Solutions?
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To import solutions:
User Permissions Needed
“Import Solutions”
The import wizard for solutions allows you to prevent the creation of duplicate records by matching records according to one of the following fields: solution title, Salesforce ID, or external ID. In your import file, include a column for the field that you are using for record matching.
Matching by Solution Title
When you select this option, the import wizard will detect existing solutions in Salesforce that have the same title. Note that this type of matching is not case-sensitive - for example, titles that begin with a capital letter will be matched with the same title that begins with a lowercase letter. If necessary, scan and standardize your solution titles before performing the import to prevent unintended matches.
Matching by Salesforce ID
A Salesforce ID is a system-generated, case-sensitive string of 15 or 18 letters and numbers that uniquely identifies each
Salesforce record. When you select this option, the import wizard will detect existing records in Salesforce that have the same
Salesforce ID. Note that Salesforce IDs are case-sensitive and must match exactly. Salesforce IDs can be obtained by running reports that include the ID field of the record.
Matching by External ID
An external ID is a custom field that has the “External ID” attribute, meaning that it contains unique record identifiers from a system outside of Salesforce. When you select this option, the import wizard will detect existing records in Salesforce that have the same external ID. Note that this operation is not case-sensitive - for example, “ABC” will be matched with “abc”.
However, there is an exception: if the custom field has the separate “Unique” attribute and the case-sensitive option for that attribute is selected, uppercase and lowercase letters will not be considered identical.
If necessary, scan and standardize your external ID values before performing the import to prevent unintended matches.
247
Import Your Data Which Data Import/Export Tool Should I Use?
When matching by external ID, if the import wizard finds duplicate records, only the first three duplicate records are reported to you in the confirmation email.
Ignoring or Updating Matching Records
When the import wizard detects existing records in Salesforce that match according to the field you have chosen, you can choose one of the following actions:
• Do not update existing records and only insert new records - If there are records in your file that are new and do not match any existing records, then insert them into Salesforce. Also, ignore any records in your file that match an existing record, and do nothing to the existing record.
• Update existing records and do not insert any new records - If there are records in your file that match an existing record, then update the existing record. Also, ignore any records in your file that do not match an existing record, and do not insert them as new records.
• Update existing records and insert new records - If there are records in your file that are new and do not match any existing records, then insert them into Salesforce. Also, if there are records in your file that match an existing record, then update the existing record.
See Also:
Import My Organization's Solutions
Which Data Import/Export Tool Should I Use?
Notes on Importing Data
Your edition determines the types of objects you can import.
• Field Accessibility—In the organization-wide import wizards for accounts and leads, you can import data into any standard or custom field even if it is hidden or read only in your page layout or field-level security settings.
For the Import My Contacts wizard, you can import data only into the fields that are editable for you in your page layout or field-level security settings.
Field-level security is available in Enterprise, Unlimited, and Developer Editions only.
• New Values for Picklists and Multi-Select Picklists—If your import file contains data to be displayed in picklists or multi-select picklists, the wizards warn you when you attempt to import a new picklist value that does not match any valid picklist values. If you ignore the warning, the new value is automatically added to the imported record. Your administrator can later edit the field to add the necessary values. Note that the import wizards do not allow you to import more than 100 new picklist or multi-select picklist values for any field during a single import.
If your organization uses the Translation Workbench, the import wizards look for matching translated values before creating new inactive picklist values.
• Multi-Select Picklists—To import multiple values into a multi-select picklist, separate the values by a semicolon in your import file.
You can import up to 100 values at a time in a multi-select picklist field. If you have more than 100 values in your import file for any one record, the import wizard leaves the field blank in that record.
• Checkboxes—To import data into a checkbox field, use 1 for checked values and 0 for unchecked values.
248
Import Your Data Which Data Import/Export Tool Should I Use?
• Default Values—For picklist, multi-select picklist, and checkbox fields, if you do not map the field in the import wizard, the default value for the field, if any, is automatically inserted into the new or updated record.
• Date/Time Fields—Ensure that the format of any date/time fields you are importing matches how they display in Salesforce per your locale setting.
• Formula Fields—Formula fields cannot accept imported data because they are read only.
• Field Validation Rules—Salesforce runs validation rules on records before they are imported. Records that fail validation aren’t imported. Consider deactivating the appropriate validation rules before running an import if they affect the records you are importing.
• Universally Required Fields—You must include universally required fields in your import files or the import will fail.
See Also:
Which Data Import/Export Tool Should I Use?
Importing Multiple Currencies
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
If your organization has set up the ability to use multiple currencies, you can import amounts in different currencies.
Import My Accounts and Contacts
For personal imports, all amounts in new accounts and contacts are imported in your personal currency. When import updates amounts in existing records, the amounts in your file are converted from your personal currency to the currency of the account or contact.
For example, if your personal currency is U.S. dollars, and your import file has 100 as the annual revenue of an existing account with
Account Currency
of euros, then the new
Annual Revenue
value of the account will be EUR 92, assuming a conversion rate of 0.92 and “EUR” as the currency code for euros.
Organization Import
When importing accounts, contacts, custom objects, leads, or solutions for your organization, you can specify the currency type for amount fields using the Currency ISO Code column in your import file. The following rules apply:
• Entering currency codes - Enter a currency code in the Currency ISO Code column in your import file. Currency codes are three letter codes that follow an international standard. For example, USD is the currency code for U.S. dollars.
Click
Your Name
> Setup > Company Profile > Manage Currencies to see a list of valid codes for your organization.
• Using one currency for accounts and contacts - If you are importing accounts and contacts, the
Currency ISO Code column applies to both an account and its associated contact. You cannot specify different currencies for associated accounts and contacts.
• Updating the currency code - When updating the currency code but not the currency amount for existing accounts and contacts, the existing amount is not converted to the corresponding number in the new currency.
• Entering inactive currencies - If your enter an inactive currency in your import file, your personal currency will be used instead. However, amounts will not be modified. For example, if your file has AUD 100 for 100 Australian dollars but
AUD is an inactive currency for your organization, then it is imported as USD 100, assuming your personal currency is
U.S. dollars.
249
Import Your Data Creating Export Files for Import Wizards
• Omitting the Currency ISO Code column - When creating new records via importing, if you do not use the
Currency
ISO Code column or fail to map it, your personal currency is used. For example, if your file has 100 and your personal currency is U.S. dollars (currency code = USD), this is imported as USD 100.
When updating existing records via importing, if you do not use the Currency ISO Code column or fail to map it, any amounts are interpreted as having the existing currency of the record. For example, if your file has 100 for a record that has a currency of EUR (the currency code for euros), this amount is interpreted as EUR 100.
Creating Export Files for Import Wizards
Available in: All Editions except Database.com
To import data into Salesforce, you first need to export the data from your existing application. This creates an export file of the information you want to import.
•
•
•
•
•
•
Exporting from Other Data Sources
•
After creating the export file, compare your data with the Salesforce fields available for import, and verify that your data will be mapped into the appropriate Salesforce fields. See
Preparing Your Data for Import on page 256.
Your file can contain a mixture of some new records as well as updates for existing records. The option selected in the
Matching
Type field determines whether it is a new or existing record. When importing leads, you can choose whether to match leads in your import file with existing leads in Salesforce. Leads can be matched according to the following types: Salesforce ID, name, or email. Choosing a matching type sets the criteria for avoiding duplicate leads. For example, if you are matching by email and a lead in your source file has the same email as a lead in Salesforce, then that lead will be updated in Salesforce. If you are not matching by email and a lead in your source file has the same email as a lead in Salesforce, then a new lead will be created.
Note:
If you are the administrator and are importing for multiple users, you must combine your export data into a single
CSV file using Excel.
When importing new records, add or modify a Record Owner field in your file such that the field contains the names of existing, active users. Enter the users’ full usernames (for example, “[email protected]”) or first and last names (for example, “Joe Smith”, or “Smith Joe” for Asian locales). This will specify the owner of the imported data for an organization import. For lead imports, you can also specify the name of a lead queue. Record owner fields do not get updated when records are updated via import. All records retain their existing owners; and the Record
Owner
field in your import file is ignored for these records.
When importing leads, you can alternatively use a lead assignment rule to specify the owners of the imported data, instead of using a
Record Owner
field.
250
Import Your Data Creating Export Files for Import Wizards
Exporting from ACT!
ACT! allows you to export contact data in a text-delimited format which can then be imported. To export contact data from
ACT! (versions 4.0 or 2000):
1. Launch ACT! and open your database.
2. Select File > Data Exchange > Export....
3. Select the file type Text-Delimited.
4. Choose a file name and location for the exported data and click Next.
5. Select Contact records only.
6. Click the Options... button.
7. Select Comma for the field separator character.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
8. Select Yes, export field names and click OK.
9. Click Next.
10. Select All Records and then click Next.
11. Leave the export field order list alone, and click Finish.
See Also:
Default Field Mapping for ACT!
Creating Export Files for Import Wizards
Exporting from Outlook
Microsoft ® Outlook ® allows you to export data in a CSV (comma-separated values) format which can then be imported.
1. Launch Outlook.
2. Select File > Import and Export....
3. Choose Export to a file and click Next.
4. Choose Comma Separated Values (Windows) and click Next.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
5. Select the Contacts folder and click Next. You can select a different contacts folder if you have contacts stored in multiple folders.
6. Choose a file name for the exported data and click Next.
251
Import Your Data Creating Export Files for Import Wizards
7. Click Finish.
See Also:
Default Field Mapping for Outlook
Creating Export Files for Import Wizards
Exporting from GoldMine 4.0
GoldMine 4.0 allows you to export contact data in a text format that can be imported. Additionally, you can export GoldMine
4.0 notes for import into Professional, Enterprise, Unlimited, and Developer Edition organizations.
•
Exporting Contacts from GoldMine 4.0
•
Exporting Notes from GoldMine 4.0
Exporting Contacts from GoldMine 4.0
To export contact data from GoldMine 4.0, follow these steps:
1. Launch GoldMine 4.0.
2. Choose Export Records from the Tools menu.
3. Select Export to a new file and DBF file, and click Next.
4. In the list of GoldMine Fields on the left side of the dialog, select all of the fields, and click Add Field. Then click Next.
5. Choose the location for the export file, and click Next.
6. Select No when asked if you want to save these settings, and click Next.
7. Click Finish.
8. After the export finishes, locate the exported file and change its file extension from .dbf to .csv. The file is now ready for import into Salesforce.
Exporting Notes from GoldMine 4.0
Before importing your GoldMine 4.0 notes into Salesforce, you must import your GoldMine 4.0 contacts.
To export notes from GoldMine 4.0, follow these steps:
1. Launch GoldMine 4.0.
2. Choose Export Records from the Tools menu.
3. Select Export to a new file and ASCII file, and click Next.
4. In the list of GoldMine Fields on the left side of the dialog, select the company , lastname , and notes fields, and click
Add Field. Then click Next.
5. Choose the location for the export file, and click Next.
6. Select No when asked if you want to save these settings, and click Next.
7. Click Finish.
8. After the export finishes, locate the exported file and change its file extension to .csv.
9. Open the file.
10. Add a header column by right-clicking on the first row and choosing Insert.
11. In column A, enter Company .
12. In column B, enter
Last Name
.
13. In column C, enter Note .
252
Import Your Data Creating Export Files for Import Wizards
14. If necessary, clean up the file prior to importing it. Common problems include notes that have been broken between columns (this occurs when notes contain quotation marks).
See Also:
Field Mapping for Other Data Sources and Organization Import
Creating Export Files for Import Wizards
Exporting from GoldMine 5.0
GoldMine 5.0 allows you to export contact data in a text format that can be imported. Additionally, you can export GoldMine
5.0 notes for import into Professional, Enterprise, Unlimited, and Developer Edition organizations.
•
Exporting Contacts from GoldMine 5.0
•
Exporting Notes from GoldMine 5.0
Exporting Contacts from GoldMine 5.0
To export contact data from GoldMine 5.0, follow these steps:
1. Launch GoldMine 5.0.
2. Choose Tools > Import/Export Wizard > Export Contact Records.
3. Select Export to a new file and ASCII file, and click Next.
4. Select ALL Contact Records! in the drop-down list, and click Next.
5. In the list of GoldMine Fields on the left side of the dialog, select the fields you want to export, and click Add Field. We recommend you select all fields, except the notes
field. See Exporting Notes from GoldMine 5.0
on page 253 for information on how to export notes.
6. Click Next.
7. Choose the location for the export file, select the Export GoldMine field names... checkbox, and then click Next.
8. Select No when asked if you want to save these settings, and click Next.
9. Click Finish.
10. After the export finishes, locate the exported file and change its file extension from .txt to .csv. The file is now ready for import into Salesforce.
Exporting Notes from GoldMine 5.0
Before importing your GoldMine 5.0 notes into Salesforce, you must import your GoldMine 5.0 contacts.
To export notes from GoldMine 5.0, follow these steps:
1. Launch GoldMine 5.0.
2. Choose Tools > Import/Export Wizard > Export Contact Records.
3. Select Export to a new file and ASCII file, and click Next.
4. Select ALL Contact Records! in the drop-down list, and click Next.
5. In the list of GoldMine Fields on the left side of the dialog, select the company
, lastname
, and notes
fields, and click
Add Field. Then click Next.
6. Choose the location for the export file, select the Export GoldMine field names... checkbox, and then click Next.
7. Select No when asked if you want to save these settings, and click Next.
8. Click Finish.
9. After the export finishes, locate the exported file and change its file extension from .txt to .csv.
253
Import Your Data Creating Export Files for Import Wizards
10. Open the file.
11. If necessary, clean up the file prior to importing it. Common problems include notes that have been broken between columns (this occurs when notes contain quotation marks).
See Also:
Field Mapping for Other Data Sources and Organization Import
Creating Export Files for Import Wizards
Exporting from Palm Desktop
The Palm Desktop allows you to export your Address Book contacts in a CSV (comma-separated values) format which can then be imported.
1. Open the Address Book in the Palm Desktop. If you only want to export specific contacts, select those records.
2. Choose Export from the File menu.
3. In the “Export To File” dialog, enter a name for the file and choose a folder for it. In the Export as drop-down list, choose
“Comma Separated (*.csv;*.txt)”. Select the range of records to export - either All or Currently selected records.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
4. Click Export.
5. In the “Specify Export Fields” dialog box, select the Address Book fields you want to export, and click OK.
See Also:
Field Mapping for Other Data Sources and Organization Import
Creating Export Files for Import Wizards
Exporting from Other Data Sources
You can import data into the system from any other application that can create a CSV (comma-separated values) file.
1. Save your data source as a CSV file.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
2. Ensure your file includes only one name per field. The system cannot accept more than one name per field.
3. Ensure your file separates names and titles into two fields. The system cannot accept fields containing both names and titles.
254
Import Your Data Creating Export Files for Import Wizards
4. Ensure your file includes only one phone number per field.
See Also:
Field Mapping for Other Data Sources and Organization Import
Creating Export Files for Import Wizards
Exporting from Salesforce
Available in: Professional, Enterprise, Unlimited, and Developer Editions
You can export account, contact, custom object, lead, or solution reports from Salesforce to create an import file for the import wizards. You must include the
Account ID
,
Contact ID
,
Custom Object ID
,
Lead ID
, or
Solution ID
value for each respective record in your report. These ID fields are unique Salesforce identifiers and are used to accurately match your data with existing Salesforce records.
To create an import file with these ID fields, you first need to export the data from Salesforce.
1. Run an account, contact, custom object, lead, or solution report in Salesforce, include the respective ID field, and export it to Excel.
2. If you are exporting both leads and contacts to be targeted in a campaign:
a. In Excel, combine the exported reports into one CSV (comma-separated values) file. Make sure all of the ID field values are in the same column.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
b. Rename the
Lead ID/Contact ID
column to
Record Id
.
c. Add a column entitled
Status
, and enter the campaign member status for each contact or lead.
Note: Remember that Salesforce record IDs are case-sensitive and should never be changed manually in your import file.
See Also:
Creating Export Files for Import Wizards
255
Import Your Data Preparing Your Data for Import
Preparing Your Data for Import
Available in: All Editions except Database.com
After exporting your data from Salesforce or your existing application, prepare your data before importing it.
Note: If your data has information in fields that do not match any of the standard fields, your administrator can create custom fields for that data prior to import.
You must include universally required fields in your import files or the import will fail.
Preparing Contacts
When importing from ACT! or Outlook, the Import My Contacts wizard automatically maps fields from ACT! and
Outlook to Salesforce.
When importing from other data sources, you must use Excel ® to label the columns in your import file as specified in
Field Mapping for Other Data Sources and Organization Import
on page 263.
Preparing Person Accounts
When importing person accounts, use the field labels in Salesforce as the column labels in your import file.
Preparing Organization's Business Accounts and Contacts
When importing business accounts and contacts for your organization, you must use Excel ® to label the columns in your
Preparing Organization's Leads
When importing general leads or leads for campaigns, use the import file labels specified in
Preparing Custom Objects
When importing a custom object, use the field labels shown on the custom object detail page in Salesforce as the column labels in your import file.
Preparing Solutions
When importing solutions, use the field labels in Salesforce as the column labels in your import file.
You can enter HTML into the solutions you plan to import into Salesforce. However, unless your organization has enabled HTML solutions, HTML tags will display in the solutions after they are imported.
For security purposes, Salesforce automatically filters all HTML solutions for potentially malicious HTML. If potentially malicious HTML is detected in an HTML solution, then the potentially malicious HTML is either automatically removed or transformed into text for users who view the HTML solution. Note that users will not be able to notice when potentially malicious HTML is removed from an HTML solution.
You can import solutions written in HTML format into Salesforce. However, for security purposes, only the HTML tags listed below are allowed. The content of any HTML tags not listed below is automatically removed when saved in
HTML solutions. Furthermore, the content of all
<script>
and
<iframe>
tags, as well as all JavaScript, is automatically
256
Import Your Data Preparing Your Data for Import
<a>
<abbr>
<acronym>
<address>
<b>
<bdo>
<big>
<blockquote>
<br>
<caption>
<cite>
<code>
<col>
<colgroup>
<dd>
<del>
<dfn>
<div>
<dl> removed when saved in HTML solutions. Additionally, Cascading Style Sheets (CSS) are not supported in HTML solutions.
The following HTML tags are allowed in HTML solutions imported into Salesforce:
<h6>
<hr>
<i>
<img>
<ins>
<kbd>
<li>
<ol>
<p>
<pre>
<dt>
<em>
<font>
<h1>
<h2>
<h3>
<h4>
<h5>
<table>
<tbody>
<td>
<tfoot>
<th>
<thead>
<tr>
<tt>
<ul>
<var>
<q>
<samp>
<small>
<span>
<strike>
<strong>
<sub>
<sup>
Within the above tags, you can include the following attributes: alt background border class colspan face height href name rowspan size src style target width
The above attributes which can include a URL are limited to URLs that begin with the following:
• http:
257
Import Your Data Preparing Your Data for Import
• https:
• file:
• ftp:
• mailto:
• #
• / for relative links
See Also:
Default Field Mapping for ACT!
Default Field Mapping for Outlook
Creating Export Files for Import Wizards
Default Field Mapping for ACT!
Available in: All Editions except Database.com
This table details how ACT! fields map to Salesforce account and contact import fields during an individual data import.
Note: If an ACT! record contains more than one contact for the same company, the import wizard creates multiple contacts for one account.
ACT! Field
Address 1
Address 2
Address 3
Alt Phone
Alt Phone Ext.
Assistant
Asst. Phone
Asst. Phone Ext.
Import Field
Contact:
Mailing Address
and
Account: Billing Address
Contact:
Mailing Address
and
Account: Billing Address
Contact: Mailing Address and
Account:
Billing Address
Contact: Other Phone
Contact:
Other Phone Ext.
Contact:
Assistant's Name
Contact: Asst. Phone
Contact: Asst. Phone Ext.
258
Import Your Data
ACT! Field
City
Company
Contact
Country
Import Field
Contact:
Mailing City
and
Account: Billing City
Account:
Name
Contact: Full Name
Contact:
Mailing Country
and
Account:
Billing Country
Department
E-mail Login
(The import wizard verifies this is a valid email address in the form: [email protected])
Contact:
Department
Contact:
Fax
Fax Ext.
First Name
Home Address 1
Home Address 2
Home Address 3
Home City
Home Country
Home Phone
Home State
Home Zip
ID/Status
Last Name
Mobile Phone
Note
Phone
Phone Ext.
Referred By
Revenue
Contact:
Fax
and
Account: Fax
Contact:
Business Fax Ext.
Contact: First Name
Contact:
Other Address 1
Contact:
Other Address 2
Contact:
Other Address 3
Contact: Other City
Contact:
Other Country
Contact:
Home Phone
Contact:
Other State
Contact: Other Postal Code
Account:
Type
Contact:
Last Name
Contact:
Mobile Phone
Does not import
Contact:
Phone
and
Account:
Phone
Contact:
Business Phone Ext.
Contact:
Lead Source
Account: Annual Revenue
Preparing Your Data for Import
259
Import Your Data Preparing Your Data for Import
ACT! Field
State
Ticker Symbol
Title
Web Site
Zip
Import Field
Contact:
Mailing State
and
Account: Billing State
Account:
Ticker Symbol
Contact: Title
Account:
Website
Contact:
Mailing Postal Code
Account: Billing Postal Code
2nd Contact
2nd Phone
2nd Phone Ext.
2nd Title
3rd Contact
2nd Contact:
Name
2nd Contact: Phone
2nd Contact:
Phone Ext.
2nd Contact:
Title
3rd Contact:
Name
3rd Phone
3rd Phone Ext.
3rd Contact: Phone
3rd Contact:
Phone Ext.
3rd Title
3rd Contact:
Title
2nd Last Reach
,
3rd Last Reach
,
Asst. Title
,
Last
Attempt
,
Last Meeting
,
Last Reach
,
Last Results
,
Letter Date
,
Pager
,
Spouse
,
User 1-15
Contact:
Note
or Account:
Note
(In Professional, Enterprise, Unlimited, and Developer Edition organizations, you specify which fields import into a single contact or account note; separate notes are not created for each
ACT! field.)
See Also:
Preparing Your Data for Import
Default Field Mapping for Outlook
Available in: All Editions except Database.com
This table details how Outlook fields map to Salesforce account and contact import fields during an individual data import.
260
Import Your Data Preparing Your Data for Import
Outlook Field
Assistant’s Name
Assistant’s Phone
Birthday
Business City
Business Country
Business Fax
Business Phone
Business Postal Code
Import Field
Contact:
Assistant’s Name
Contact:
Asst Phone
Contact: Birthdate
Contact:
Mailing City
and
Account:
Billing City
Contact:
Mailing Country
and
Account: Billing Country
Contact:
Fax
and
Account:
Fax
Contact: Phone
Contact:
Mailing Postal Code
Account:
Billing Postal Code
Business Street
Business Street 2
Business Street 3
Company
Contact:
Mailing Address
and
Account: Billing Address
Contact:
Mailing Address
and
Account:
Billing Address
Contact: Mailing Address and
Account:
Billing Address
Account:
Account Name
and
Contact:
Account
Company Main Phone
Department
(The import wizard verifies this is a valid email address in the form: [email protected])
Account:
Phone
Contact:
Department
Contact: Email
First Name
Home City
Home Country
Home Phone
Home Postal Code
Home Street
Contact:
First Name
Contact: Other City
Contact:
Other Country
Contact:
Home Phone
Contact:
Other Postal Code
Contact: Other Address
261
Import Your Data Preparing Your Data for Import
Outlook Field
Home Street 2
Home Street 3
Job Title
Last Name
Manager's Name
Import Field
Contact:
Other Address
Contact:
Other Address
Contact: Title
Contact:
Last Name
Contact:
Reports To
(In addition, if the name in this field does not match an existing contact, a new contact is created with the manager’s name.)
Mobile Phone
Notes
Other Phone
Referred By
Title
Contact:
Mobile Phone
Contact: Description
Contact:
Other Phone
Contact:
Lead Source
Contact:
Salutation
Web Page Account: Website
Account
,
Anniversary
,
Billing Information
,
Business Phone 2
,
Callback
,
Car Phone
,
Categories
,
Children, Directory Server
,
2
,
E-mail 3
,
Government ID Number
,
Hobby
,
Home
Fax
,
Home Phone 2
,
Internet Free/Busy Address
,
ISDN, Keywords
,
Language
,
Location
,
Middle Name
,
Mileage
,
Office Location
,
Organizational ID
Number
,
Other City
,
Other Country
,
Other Fax
,
Other Postal Code
,
Other State
,
Other Street
,
Other Street 2
,
Other Street 3
,
Pager
,
PO Box
,
Primary Phone
,
Profession
,
Radio Phone
,
Spouse
,
Suffix
,
Telex
,
TTY/TDD Phone
,
User 1
,
User 2
,
User
3
,
User 4
Contact:
Note
or Account:
Note
(In Professional, Enterprise, Unlimited, and Developer Edition organizations, you specify which fields import into a single contact or account note; separate notes are not created for each
Outlook field.)
See Also:
Preparing Your Data for Import
262
Import Your Data Preparing Your Data for Import
Field Mapping for Other Data Sources and Organization Import
Available in: All Editions except Database.com
Organization import not available in: Personal Edition, Database.com
If you are importing accounts and contacts for an organization, or importing individual data from sources other than Outlook or ACT!, the Import Wizards map the fields as correctly as possible. You must fine-tune the mapping before completing the import. Before importing your data, Salesforce recommends that you use Excel to label the columns in your import file with the labels listed below. Field length limits for each object are listed in the Salesforce Field Reference Guide .
Note: The default mappings listed below are offered as a guide for importing; they do not ensure 100% accuracy in mapping your data. You must fine-tune the mapping in the Import Wizards. Remember that you can map the same field multiple times if necessary—for example, for the account and contact address fields.
Common Fields for Contacts and Accounts
Label for Your Import File Salesforce Field
Record Owner Contact: Contact Owner and
(Note: For individual imports, this field is not necessary, since all data you import is automatically owned by you. In addition, when importing records by Salesforce record ID, this field is ignored.)
Account:
Account Owner
Currency ISO Code
Contact:
Contact Currency
and
(Note: You can use this field only for organization imports in organizations that use multiple currencies. For more
information, see Importing Multiple Currencies on page 249.)
Account:
Account Currency
Label for Your Import File
Assistant
Asst. Phone
Asst. Phone Ext.
Birthdate
Business Fax
Business Fax Ext.
Business Phone
Business Phone Ext.
Contact Fields
Salesforce Field
Contact: Assistant
Contact:
Asst. Phone
Appended to Contact:
Asst. Phone
Contact:
Birthdate
Contact: Fax
Appended to Contact:
Fax
Contact:
Phone
Appended to Contact:
Phone
263
Import Your Data Preparing Your Data for Import
Label for Your Import File
Contact Description
Contact Fields
Salesforce Field
Contact:
Description
Contact Full Name or
First Name
&
Last Name
(Note: When importing contact names, use either Contact
Full Name
or
First Name
and
Last Name
, but not both.)
Contact: First Name and
Contact:
Last Name
Contact:
Contact ID Contact ID
(Note: Record IDs are case-sensitive and should not be changed.)
Contact Note
Department
E-mail Address
(Note: The import wizard verifies this is a valid email address in the form: [email protected].)
Creates a note attached to the contact
Contact:
Department
Contact:
Email Opt Out
(Note: Use “1” to indicate that user opts out; use “0” to indicate that user wants emails.)
Contact:
Email Opt Out
Home Phone
Home Phone Ext.
Lead Source
Mailing City
Mailing Country
Mailing Postal Code
Mailing State
Mailing Street 1
Mailing Street 2
Mailing Street 3
Mobile Phone
Mobile Phone Ext.
Other City
Other Country
Other Phone
Contact: Home Phone
Appended to Contact:
Home Phone
Contact:
Lead Source
Contact:
Mailing City
Contact: Mailing Country
Contact:
Mailing Address Zip/Postal Code
Contact:
Mailing State/Province
Contact:
Mailing Address
Contact: Mailing Address
Contact:
Mailing Address
Contact:
Mobile
Appended to Contact:
Mobile
Contact: Other City
Contact:
Other Country
Contact:
Other Phone
264
Import Your Data Preparing Your Data for Import
Label for Your Import File
Other Phone Ext.
Other Postal Code
Other State
Other Street 1
Other Street 2
Contact Fields
Salesforce Field
Appended to Contact:
Other Phone
Contact: Other Address Zip/Postal Code
Contact:
Other State/Province
Contact:
Other Address
Contact:
Other Address
Other Street 3
Reports To
(Note: If the import wizard cannot find a contact that matches the name in this field, it will create a new contact using this value as the Contact:
First Name
&
Last Name
.)
Contact: Other Address
Contact:
Reports To
Salutation
Title
2nd Contact
2nd Phone
2nd Phone Ext.
2nd Title
3rd Contact
3rd Phone
3rd Phone Ext.
3rd Title
Prefixed to Contact:
First Name
Contact:
Title
Split into Contact: First Name & Last Name for a second contact for the account
Contact:
Phone
for a second contact for the account
Appended to Contact: Phone for a second contact for the account
Contact:
Title
for a second contact for the account
Split into Contact: First Name & Last Name for a third contact for the account
Contact:
Phone
for a third contact for the account
Appended to Contact: Phone for a third contact for the account
Contact:
Title
for a third contact for the account
Account Fields
Label for Your Import File Salesforce Field
Account Description
Account Division
(Note: You do not need to specify this field if you choose to assign the division via the drop-down list on Step 1 of the import wizard. If you do not map this field or use the division drop-down list, the division is set to the record owner’s default division for each record.)
Account: Description
Account:
Account Division
265
Import Your Data Preparing Your Data for Import
Account Fax
Label for Your Import File
Account Fax Ext.
Account ID
(Note: Record IDs are case-sensitive and should not be changed.)
Account Fields
Salesforce Field
Account:
Fax
Appended to Account: Fax
Account:
Account ID
Account Name Account: Account Name and
Contact:
Account
Account Note
Account Number
Account Phone
Account Phone Ext.
Account Site
Account Type
Billing City
Billing Country
Billing Postal Code
Billing State
Billing Street 1
Billing Street 2
Billing Street 3
Employees
Industry
Creates a note attached to the account
Account:
Account Number
Account:
Phone
Appended to Account: Phone
Account:
Account Site
Account:
Type
Account:
Billing City
Account: Billing Country
Account:
Billing Zip/Postal Code
Account:
Billing State/Province
Account:
Billing Address
Account: Billing Address
Account:
Billing Address
Account:
Employees
Account:
Industry
Ownership
Parent Account
(Note: If the import wizard cannot find an account that matches the parent account name, it will create a new account using this value as the
Account Name
.)
Account: Ownership
Account:
Parent Account
Parent Account Site
(Note: Indicates the site value of Parent Account .)
Rating
Account:
Account Site
(Note: Maps to the Account Site field in the parent account.)
Account:
Rating
266
Import Your Data Preparing Your Data for Import
Label for Your Import File
Revenue
Shipping City
Shipping Country
Shipping Postal Code
Shipping State
Shipping Street 1
Shipping Street 2
Shipping Street 3
SIC Code
Ticker Symbol
Website
Account Fields
Salesforce Field
Account:
Annual Revenue
Account: Shipping City
Account:
Shipping Country
Account:
Shipping Zip/Postal Code
Account:
Shipping State/Province
Account: Shipping Address
Account:
Shipping Address
Account:
Shipping Address
Account:
SIC Code
Account: Ticker Symbol
Account:
Website
Note: If you include record types in your import file, the Import Wizard uses the record owner’s default record type when creating new records. For existing records, the Import Wizard does not update the record type field.
See Also:
Preparing Your Data for Import
Field Mapping for Importing Leads
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
When you import leads, the Import My Organization’s Leads wizard and the campaign Import Leads wizard map the fields in your import file as correctly as possible, but you must fine-tune the mapping before completing the import. Prior to importing your leads, it is recommended that you use Excel to label the columns in your lead import file with the labels listed in the table below.
Note: The default mappings listed below are offered as a guide for importing; they do not ensure 100% accuracy in mapping your data. You must fine-tune the mapping in the Import Wizard.
Label for Your Import File
Annual Revenue
City
Annual Revenue
Salesforce Lead Field
City
267
Import Your Data Preparing Your Data for Import
Label for Your Import File
Company
Country
Company
Country
Currency ISO Code
(Note: You can use this field only for organizations that use
multiple currencies; see Importing Multiple Currencies
on page 249.)
Lead Currency
Salesforce Lead Field
Description Description
(The import wizard verifies this is a valid email address in the form: [email protected].)
Email Opt Out
(Use “1” to indicate that the user opts out; use “0” to indicate that the user wants emails.)
Email Opt Out
No. of Employees No. of Employees
Fax Fax
Full Name
or
First Name
&
Last Name
(Note: When importing lead names, use either Full Name or
First Name
and
Last Name
, but not both.)
First Name
and
Last Name
Industry Industry
Lead Division
(Note: You do not need to specify this field if you choose to assign the division via the drop-down list on Step 1 of the import wizard. If you do not map this field or use the division drop-down list, the division is set to the record owner’s default division for each record.)
Lead Division
Lead ID
Lead ID
(Note: Record IDs are case-sensitive and should not be changed.)
Lead Source
(Note: You do not need to specify this field if you choose to assign the same
Lead Source
to all leads on the first page of the import wizard.)
Lead Source
268
Import Your Data Preparing Your Data for Import
Lead Status
Mobile Phone
Label for Your Import File
Phone
Lead Status
Mobile
Phone
Salesforce Lead Field
Postal Code
Rating
Postal Code
Rating
Record Owner
(Note: You do not need this field if assigning ownership via a lead assignment rule. In addition, when importing records by Salesforce record ID, this field is ignored.)
Lead Owner
Salutation
State
Added to beginning of First Name
State
Status
(For campaign Import Leads wizard only.)
Street 1
Street 2
Street 3
Title
Website
Status
(in the Campaign History related list of a lead)
Address
Address
Address
Title
Website
Note:
If you include record types in this list, the Import Wizard uses the record owner’s default record type when creating new records. For existing records, the Import Wizard does not update the record type field.
If you choose to use assignment rules, the Import Wizard uses the new owner’s default record type when creating new records. When the assignment rules assign the record to a queue, the queue owner’s default record type is used.
See Also:
Import My Organization’s Leads
Preparing Your Data for Import
269
Import Your Data Accessing the Import Wizards
Accessing the Import Wizards
For Records You Own
Import wizards for records you personally own are located at Your Name > Setup > Import:
•
•
For Your Organization's Records
Import wizards for organization-wide data are located at
Your Name
> Setup > Data Management:
•
Import My Organization’s Accounts and Contacts
•
Import My Organization's Person Accounts
•
Import My Organization’s Leads
•
Import My Organization's Solutions
•
Import My Organization's Custom Objects
For Campaign Members
To access the campaign import wizards, view a campaign and click Manage Members. Then click the appropriate link:
• Add Members - Import File
• Update & Add Members - Import File
See Also:
Import My Contacts
Available in: All Editions except Database.com
With the Import My Contacts wizard, any user can import up to 500 personal contacts and associated business accounts.
correctly prepared your data (see Preparing Your Data for Import on page 256).
Note: We recommend you import a small test file first to make sure that you have prepared your import file correctly.
1. Start the wizard
Navigate to Your Name > Setup > Import > Import My Accounts & Contacts, and click Start the Import Wizard!.
Alternatively, click the Import My Accounts & Contacts link in the Tools area of the account home page. Note that the labels for business contacts and business accounts may have been renamed by your administrator, in which case the “Import
My...” links may have customized text.
270
Import Your Data Accessing the Import Wizards
2. Select the source
a. Specify the source application of your data - ACT!, Outlook, or other data source (any CSV file).
b. Click Next to continue.
3. Upload the file
a. Click Browse to load your file.
b. If importing from ACT! or Outlook, click Import Now!, or click Customize Mappings to verify the field mappings.
c. If importing from any other source, select the character encoding of the file. Most users will not need to change the default setting.
d. Choose whether to match your contacts by name or by email. This field sets the criteria for avoiding duplicates. For example, if you are matching by email and a record in your source file has the same email as a record in Salesforce, then that record will be updated in Salesforce. If you are not matching by email and there is a record in Salesforcewith the same email, then a new record will be created.
e. Choose Next to continue.
4. Map the fields
a. On four different mapping pages, the wizard associates the Salesforce field names with the field names from your import file. You must check the default mappings and alter any incorrect mappings. For more information about the
default field mappings, see Preparing Your Data for Import on page 256.
b. Note that there is no
Record Owner
field; you are automatically assigned as the owner of any data you import. On the Map Account Fields page, check the
Overwrite existing account values
box if you want to overwrite existing business account fields with your import data. Note that you cannot use this checkbox to update existing field data with blank values.
c. You can import data only into the fields that are editable for you in your page layout or field-level security settings.
d. When all fields are assigned correctly, click Next.
5. Map the miscellaneous fields
a. The wizard reports the fields that do not map.
In Professional, Enterprise, Unlimited, and Developer Edition organizations, you can choose whether the unmapped fields should be imported into an business account or contact Note or should not be imported at all. The fields are imported into a single business account Note or a single contact Note; separate note fields are not created for each import field.
b. When all fields are assigned correctly, click Import Now!.
See Also:
271
Import Your Data Accessing the Import Wizards
Import My Person Accounts
Person account import available in: Enterprise, Unlimited, and Developer Editions
To import your own person accounts:
User Permissions Needed
“Create” on accounts
AND
“Read” on contacts
AND
“Import Personal Contacts”
AND
At least one person account record type available for your profile
With the Import My Person Accounts wizard, you can import person accounts that you own. To understand how person
account records are matched to prevent duplicates, see What Is Imported for Person Accounts?
Note: Your administrator may have renamed “person account” to another term. If so, the import wizard will refer to the new name.
Follow these steps to import your person accounts. Click each link for more details.
1.
2.
3.
4.
5.
6.
Confirm and submit your import
7.
Launch the wizard
1. To import your person accounts, choose Your Name > Setup > Import > Import My Person Accounts.
Alternatively, click Import My Person Accounts in the Tools area of the accounts home page.
2. For best results, perform all of the steps provided on the introductory page.
3. Click Start the Import Wizard! to begin your import.
Prevent Duplicate Records
1. Choose the field that you are using to match existing records in Salesforce with records in your import file. The External
ID
option is disabled if no external ID fields have been created for your records.
272
Import Your Data Accessing the Import Wizards
2. Choose what you want to happen if matches are found - only import new records, only update existing records, or update existing records and import new ones.
Note: If you have chosen to match by Salesforce ID , you can only update existing records; you cannot import new ones.
3. Click Next.
Select record type
1. Choose the record type that you want to assign to the records in your import file.
2. If you are inserting new records and updating existing records at the same time, then choose whether to override the record types of existing records.
3. Click Next.
Upload your import file
1. Click Browse... to provide the location of your import file.
2. Choose the character encoding of your import file. In most cases, you can accept the default value.
3. Make additional settings depending on the setup of your organization, such as whether workflow rules will be triggered and the language of the records in the import file.
4. Click Next.
Map fields
1. Map the fields in your import file to the appropriate Salesforce fields by matching the fields on the left, which includes all the columns in your import file, with the appropriate Salesforce field on the right. If the column labels in your import file exactly match field labels in Salesforce, the wizard automatically maps those fields for you. However, if two or more of your file's column labels are identical matches with a field in Salesforce, you must map the fields manually.
Note: Some Salesforce fields cannot be updated using import, for example, the Created Date and Last
Modified Date
. So even though you may be using an exported report as your import file, some of the Salesforce fields in your file cannot be mapped.
2. Click Next. The import wizard warns you if you have not mapped all of the fields in your import file. Unmapped field values are not imported.
Confirm and submit your import
1. Read any warning messages that the import wizard displays. Optionally, click Previous to return to earlier steps and resolve potential problems.
2. Click Import Now! to submit your import request to Salesforce.
Complete your import
1. A message indicates approximately how long the import will take. When the import operation is finished, a message from
Customer Support will be sent to the email address shown.
2. Click Finish to exit the wizard.
273
Import Your Data Accessing the Import Wizards
3. To monitor the status of your pending import, click
Your Name
> Setup > Monitoring > Imports.
See Also:
Import My Organization’s Accounts and Contacts
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Editions
With the Import My Organization’s Accounts and Contacts wizard, administrators, and users with the “Modify All Data” permission, can import up to 50,000 business accounts and contacts at a time for multiple users. Before beginning, make sure you have created an export file and correctly prepared your data.
Note: We recommend you import a small test file first to make sure that you have prepared your import file correctly.
1. Start the wizard.
Go to Your Name > Setup > Data Management > Import Accounts/Contacts (or Import Business Accounts/Contacts if your organization uses person accounts). Review the steps provided on the welcome page, then click Start the Import
Wizard!. Alternatively, click the appropriate link in the Tools area of the accounts home page.
Note: If your organization uses person accounts and the labels for business accounts and business contacts have been renamed, the renamed labels will appear in the Tools area of the accounts home page, but not in the Data
Management area under Setup. (Renamed labels do not appear in any pages under App Setup or Administration
Setup.)
2. Create your import file.
a. Follow the instructions to create an import file.
b. Click Next to continue.
3. Upload the file.
a. Click Browse to load your file.
b. Select the character encoding of your file. Most users will not need to change the default character encoding setting.
c. Choose whether to match your organization’s contacts by Salesforce ID, name, or email. Similarly, choose whether to match your organization’s accounts by Salesforce ID or by name and site. Note that matching by Salesforce ID is inclusive of both contacts and accounts.
These Matching Type fields set the criteria for avoiding duplicates. For example, if you are matching by email and a record in your source file has the same email as a record in Salesforce, then that record will be updated in Salesforce.
If you are not matching by email and there is a record in Salesforce with the same email, then a new record will be created. Note that contacts are matched only within the same account. If contacts related to different accounts have the same name or email, they treated as separate contacts.
d. Organizations that use the Translation Workbench can specify the language of the import data.
274
Import Your Data Accessing the Import Wizards
e. If you use divisions, select a division to assign to all imported records. Alternatively, select “None” to use the record owner’s default division on each record, or specify the division in your import file.
f. Select the checkbox to trigger workflow rules for new and updated records that match workflow rule criteria.
g. Click Next to continue.
4. Map the fields.
a. On four different mapping pages, the wizard associates the Salesforce field names with the field names from your import file. You must check the default mappings and alter any incorrect mappings
b. Remember to map the
Record Owner
field with your
Record Owner
field so that record ownership is assigned correctly. When importing records by Salesforce record ID, the
Record Owner
field in your import file is ignored.
All records retain their existing owners; record owners cannot be updated using the import wizard.
c. On the Map Account Fields page, check the
Overwrite existing account values
box if you want to overwrite existing account fields with your import data. Note that you cannot use this checkbox to update existing field data with blank values.
d. When all fields are assigned correctly, click Next.
5. Map the miscellaneous fields.
a. The wizard reports the fields that do not map. In Professional, Enterprise, Unlimited, and Developer Edition organizations, you can choose whether the unmapped fields should be imported into an account or contact Note or should not be imported at all. The fields are imported into a single account Note or a single contact Note; separate note fields are not created for each import field.
b. When all fields are assigned correctly, click Next.
6. Review and confirm.
a. If there are warnings on this page, stop the import process and correct your import file.
b. Select Import Now! to send your import request. Your data is imported within the next 24 hours, and we notify you via email when the import is complete. Once the system begins processing, you cannot cancel the import.
7. Check the Import Queue.
a. You can use the Import Queue to check the progress of your import. Click
Your Name
> Setup > Monitoring >
Imports. Alternatively, click the Import Queue link on the Import Wizard for My Organization page. For imports that have not begun processing, you can click Del to cancel the import.
Note: If your organization uses territory management, your imported accounts are always evaluated by account assignment rules.
See Also:
Creating Export Files for Import Wizards
Preparing Your Data for Import
Creating Export Files for Import Wizards
Preparing Your Data for Import
275
Import Your Data Accessing the Import Wizards
Import My Organization's Person Accounts
Person account import available in: Enterprise, Unlimited, and Developer Editions
To import your organization's person accounts:
User Permissions Needed
“Import Person Accounts”
With the Import My Organization's Person Accounts wizard, you can import person accounts that are owned by different users. To understand how person account records are matched to prevent duplicates, see
What Is Imported for Person Accounts?
on page 243.
Note: If the label for person accounts has been renamed for your organization, the renamed label will appear in the import wizard itself and in the Tools area of the accounts home page, but not in the Data Management area under
Setup. (Renamed labels do not appear in any pages under App Setup or Administration Setup.)
Follow these steps to import person accounts for your organization.
1.
2.
3.
Specify owner and lookup relationships
4.
5.
6.
7.
Confirm and submit your import
8.
Note: The import wizard is dynamic; it displays different screens depending on what you are importing and the setup of your organization.
Launch the wizard
To import person accounts for your organization:
1. Choose
Your Name
> Setup > Data Management > Import Person Accounts.
Alternatively, click Import My Organization's Person Accounts in the Tools area of the accounts home page.
2. For best results, perform all of the steps provided on the introductory page.
3. Click Start the Import Wizard! to begin your import.
Prevent duplicate records
1. The import wizard can compare the records in your import file with existing records in Salesforce in order to prevent duplicate records from being created as a result of your import. Indicate whether you would like to prevent duplicate records from being created. You must select
Yes
in order to update existing records.
2. If you choose Yes , then additional choices will appear:
276
Import Your Data Accessing the Import Wizards
• Choose the field that you are using to match existing records in Salesforce with records in your import file. The
External ID option is disabled if no external ID fields have been created for your records.
• Choose what you want to happen if matches are found—only import new records, only update existing records, or update existing records and import new ones.
Note: If you have chosen to match by
Salesforce ID
, you can only update existing records; you cannot import new ones.
3. Click Next.
Specify owner and lookup relationships
1. Specify the field in your import file that contains person account owners.
When you choose “Name,” the following formats are valid:
• First name followed by last name
• Last name followed by first name
• Alias
• Username
2. Records can have custom fields that create lookup relationships with other records. If you have included lookup fields in your import file, then check the corresponding boxes.
Note: Any related records must already exist in Salesforce before proceeding. Related records will not be updated during your import even if your import file contains different values for fields on those related records.
3. Click Next.
Select record type
1. Choose the record type that you want to assign to the records in your import file.
2. If you are inserting new records and updating existing records at the same time, then choose whether to override the record types of existing records.
3. Click Next.
Upload your import file
1. Click Browse... to provide the location of your import file.
2. Choose the character encoding of your import file. In most cases, you can accept the default value.
3. Make additional settings depending on the setup of your organization, such as whether workflow rules will be triggered and the language of the records in the import file.
4. Click Next.
Map fields
1. Map the fields in your import file to the appropriate Salesforce fields by matching the fields on the left, which includes all the columns in your import file, with the appropriate Salesforce field on the right. If the column labels in your import file exactly match field labels in Salesforce, the wizard automatically maps those fields for you. However, if two or more of your file's column labels are identical matches with a field in Salesforce, you must map the fields manually.
277
Import Your Data Accessing the Import Wizards
Note: Some Salesforce fields cannot be updated using import, for example, the Created Date and Last
Modified Date
. So even though you may be using an exported report as your import file, some of the Salesforce fields in your file cannot be mapped.
2. Click Next. The import wizard warns you if you have not mapped all of the fields in your import file. Unmapped field values are not imported.
Confirm and submit your import
1. Read any warning messages that the import wizard displays. Optionally, click Previous to return to earlier steps and resolve potential problems.
2. Click Import Now! to submit your import request to Salesforce.
Complete your import
1. A message indicates approximately how long the import will take. When the import operation is finished, a message from
Customer Support will be sent to the email address shown.
2. Click Finish to exit the wizard.
3. To monitor the status of your pending import, click Your Name > Setup > Monitoring > Imports.
See Also:
Import My Organization’s Leads
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To use the Import My Organization's Leads wizard: “Read”, “Create”, and “Edit” on leads
AND
“Import Leads”
With the Import My Organization’s Leads wizard, administrators, users with the Marketing User profile, or users with the
“Import Leads” permission and “Read,” “Create,” and “Edit” permissions on leads can import up to 50,000 leads at a time for multiple users. Before beginning, make sure you have created an export file and correctly prepared your data.
Note: We recommend you import a small test file first to make sure that you have prepared your import file correctly.
1. Start the wizard.
Click Your Name > Setup > Data Management > Import Leads, and click Start the Import Wizard.
2. Upload the file.
278
Import Your Data Accessing the Import Wizards
a. Select Browse to load your import file.
b. If desired, select a value to import into the Lead Source field of all imported leads. Alternatively, you can assign the lead source via a
Lead Source
field in your import file. You must specify a
Lead Source
value that is not marked as “Converted”; leads with a “Converted” status will not be imported.
c. Next, choose a lead assignment rule to determine the owners of imported leads. If you have a
Record Owner
field in your import file, do not select an assignment rule. Without an assignment rule or a
Record Owner
field in your import file, all leads are assigned to the administrator doing the import. When importing records by Salesforce record ID, the
Record Owner
field in your import file is ignored. All records retain their existing owners; record owners cannot be updated using the import wizard.
d. If you have chosen an assignment rule, select the
Use assignment rule settings to send notification emails to record owners checkbox to send notification emails to owners of newly created leads. If you do not select the checkbox, no email notifications are sent, regardless of your assignment rule settings.
e. Then select the character encoding of your file. Most users do not need to change the default setting.
f. Choose whether to match your organization’s leads by Salesforce ID, name, or email. This field sets the criteria for avoiding duplicates. For example, if you are matching by email and a record in your source file has the same email as a record in Salesforce, then that record will be updated in Salesforce. If you are not matching by email and there is a record in Salesforce with the same email, then a new record will be created. Select a matching type of “None” if you do not want to de-duplicate leads; a new record will be created for every lead in your import file.
When importing new leads for a campaign, the
Matching Type
option is not available; the wizard does not merge duplicate leads.
g. Organizations that use the Translation Workbench can specify the language of the import data.
h. If you use divisions, select a division to assign to all imported records. Alternatively, select “None” to use the record owner’s default division on each record, or specify the division in your import file.
i. Select the checkbox to trigger workflow rules for new and updated records that match workflow rule criteria.
j. If your organization has multiple record types on leads, choose the active record type that will be applied to all leads in your import file. However, if you are logged in as a user who has a default lead record type selected at
Your Name
>
Setup > My Personal Information > Record Type Selection > Lead, then this drop-down list does not display and your default lead record type is automatically applied to the imported records.
k. Click Next to continue.
3. Map the fields.
a. The wizard associates the Salesforce lead field names with the field names in your import file. You must verify the default mappings and alter any incorrect mappings. Any unmapped fields are not imported.
b. If you chose to avoid duplicate leads (that is, the selected
Matching Type
is not “None”), check the
Overwrite existing lead values
box if you want to overwrite existing lead fields with your import data. Note that you cannot use this checkbox to update existing field data with blank values.
c. Click Next to continue.
4. Review and confirm.
Choose Import Now! to send your import request. Your leads are imported within the next 24 hours, and we notify you via email when the import is complete. Once the system begins processing, you cannot cancel the import.
5. Check the Import Queue.
279
Import Your Data Accessing the Import Wizards
You can use the Import Queue link to check the progress of your import. Click Your Name > Setup > Monitoring >
Imports. Alternatively, click the Import Queue link on the Import Wizard for My Organization’s Leads page. For imports that have not begun processing, you can click Del to cancel the import.
See Also:
Creating Export Files for Import Wizards
Field Mapping for Importing Leads
Creating Export Files for Import Wizards
Field Mapping for Importing Leads
Import My Organization's Custom Objects
Custom object import available in: Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Editions
To import custom objects:
User Permissions Needed
“Modify All Data”
With the Import My Organization's Custom Objects wizard, you can import custom objects.
Follow these steps to import custom objects. Click each link for more details.
1.
2.
3.
4.
Specify owner, master-detail, and lookup relationships
5.
6.
7.
8.
9.
Confirm and submit your import
10.
Note: The import wizard is dynamic; it displays different screens depending on what you are importing and the setup of your organization.
Launch the wizard
1. To import custom objects, choose Your Name > Setup > Data Management > Import Custom Objects.
2. For best results, perform all of the steps provided on the introductory page.
3. Click Start the Import Wizard! to begin your import.
280
Import Your Data Accessing the Import Wizards
Choose the custom object
1. The first step of the wizard lists the custom objects that have been defined for your organization.
2. Identify the custom object you are importing by selecting the corresponding radio button.
3. Click Next.
Prevent duplicate records
1. The import wizard can compare the records in your import file with existing records in Salesforce in order to prevent duplicate records from being created as a result of your import. Indicate whether you would like to prevent duplicate records from being created. You must select
Yes
in order to update existing records.
2. If you choose Yes , then additional choices will appear:
• Choose the field that you are using to match existing records in Salesforce with records in your import file. The
External ID
option is disabled if no external ID fields have been created for your records.
• Choose what you want to happen if matches are found—only import new records, only update existing records, or update existing records and import new ones.
Note: If you have chosen to match by Salesforce ID , you can only update existing records; you cannot import new ones.
3. Click Next.
Specify owner, master-detail, and lookup relationships
1. Custom objects can be owned by users, or they can have a master-detail relationship with other records. For example, a custom object can have a custom field that creates a master-detail relationship with accounts. In that case, your import file must include the names or IDs of all associated accounts.
• If your custom objects are owned by users, then choose the field in your import file to use for matching record owners.
When you choose “Name,” the following formats are valid:
◊ First name followed by last name
◊ Last name followed by first name
◊ Alias
◊ Username
• If your records have a master-detail relationship with another kind of record, then choose the field in your import file to use for matching master records.
2. Records can have custom fields that create lookup relationships with other records. If you have included lookup fields in your import file, then check the corresponding boxes.
Note: Any related records must already exist in Salesforce before proceeding. Related records will not be updated during your import even if your import file contains different values for fields on those related records.
3. Click Next.
Set lookup record matching
1. If you checked one or more lookup fields in the previous step, select the field (name or ID) you are using to uniquely identify those related records.
2. Click Next.
281
Import Your Data Accessing the Import Wizards
Select record type
1. If the records you are importing have record types, then choose the record type that you want to assign to the records in your import file.
2. If you are inserting new records and updating existing records at the same time, then choose whether to override the record types of existing records.
3. Click Next.
Upload your import file
1. Click Browse... to provide the location of your import file.
2. Choose the character encoding of your import file. In most cases, you can accept the default value.
3. Make additional settings depending on the setup of your organization, such as whether workflow rules will be triggered and the language of the records in the import file.
4. Click Next.
Map fields
1. Map the fields in your import file to the appropriate Salesforce fields by matching the fields on the left, which includes all the columns in your import file, with the appropriate Salesforce field on the right. If the column labels in your import file exactly match field labels in Salesforce, the wizard automatically maps those fields for you. However, if two or more of your file's column labels are identical matches with a field in Salesforce, you must map the fields manually.
Note: Some Salesforce fields cannot be updated using import, for example, the
Created Date
and
Last
Modified Date . So even though you may be using an exported report as your import file, some of the Salesforce fields in your file cannot be mapped.
2. Click Next. The import wizard warns you if you have not mapped all of the fields in your import file. Unmapped field values are not imported.
Confirm and submit your import
1. Read any warning messages that the import wizard displays. Optionally, click Previous to return to earlier steps and resolve potential problems.
2. Click Import Now! to submit your import request to Salesforce.
Complete your import
1. A message indicates approximately how long the import will take. When the import operation is finished, a message from
Customer Support will be sent to the email address shown.
2. Click Finish to exit the wizard.
3. To monitor the status of your pending import, click Your Name > Setup > Monitoring > Imports.
See Also:
What Is Imported for Custom Objects?
282
Import Your Data Accessing the Import Wizards
Import My Organization's Solutions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To import solutions:
User Permissions Needed
“Import Solutions”
With the Import My Organization's Solutions wizard, you can import solutions.
Follow these steps to import solutions. Click each link for more details.
1.
2.
Choose the type of solution (multilingual solutions only)
3.
4.
Specify author and lookup relationships
5.
6.
7.
8.
9.
Confirm and submit your import
10.
Note: The import wizard is dynamic; it displays different screens depending on what you are importing and the setup of your organization.
Launch the wizard
1. To import solutions, choose
Your Name
> Setup > Data Management > Import Solutions.
2. For best results, perform all of the steps provided on the introductory page.
3. Click Start the Import Wizard! to begin your import.
Choose the type of solution (multilingual solutions only)
1. If multilingual solutions is enabled for your organization, choose to import either master solutions or translated solutions.
You cannot import both at the same time.
For each translated solution you import, include the 15 to 18 character Solution ID field of its master solution in a master solution ID column in your import file. This will help you avoid having to manually associate translated solutions with master solutions after import. To view the
Solution ID
field for master solutions, run the Translated Solutions report.
2. Select the language of the solutions you are importing from the Language drop-down list. For each import, you can only select one language so make sure your import file includes solutions in a single language.
283
Import Your Data Accessing the Import Wizards
Prevent duplicate records
1. The import wizard can compare the records in your import file with existing records in Salesforce in order to prevent duplicate records from being created as a result of your import. Indicate whether you would like to prevent duplicate records from being created. You must select Yes in order to update existing records.
2. If you choose
Yes
, then additional choices will appear:
• Choose the field that you are using to match existing records in Salesforce with records in your import file. The
External ID option is disabled if no external ID fields have been created for your records.
• Choose what you want to happen if matches are found—only import new records, only update existing records, or update existing records and import new ones.
Note: If you have chosen to match by
Salesforce ID
, you can only update existing records; you cannot import new ones.
3. Click Next.
Specify author and lookup relationships
1. Solutions are associated with authors - the users who initially created the solutions. If you have included a column in your import file to identify authors, specify the user field it contains.
When you choose “Name,” the following formats are valid:
• First name followed by last name
• Last name followed by first name
• Alias
• Username
Choose None to specify yourself as the author of the imported solutions.
2. Records can have custom fields that create lookup relationships with other records. If you have included lookup fields in your import file, then check the corresponding boxes.
Note: Any related records must already exist in Salesforce before proceeding. Related records will not be updated during your import even if your import file contains different values for fields on those related records.
3. Click Next.
Set lookup record matching
1. If you checked one or more lookup fields in the previous step, select the field (name or ID) you are using to uniquely identify those related records.
2. Click Next.
Select record type
1. If the records you are importing have record types, then choose the record type that you want to assign to the records in your import file.
2. If you are inserting new records and updating existing records at the same time, then choose whether to override the record types of existing records.
3. Click Next.
284
Import Your Data Accessing the Import Wizards
Upload your import file
1. Click Browse... to provide the location of your import file.
2. Choose the character encoding of your import file. In most cases, you can accept the default value.
3. Make additional settings depending on the setup of your organization, such as whether workflow rules will be triggered and the language of the records in the import file.
4. Click Next.
Map fields
1. Map the fields in your import file to the appropriate Salesforce fields by matching the fields on the left, which includes all the columns in your import file, with the appropriate Salesforce field on the right. If the column labels in your import file exactly match field labels in Salesforce, the wizard automatically maps those fields for you. However, if two or more of your file's column labels are identical matches with a field in Salesforce, you must map the fields manually.
Note: Some Salesforce fields cannot be updated using import, for example, the
Created Date
and
Last
Modified Date
. So even though you may be using an exported report as your import file, some of the Salesforce fields in your file cannot be mapped.
2. Click Next. The import wizard warns you if you have not mapped all of the fields in your import file. Unmapped field values are not imported.
Confirm and submit your import
1. Read any warning messages that the import wizard displays. Optionally, click Previous to return to earlier steps and resolve potential problems.
2. Click Import Now! to submit your import request to Salesforce.
Complete your import
1. A message indicates approximately how long the import will take. When the import operation is finished, a message from
Customer Support will be sent to the email address shown.
2. Click Finish to exit the wizard.
3. To monitor the status of your pending import, click
Your Name
> Setup > Monitoring > Imports.
See Also:
285
Import Your Data Using the Import Queue
Using the Import Queue
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To use the Import Queue: “Modify All Data”
Administrators can check the Import Queue to view details about an import or to cancel an organization import. Import details are removed from the queue three days after completion.
1. Click
Your Name
> Setup > Monitoring > Imports.
2. Select the file name of the import file to see the Import Queue Detail page for that file.
If you want to cancel an import, and the import has not started processing, click Del. You cannot cancel an import after it has started processing.
The possible values of the
Status
column are listed below:
Status
Aborted
Completed
Error
Pending
Processing
Description
The import did not complete successfully. The error details are emailed to the user who performed the import. Aborted imports can be retried within three days, but, if multiple retry attempts are made, the import cannot remain in the queue for more than 30 days from the original import attempt.
The import completed successfully without errors.
The import was processed and errors were encountered. The error details are emailed to the user who performed the import. The user can fix the errors, and then attempt the import again.
The import is in the queue but has not started processing yet.
The import is in the queue and is currently being processed.
See Also:
286
Import Your Data Undoing an Import
Undoing an Import
Available in: All Editions except Database.com
User Permissions Needed
To mass delete data: “Modify All Data”
If you import accounts, contacts, leads, or solutions by mistake, your administrator can click Your Name > Setup > Data
Management > Mass Delete Records to delete the items you mistakenly imported. View the Using Mass Delete to Undo
Imports document for instructions.
The Mass Delete Records tools do not support custom objects. If you import custom objects by mistake in Enterprise,
Unlimited, or Developer Edition, your administrator can use the Data Loader to mass delete the mistakenly imported records.
See
Performing Mass Deletes on page 301.
See Also:
D
ATA
L
OADER
Data Loader Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Data Loader is a client application for the bulk import or export of data. Use it to insert, update, delete, or export Salesforce records.
When importing data, Data Loader reads, extracts, and loads data from comma separated values (CSV) files or from a database connection. When exporting data, it outputs CSV files.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
You can use Data Loader in two different ways:
• User interface—When you use the user interface, you work interactively to specify the configuration parameters, CSV files used for import and export, and the field mappings that map the field names in your import file with the field names in
Salesforce.
287
Data Loader When to Use Data Loader
• Command line—When you use the command line, you specify the configuration, data sources, mappings, and actions in files. This enables you to set up Data Loader for automated processing.
Data Loader offers the following key features:
• An easy-to-use wizard interface for interactive use
• An alternate command line interface for automated batch operations
• Support for large files with up to 5 million records
• Drag-and-drop field mapping
• Support for all objects, including custom objects
• Can be used to process data in both Salesforce and Database.com
• Detailed success and error log files in CSV format
• A built-in CSV file viewer
• Support for Windows 7
To get started, see the following topics:
•
•
Note: In previous versions, Data Loader has been known as “AppExchange Data Loader“ and “Sforce Data Loader.”
When to Use Data Loader
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Data Loader complements the web-based import wizards that are accessible from the Setup menu in the online application.
Refer to the following guidelines to determine which method best suits your business needs:
Use Data Loader when:
• You need to load 50,000 to 5,000,000 records. Data Loader is supported for loads of up to 5 million records. If you need to load more than 5 million records, we recommend you work with a salesforce.com partner or visit the App Exchange for a suitable partner product.
• You need to load into an object that is not yet supported by the import wizards.
• You want to schedule regular data loads, such as nightly imports.
• You want to export your data for backup purposes.
Use the import wizards when:
• You are loading less than 50,000 records.
• The object you need to import is supported by import wizards. To see what import wizards are available and thus what objects they support, click
Your Name
> Setup > Data Management.
• You want to prevent duplicates by uploading records according to account name and site, contact email address, or lead email address.
For more information about the import wizards, see
on page 238.
288
Data Loader Installing Data Loader
I
NSTALL AND
C
ONFIGURE
D
ATA
L
OADER
Installing Data Loader
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To access the page to download Data Loader:
User Permissions Needed
“Modify All Data”
To use Data Loader: The appropriate user permission for the operation you are doing, for example, “Create” on accounts to insert new accounts
System Requirements
To use Data Loader, you need:
• Microsoft ® Windows ® 7 or Windows XP
• 120 MB free disk space
• 256 MB available memory
• Java JRE 1.6 or later (Windows 7 or Windows XP)
• Sun JVM 1.6 or later (Windows 7 or Windows XP)
• Administrator privileges on the machine
Installation Procedure
Warning: Over time, multiple versions of the Data Loader client application have been available for download.
Different versions have different entries in the Add or Remove Programs dialog in your Windows Control Panel.
Some versions were released with earlier product names such as “AppExchange Data Loader” or “Sforce Data Loader.”
You can run different versions at the same time on one computer. However, do not install multiple copies of the same version.
The latest version is always available from Salesforce at
Your Name
> Setup > Data Management > Data Loader.
If you have previously installed the latest version and want to install it again, first remove it from your computer by using the Add or Remove Programs dialog in Windows Control Panel.
1. In the application, click Your Name > Setup > Data Management > Data Loader.
2. Click Download the Data Loader and save the installer to your PC. If you're prompted to run or save the file, click Run.
If you're then prompted to allow the program to make changes to the computer, click Yes.
3. Double-click the downloaded file to launch the InstallShield wizard.
4. Click Next.
5. Accept the license agreement and click Next.
6. Accept the default installation directory, or click Change... to choose another directory. Click Next.
7. Click Install.
289
Import Your Data Configuring Data Loader
8. Click Finish.
9. To start Data Loader, double-click the Data Loader icon on your desktop, or choose Start > All Programs > salesforce.com
> Apex Data Loader > Apex Data Loader.
Tip:
If you experience login issues in the command line interface after upgrading to a new version of Data Loader, please try re-encrypting your password to solve the problem. For information on the password encryption utility, see
Encrypting From the Command Line
on page 305.
If you want to download the source code and make changes, an open source version of Data Loader is available at https://github.com/forcedotcom/dataloader .
Login Considerations
If your organization restricts IP addresses, logins from untrusted IPs are blocked until they’re activated. Salesforce automatically sends you an activation email that you can use to log in. The email contains a security token that you must add to the end of your password. For example, if your password is mypassword , and your security token is XXXXXXXXXX , you must enter mypasswordXXXXXXXXXX to log in.
Configuring Data Loader
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Use the Settings menu to change the default operation settings of Data Loader.
1. Start Data Loader by choosing Start > Programs > salesforce.com > Data Loader > Data Loader.
2. Choose Settings > Settings.
3. Edit the fields as desired:
Field
Batch size
Insert null values
Description
In a single insert, update, upsert, or delete operation, records moving to or from Salesforce are processed in increments of this size. The maximum value is 200. We recommend a value between 50 and 100.
The maximum value is 10,000 if the Use Bulk API option is selected.
Select this option to insert blank mapped values as null values during data operations. Note that when you are updating records, this option instructs Data Loader to overwrite any existing data in mapped fields.
This option is not available if the
Use Bulk API
option is selected. Empty field values are ignored when you update records using the Bulk API. To set a field value to null when the Use Bulk API option is selected, use a field value of
#N/A
.
290
Import Your Data
Field
Assignment rule
Server host
Reset URL on Login
Compression
Timeout
Query request size
Generate status files for exports
Read all CSVs with UTF-8 encoding
Write all CSVs with UTF-8 encoding
Use European date format
Allow field truncation
Configuring Data Loader
Description
Specify the ID of the assignment rule to use for inserts, updates, and upserts. This option applies to inserts, updates, and upserts on cases and leads. It also applies to updates on accounts if your organization has territory assignment rules on accounts. The assignment rule overrides
Owner
values in your CSV file.
Enter the URL of the Salesforce server with which you want to communicate. For example, if you are loading data into a sandbox, change the URL to https://test.salesforce.com
.
By default, Salesforce resets the URL after login to the one
. To turn off this automatic reset,
disable this option.
Compression enhances the performance of Data Loader and is turned on by default. You may want to disable compression if you need to debug the underlying SOAP messages. To turn off compression, enable this option.
Specify how many seconds Data Loader waits to receive a response back from the server before returning an error for the request.
In a single export or query operation, records are returned from Salesforce in increments of this size. The maximum value is 2,000 records. Larger values may improve performance but use more memory on the client.
Select this option to generate success and error files when exporting data.
Select this option to force files to open in UTF-8 encoding, even if they were saved in a different format.
Select this option to force files to be written in UTF-8 encoding.
Select this option to support the date formats dd/MM/yyyy and dd/MM/yyyy HH:mm:ss
.
Select this option to truncate data in the following types of fields when loading that data into Salesforce: Email,
Multi-select Picklist, Phone, Picklist, Text, and Text
(Encrypted).
In Data Loader versions 14.0 and earlier, values for fields of those types are truncated by Data Loader if they are too large. In Data Loader version 15.0 and later, the load operation fails if a value is specified that is too large.
291
Import Your Data
Field
Use Bulk API
Enable serial mode for Bulk API
Upload Bulk API Batch as Zip File
Time Zone
Configuring Data Loader
Description
Selecting this option allows you to specify that the previous behavior, truncation, be used instead of the new behavior in
Data Loader versions 15.0 and later. This option is selected by default and has no effect in versions 14.0 and earlier.
This option is not available if the
Use Bulk API
option is selected. In that case, the load operation fails for the row if a value is specified that is too large for the field.
Select this option to use the Bulk API to insert, update, upsert, delete, and hard delete records. The Bulk API is optimized to load or delete a large number of records asynchronously. It’s faster than the default SOAP-based
API due to parallel processing and fewer network round-trips.
Warning: When you select the Hard Delete operation, the deleted records are not stored in the
Recycle Bin. Instead, they become immediately eligible for deletion.
Select this option to use serial instead of parallel processing for Bulk API. Processing in parallel can cause database contention. When this is severe, the load may fail. Using serial mode guarantees that batches are processed one at a time. Note that using this option may significantly increase the processing time for a load.
This option is only available if the Use Bulk API option is selected.
Select this option to use Bulk API to upload zip files containing binary attachments, such as Attachment records or Salesforce CRM Content.
This option is only available if the
Use Bulk API
option is selected.
Select this option to specify a default time zone.
If a date value does not include a time zone, this value is used.
• If no value is specified, the time zone of the computer where Data Loader is installed is used.
• If an incorrect value is entered, GMT is used as the time zone and this fact is noted in the Data Loader log.
Valid values are any time zone identifier which can be passed to the Java getTimeZone(java.lang.String) method.
292
Import Your Data Configuring Data Loader
Field
Proxy host
Proxy port
Proxy username
Proxy password
Proxy NTLM domain
Start at row
Description
The value can be a full name such as
America/Los_Angeles , or a custom ID such as
GMT-8:00
.
The host name of the proxy server, if applicable.
The proxy server port.
The username for proxy server authentication.
The password for proxy server authentication.
The name of the Windows domain used for NTLM authentication.
If your last operation failed, you can use this setting to begin where the last successful operation finished.
4. Click OK to save your settings.
See Also:
Data Loader Behavior with Bulk API Enabled
Configuring the Data Loader to Use the Bulk API
Data Loader Behavior with Bulk API Enabled
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Enabling the Bulk API in Data Loader allows you to load or delete a large number of records faster than using the default
SOAP-based API. However, there are some differences in behavior in Data Loader when you enable the Bulk API. One important difference is that it allows you to execute a hard delete if you have the permission and license. See
on page 290.
The following settings are not available on the Settings > Settings page in Data Loader when the
Use Bulk API
option is selected:
Insert null values
This option enables Data Loader to insert blank mapped values as null
values during data operations when the Bulk
API is disabled. Empty field values are ignored when you update records using the Bulk API. To set a field value to null
when the
Use Bulk API
option is selected, use a field value of
#N/A
.
293
Import Your Data Uninstalling the Data Loader
Allow field truncation
This option directs Data Loader to truncate data for certain field types when the Bulk API is disabled. A load operation fails for the row if a value is specified that is too large for the field when the
Use Bulk API
option is selected.
See Also:
Configuring the Data Loader to Use the Bulk API
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The Bulk API is optimized to load or delete a large number of records asynchronously. It is faster than the SOAP-based API due to parallel processing and fewer network round-trips. By default, Data Loader uses the SOAP-based API to process records.
To configure Data Loader to use the Bulk API for inserting, updating, upserting, deleting, and hard deleting records:
1. Start Data Loader by choosing Start > Programs > salesforce.com > Data Loader > Data Loader.
2. Choose Settings > Settings.
3. Select the
Use Bulk API
option.
4. Click OK.
Note:
• You can also select the Enable serial mode for Bulk API option. Processing in parallel can cause database contention. When this is severe, the load may fail. Using serial mode guarantees that batches are processed one at a time. Note that using this option may significantly increase the processing time for a load.
• Caution: When you select the Hard Delete operation, the deleted records are not stored in the Recycle Bin.
Instead, they become immediately eligible for deletion.
See Also:
Uninstalling the Data Loader
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To uninstall the Data Loader client application:
1. Go to Start > Control Panel > Add or Remove Programs.
2. Select the Data Loader program.
294
Data Loader
3. Click Remove. The uninstaller removes the program from your computer.
U
SE
D
ATA
L
OADER
Data Types Supported by Data Loader
Data Types Supported by Data Loader
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Data Loader supports the following data types:
Base64
String path to file (converts the file to a base64–encoded array). Base64 fields are only used to insert or update attachments and Salesforce CRM Content. For more information, see
Uploading Attachments on page 301 and
Uploading Content with the Data Loader on page 302.
Boolean
• True values (case insensitive) = yes , y , true , on , 1
• False values (case insensitive) = no , n , false , off , 0
Date Formats
We recommend you specify dates in the format yyyy-MM-ddTHH:mm:ss.SSS+/-HHmm :
• yyyy is the four-digit year
•
MM
is the two-digit month (01-12)
• dd
is the two-digit day (01-31)
• HH is the two-digit hour (00-23)
• mm is the two-digit minute (00-59)
• ss
is the two-digit seconds (00-59)
•
SSS
is the three-digit milliseconds (000-999)
• +/-HHmm
is the Zulu (UTC) time zone offset
The following date formats are also supported:
• yyyy-MM-dd'T'HH:mm:ss.SSS'Z'
• yyyy-MM-dd'T'HH:mm:ss.SSS Pacific Standard Time
• yyyy-MM-dd'T'HH:mm:ss.SSSPacific Standard Time
• yyyy-MM-dd'T'HH:mm:ss.SSS PST
• yyyy-MM-dd'T'HH:mm:ss.SSSPST
• yyyy-MM-dd'T'HH:mm:ss.SSS GMT-08:00
• yyyy-MM-dd'T'HH:mm:ss.SSSGMT-08:00
• yyyy-MM-dd'T'HH:mm:ss.SSS -800
• yyyy-MM-dd'T'HH:mm:ss.SSS-800
295
Import Your Data Data Types Supported by Data Loader
• yyyy-MM-dd'T'HH:mm:ss
• yyyy-MM-dd HH:mm:ss
• yyyyMMdd'T'HH:mm:ss
• yyyy-MM-dd
• MM/dd/yyyy HH:mm:ss
• MM/dd/yyyy
Note the following tips for date formats:
• To enable date formats that begin with the day rather than the month, select the
Use European date format box in the Settings dialog. European date formats are dd/MM/yyyy and dd/MM/yyyy HH:mm:ss .
• If your computer's locale is east of Greenwich Mean Time (GMT), we recommend that you change your computer setting to GMT in order to avoid date adjustments when inserting or updating records.
• Only dates within a certain range are valid. The earliest valid date is 1700-01-01T00:00:00Z GMT, or just after midnight on January 1, 1700. The latest valid date is 4000-12-31T00:00:00Z GMT, or just after midnight on
December 31, 4000. These values are offset by your time zone. For example, in the Pacific time zone, the earliest valid date is 1699-12-31T16:00:00, or 4:00 PM on December 31, 1699.
Double
Standard double string
ID
A Salesforce ID is a case-sensitive 15-character or case–insensitive 18-character alphanumeric string that uniquely identifies a particular record.
Tip: To ensure data quality, make sure that all Salesforce IDs you enter in Data Loader are in the correct case.
Integer
Standard integer string
String
All valid XML strings; invalid XML characters are removed.
296
Import Your Data Exporting Data
Exporting Data
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To export records:
To export all records:
User Permissions Needed
“Read” on the records
“Read” on the records
You can use the Data Loader export wizard to extract data from any Salesforce object. When you export, you can choose to include (Export All) or exclude (Export) soft-deleted records.
1. Start the Data Loader by choosing Start > Programs > salesforce.com > Data Loader > Data Loader.
2. Click Export or Export All . These commands can also be found in the File menu.
3. Enter your Salesforce username and password. Click Log in to log in. After your login completes successfully, click Next.
(Until you log out or close the program, you will not be asked to log in again.)
If your organization restricts IP addresses, logins from untrusted IPs are blocked until they’re activated. Salesforce automatically sends you an activation email that you can use to log in. The email contains a security token that you must add to the end of your password. For example, if your password is mypassword , and your security token is XXXXXXXXXX , you must enter mypasswordXXXXXXXXXX to log in.
4. Choose an object. For example, select the Account object. If your object name does not display in the default list, check
Show all objects
to see a complete list of objects that you can access. The objects will be listed by localized label name, with developer name noted in parentheses. For object descriptions, see the SOAP API Developer's Guide .
5. Click Browse... to select the CSV file to which the data will be exported. You can enter a new file name to create a new file or choose an existing file.
If you select an existing file, the contents of that file are replaced. Click Yes to confirm this action, or click No to choose another file.
6. Click Next.
7. Create a SOQL query for the data export. For example, check
Id
and
Name
in the query fields and click Finish. As you follow the next steps, you will see that the CSV viewer displays all the Account names and their IDs. SOQL is the Salesforce
Object Query Language that allows you to construct simple but powerful query strings. Similar to the SELECT command in SQL, SOQL allows you to specify the source object, a list of fields to retrieve, and conditions for selecting rows in the source object.
a. Choose the fields you want to export.
b. Optionally, select conditions to filter your data set. If you do not select any conditions, all the data to which you have read access will be returned.
c. Review the generated query and edit if necessary.
Tip: You can use a SOQL relationship query to include fields from a related object. For example:
Select Name, Pricebook2Id, Pricebook2.Name, Product2Id, Product2.ProductCode FROM
PricebookEntry WHERE IsActive = true
297
Import Your Data Defining Field Mappings
Or:
Select Id, LastName, Account.Name FROM Contact
When using relationship queries in Data Loader, the fully specified field names are case-sensitive. For example, using
ACCOUNT.NAME
instead of
Account.Name
does not work.
Data Loader doesn’t support nested queries or querying child objects. For example, queries similar to the following return an error:
SELECT Amount, Id, Name, (SELECT Quantity, ListPrice,
PriceBookEntry.UnitPrice, PricebookEntry.Name,
PricebookEntry.product2.Family FROM OpportunityLineItems)
FROM Opportunity
Also, Data Loader doesn’t support queries that make use of polymorphic relationships. For example, the following query results in an error:
SELECT Id, Owner.Name, Owner.Type, Owner.Id, Subject FROM Case
For more information on SOQL, see the Force.com SOQL and SOSL Reference .
8. Click Finish, then click Yes to confirm.
9. A progress information window reports the status of the operation.
10. After the operation completes, a confirmation window summarizes your results. Click View Extraction to view the CSV file, or click OK to close. For more details, see
Reviewing Output Files on page 303.
Note: Data Loader currently does not support the extraction of attachments. As a workaround, we recommend that you use the weekly export feature in the online application to export attachments.
Defining Field Mappings
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Whenever you insert, delete, or update files, use the Mapping Dialog window to associate Salesforce fields with the columns of your CSV file. For more information, see
Inserting, Updating, or Deleting Data Using Data Loader
on page 299.
1. To automatically match fields with columns, click Auto-Match Fields to Columns. The Data Loader automatically populates the list at the bottom of the window, based on the similarity of field and column names. Note that for a delete operation, automatic matching works only on the ID field.
2. To manually match fields with columns, click and drag fields from the list of Salesforce fields at the top to the list of CSV column header names at the bottom. For example, if you are inserting new Account records where your CSV file contains the names of new accounts, click and drag the
Name
field to the right of the
NAME
column header field.
3. Optionally, click Save Mapping to save this mapping for future use. Specify a name for the SDL mapping file.
If you select an existing file, the contents of that file are replaced. Click Yes to confirm this action, or click No to choose another file.
298
Import Your Data Inserting, Updating, or Deleting Data Using Data Loader
4. Click OK to use your mapping for the current operation.
Inserting, Updating, or Deleting Data Using Data Loader
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To insert records:
To update records:
To upsert records:
To delete records:
To hard delete records
User Permissions Needed
“Create” on the record
“Edit” on the record
“Create” or “Edit” on the record
“Delete” on the record
“Delete” on the record
The insert, update, upsert, delete, and hard delete wizards in Data Loader allow you to add new records, modify existing records, or delete existing records. Note that “upsert” is a combination of inserting and updating. If a record in your file matches an existing record, the existing record is updated with the values in your file. If no match is found, then the record is created as new. When you hard delete records, the deleted records are not stored in the Recycle Bin and become immediately eligible
for deletion. For more information, see Configuring Data Loader
on page 290.
1. Start Data Loader by choosing Start > Programs > salesforce.com > Data Loader > Data Loader.
2. Click Insert, Update, Upsert, Delete or Hard Delete. These commands can also be found in the File menu.
3. Enter your Salesforce username and password. Click Log in to log in. After your login completes successfully, click Next.
(Until you log out or close the program, you are not asked to log in again.)
If your organization restricts IP addresses, logins from untrusted IPs are blocked until they’re activated. Salesforce automatically sends you an activation email that you can use to log in. The email contains a security token that you must add to the end of your password. For example, if your password is mypassword
, and your security token is
XXXXXXXXXX
, you must enter mypasswordXXXXXXXXXX to log in.
4. Choose an object. For example, if you are inserting Account records, select Account. If your object name does not display in the default list, check Show all objects to see a complete list of the objects that you can access. The objects are listed by localized label name, with developer name noted in parentheses. For object descriptions, see the Object Reference for Salesforce and Force.com
.
5. Click Browse... to select your CSV file. For example, if you are inserting Account records, you could specify a CSV file named insertaccounts.csv
containing a Name column for the names of the new accounts.
6. Click Next. After the object and CSV file are initialized, click OK.
7. If you are performing an upsert:
a. Your CSV file must contain a column of ID values for matching against existing records. The column may be either an external ID (a custom field with the “External ID” attribute), or Id (the Salesforce record ID). From the drop-down list, select which field to use for matching. If the object has no external ID fields,
Id
is automatically used. Click Next to continue.
299
Import Your Data Inserting, Updating, or Deleting Data Using Data Loader
b. If your file includes the external IDs of an object that has a relationship to your chosen object, enable that external ID for record matching by selecting its name from the drop-down list. If you make no selection here, you can use the related object's
Id
field for matching by mapping it in the next step. Click Next to continue.
8. Define how the columns in your CSV file map to Salesforce fields. Click Choose an Existing Map to select an existing field mapping, or click Create or Edit a Map to create a new map or modify an existing map. For more details and an example of usage, see
on page 298.
9. Click Next.
10. For every operation, the Data Loader generates two unique CSV log files; one file name starts with “success,” while the other starts with “error.” Click Browse... to specify a directory for these files.
11. Click Finish to perform the operation, and then click Yes to confirm.
12. As the operation proceeds, a progress information window reports the status of the data movement.
13. After the operation completes, a confirmation window summarizes your results. Click View Successes to view your success
on page 303.
Tip:
•
If you are updating or deleting large amounts of data, review Performing Mass Updates
Deletes for tips and best practices.
• There is a five-minute limit to process 100 records when the Bulk API is enabled. Also, if it takes longer than 10 minutes to process a file, the Bulk API places the remainder of the file back in the queue for later processing. If the Bulk API continues to exceed the 10-minute limit on subsequent attempts, the file is placed back in the queue and reprocessed up to 10 times before the operation is permanently marked as failed. Even if the processing failed, some records could have completed successfully, so you must check the results. If you get a timeout error when loading a file, split your file into smaller files, and try again.
Performing Mass Updates
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To update a large number of records at one time, we recommend the following steps:
1. Obtain your data by performing an export of the objects you wish to update, or by running a report. Make sure your report includes the record ID.
2. As a backup measure, save an extra copy of the generated CSV file.
3. Open your working file in a CSV editor such as Excel, and update your data.
Updating, or Deleting Data Using Data Loader
on page 299.
6. If you made a mistake, use the backup file to update the records to their previous values.
300
Import Your Data Uploading Attachments
Performing Mass Deletes
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To delete a large number of records at one time using Data Loader, we recommend the following steps:
297.) Save an extra copy of the generated CSV file.
2. Next, export the records you wish to delete, this time using only the record ID as the desired criterion.
3. Launch the Data Loader and follow the delete or hard delete wizard. Map only the ID column. See
Inserting, Updating, or Deleting Data Using Data Loader
on page 299.
Uploading Attachments
You can use Data Loader to upload attachments to Salesforce. Before uploading attachments, note the following:
• If you intend to upload via the Bulk API, verify that
Upload Bulk API Batch as Zip File
on the Settings >
Settings page is enabled.
• If you are migrating attachments from a source Salesforce organization to a target Salesforce organization, begin by requesting a data export for the source organization. On the Schedule Export page, make sure to select the Include
Attachments...
checkbox, which causes the file
Attachment.csv
to be included in your export. You can use this
CSV file to upload the attachments. For more information on the export service, see
Exporting Backup Data on page 354.
To upload attachments:
1. Confirm that the CSV file you intend to use for attachment importing contains the following required columns (each column represents a Salesforce field):
• ParentId - the Salesforce ID of the parent record.
•
Name
- the name of the attachment file, such as myattachment.jpg
.
•
Body
- the absolute path to the attachment on your local drive.
Ensure that the values in the Body column contain the full file name of the attachments as they exist on your computer.
For example, if an attachment named myattachment.jpg
is located on your computer at
C:\Export
,
Body
must specify C:\Export\myattachment.jpg
. Your CSV file might look like this:
ParentId,Name,Body
50030000000VDowAAG,attachment1.jpg,C:\Export\attachment1.gif
701300000000iNHAAY,attachment2.doc,C:\Export\files\attachment2.doc
The CSV file can also include other optional Attachment fields, such as
Description
.
2. Proceed with an insert or upsert operation; see
Inserting, Updating, or Deleting Data Using Data Loader on page 299. At
the
Select data objects
step, make sure to select the
Show all Salesforce objects
checkbox and the
Attachment object name in the list.
301
Import Your Data Uploading Content with the Data Loader
Uploading Content with the Data Loader
Available in: Enterprise, Unlimited, and Developer Editions
You can use Data Loader to bulk upload documents and links into libraries in Salesforce CRM Content. Before uploading documents or links, note the following:
• If you intend to upload via the Bulk API, verify that
Upload Bulk API Batch as Zip File
on the Settings >
Settings page is enabled.
• When you upload a document from your local drive using Data Loader, you must specify the actual path in the
VersionData
and
PathOnClient
fields in the CSV file.
VersionData
identifies the location and extracts the format and PathOnClient identifies the type of document being uploaded.
• When you upload a link using the Data Loader, you must specify the URL in
ContentUrl
. Do not use
PathOnClient or VersionData to upload links.
• You can't export content using the Data Loader.
1. Create a CSV file with the following fields:
•
Title - file name.
• Description - (optional) file or link description.
Note: If there are commas in the description, use double quotes around the text.
•
VersionData
- complete file path on your local drive (for uploading documents only).
Note: Files are converted to base64 encoding on upload. This adds approximately 30% to the file size.
•
PathOnClient
- complete file path on your local drive (for uploading documents only).
•
ContentUrl
- URL (for uploading links only).
•
OwnerId - (optional) file owner, defaults to the user uploading the file.
• FirstPublishLocationId - library ID.
•
RecordTypeId
- content type ID.
Note: If you publish to a library that has restricted content types, you must specify
RecordTypeId
.
To determine the RecordTypeId
values for your organization using Data Loader, follow the steps in Exporting Data
.
Your SOQL query might look like this:
Select Id, Name FROM RecordType WHERE SobjectType = 'ContentVersion'
To determine the
RecordTypeId
values for your organization using the AJAX Toolkit:
a. Log in to Salesforce.
302
Import Your Data Reviewing Output Files
b. Enter this URL in your browser: http:// instanceName.salesforce.com/soap/ajax/27.0/debugshell.html
. Enter the instanceName
, such as na1
, for your organization. You can see the instanceName
in the URL field of your browser after logging in to Salesforce.
c. In the AJAX Toolkit Shell page type: sforce.connection.describeSObject("ContentVersion")
d. Press Enter.
e. Click on the arrows for recordTypeInfos .
All of the
RecordTypeId
values for your organization are listed.
•
TagsCsv
- (optional) tag.
A sample CSV file is:
Title,Description,VersionData,PathOnClient,OwnerId,FirstPublishLocationId,RecordTypeId,TagsCsv testfile,"This is a test file, use for bulk upload",c:\files\testfile.pdf,c:\files\testfile.pdf,005000000000000,058700000004Cd0,012300000008o2sAQG,one
299. All documents and links will be available in the specified library.
Reviewing Output Files
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
After every import or export, Data Loader generates two CSV output files that contain the results of the operation. One file name starts with “success,” while the other starts with “error.” During every export, Data Loader saves the extracted data to a
CSV file that you specify in the wizard. Data Loader has a built-in CSV file viewer with which you can open and view these files.
To view output files from a Data Loader operation:
1. Choose View > View CSV.
2. Specify the number of rows to view. Each row in the CSV file corresponds to one Salesforce record. The default is 1000.
3. To view a CSV file of your choice, click Open CSV. To view the last success file, click Open Success. To view the last error file, click Open Error. The CSV file opens in a new window.
4. Optionally, click Open in External Program to open the file in the associated external program, such as Microsoft ® Office
Excel.
The “success” file contains all of the records that were successfully loaded. In this file, there's a column for the newly generated record IDs. The “error” file contains all of the records that were rejected from the load operation. In this file, there's a column that describes why the load failed.
5. Click Close to return to the CSV Chooser window, and then click OK to exit the window.
303
Data Loader Troubleshooting Data Loader Operations
Note: To generate success files when exporting data, select the
Generate status files for exports
setting.
For more information, see
Configuring Data Loader on page 290.
Troubleshooting Data Loader Operations
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
If you need to investigate a problem with Data Loader, or if requested by salesforce.com Customer Support, you can access log files that track the operations and network connections made by Data Loader. The two log files are: sdl.log
Contains a detailed chronological list of Data Loader log entries. Log entries marked “INFO” are procedural items, such as logging in to Salesforce. Log entries marked “ERROR” are problems such as a submitted record missing a required field.
sdl_out.log
A supplemental log that contains additional information not captured in sdl.log. For example, it includes log entries for the creation of proxy server network connections.
These files can be opened with commonly available text editor programs, such as Microsoft Notepad.
You can quickly open these files by entering %TEMP%\sdl.log
and %TEMP%\sdl_out.log
in either the Run dialog or the Windows Explorer address bar.
If you are having login issues from the command line, ensure that the password provided in the configuration parameters is encrypted. If you are having login issues from the UI, you may need to obtain a new security token.
R
UN
B
ATCH
P
ROCESSES
Running in Batch Mode
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
You can run Data Loader in batch mode from the command line. See the following topics:
•
Understanding Installed Directories and Files
•
Encrypting From the Command Line
•
Upgrading Your Batch Mode Interface
•
Using the Command Line Interface
•
•
Data Loader Process Configuration Parameters
304
Import Your Data Understanding Installed Directories and Files
•
Data Loader Command Line Operations
•
•
•
Running Individual Batch Processes
•
Note: If you have used the batch mode from the command line with a version earlier than 8.0, see
Batch Mode Interface on page 306.
Understanding Installed Directories and Files
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
In versions 8.0 and later,
creates several directories under the installation directory. The following directories are involved in running the program from the command line for automated batch processing: bin
Contains the batch files encrypt.bat
process.bat
For information on running the Data Loader from the command line, see
Using the Command Line Interface on page
307.
conf
The default configuration directory. Contains the configuration files config.properties
,
Loader.class
, and log-conf.xml
.
The config.properties
file that is generated when you modify the Settings dialog in the graphical user interface is located at C:\Documents and Settings\your Windows username\Application
Data\salesforce.com\Data Loader version_number
. You can copy this file to the conf
installation directory to use it for batch processes.
samples
Contains subdirectories of sample files for reference.
File Path Convention
The file paths provided in these topics start one level below the installation directory. For example,
\bin
means
C:\Program
Files \salesforce.com\Data Loader version_number\bin , provided you accepted the default installation directory.
If you installed the program to a different location, please substitute that directory path as appropriate.
Encrypting From the Command Line
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When running Data Loader in batch mode from the command line, you must encrypt the following configuration parameters:
305
Import Your Data Upgrading Your Batch Mode Interface
• sfdc.password
• sfdc.proxyPassword
Use the utility described below to perform encryption.
Using the Encryption Utility
Data Loader offers an encryption utility to secure passwords specified in configuration files. This utility is used to encrypt passwords, but data that you transmit using Data Loader is not encrypted.
1. Run
\bin\encrypt.bat
.
2. At the command line, follow the prompts provided to execute the following actions:
Generate a key
Key text is generated on screen from the text you provide. Carefully copy the key text to a key file, omitting any leading or trailing spaces. The key file can then be used for encryption and decryption.
Encrypt text
Generates an encrypted version of a password or other text. Optionally, you can provide a key file for the encryption.
In the configuration file, make sure that the encrypted text is copied precisely and the key file is mentioned.
Verify encrypted text
Given encrypted and decrypted versions of a password, verifies whether the encrypted password provided matches its decrypted version. A success or failure message is printed to the command line.
Upgrading Your Batch Mode Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The batch mode interface in Data Loader versions 8.0 and later aren’t backwards-compatible with earlier versions. If you’re using a version earlier than 8.0 to run batch processes, your options are as follows:
Maintain the old version for batch use
Do not uninstall your old version of Data Loader. Continue to use that version for batch processes. You can’t take advantage of newer features such as database connectivity, but your integrations will continue to work. Optionally, install the new version alongside the old version and dedicate the old version solely to batch processes.
Generate a new config.properties file from the new GUI
If you originally generated your config.properties
file from the graphical user interface, use the new version to set the same properties and generate a new file. Use this new file with the new batch mode interface. For more information, see
Using the Command Line Interface
on page 307.
Manually update your config.properties file
If your old config.properties
file was created manually, then you must manually update it for the new version. For
more information, see Understanding Installed Directories and Files
on page 305.
306
Import Your Data Using the Command Line Interface
Using the Command Line Interface
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
For automated batch operations such as nightly scheduled loads and extractions, run Data Loader from the command line.
Before running any batch operation, be sure to include your encrypted password in the configuration file. For more information,
see Introduction on page 323 and
Encrypting From the Command Line
on page 305. From the command line, navigate to the bin
directory and type process.bat
, which takes the following parameters:
• The directory containing config.properties
.
• The name of the batch process bean contained in process-conf.xml
.
For more information about using process.bat
, see
Running Individual Batch Processes on page 323.
To view tips and instructions, add -help to the command contained in process.bat
.
Data Loader runs whatever operation, file, or map is specified in the configuration file that you specify. If you do not specify a configuration directory, the current directory is used. By default, Data Loader configuration files are installed at the following location:
C:\Program Files\salesforce.com\Data Loader version number\conf
You use the process-conf.xml
file to configure batch processing. Set the name of the process in the bean element's id attribute: (for example <bean id="myProcessName">).
If you want to implement enhanced logging, use a copy of log-conf.xml
.
You can change parameters at runtime by giving param = value as program arguments. For example, adding process.operation=insert
to the command changes the configuration at runtime.
You can set the minimum and maximum heap size. For example, -Xms256m -Xmx256m sets the heap size to 256 MB.
Note: These topics only apply to Data Loader version 8.0 and later.
Tip:
If you experience login issues in the command line interface after upgrading to a new version of Data Loader, please try re-encrypting your password to solve the problem. For information on the password encryption utility, see
Encrypting From the Command Line
on page 305.
Configuring Batch Processes
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Use \samples\conf\process-conf.xml
to configure your Data Loader processes, which are represented by ProcessRunner beans. A process should have
ProcessRunner
as the class
attribute and the following properties set in the configuration file:
307
Import Your Data name
Sets the name of the ProcessRunner bean. This value is also used as the non-generic thread name and for configuration backing files (see below).
configOverrideMap
A property of type map
where each entry represents a configuration setting: the key is the setting name; the value is the setting value.
enableLastRunOutput
If set to true (the default), output files containing information about the last run, such as sendAccountsFile_lastrun.properties
, are generated and saved to the location specified by lastRunOutputDirectory
. If set to false, the files are not generated or saved.
lastRunOutputDirectory
The directory location where output files containing information about the last run, such as sendAccountsFile_lastrun.properties
, are written. The default value is
\conf
. If enableLastRunOutput is set to false, this value is not used because the files are not generated.
The configuration backing file stores configuration parameter values from the last run for debugging purposes, and is used to load default configuration parameters in config.properties
. The settings in configOverrideMap
take precedence over those in the configuration backing file. The configuration backing file is managed programmatically and does not require any manual edits.
on page 308.
Data Loader Process Configuration Parameters
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When running Data Loader from the command line, you can specify the following configuration parameters in the process-conf.xml
file. In some cases, the parameter is also represented in the graphical user interface at Settings > Settings.
Tip: A sample process-conf.xml
file can be found in the \samples directory that's installed with Data Loader.
Parameter Name dataAccess.readUTF8
Data Loader Process Configuration Parameters
Data
Type boolean
Equivalent
Option in
Settings
Dialog
Description
Read all
CSVs with
UTF-8 encoding
Select this option to force files to open in UTF-8 encoding, even if they were saved in a different format.
Sample value: true
308
Import Your Data Data Loader Process Configuration Parameters
Parameter Name dataAccess.writeUTF8
dataAccess.name
dataAccess.readBatchSize
dataAccess.type
dataAccess.writeBatchSize
process.enableLastRunOutput
Data
Type boolean string integer string integer process.enableExtractSuccessOutput
boolean boolean
Equivalent
Option in
Settings
Dialog
Description
Write all
CSVs with
UTF-8 encoding
Select this option to force files to be written in
UTF-8 encoding.
Sample value: true
Not applicable
(N/A)
Name of the data source to use, such as a CSV file name. For databases, use the name of the database configuration in database-conf.xml
.
Sample value: c:\dataloader\data\extractLead.csv
N/A
Number of records read from the database at a time. The maximum value is 200.
Sample value:
50
N/A
Standard or custom data source type. Standard types are csvWriter
, csvRead
, databaseWrite
, and databaseRead
.
Sample value: csvWrite
N/A
Number of records written to the database at a time. The maximum value is 2,000. Note the implication for a large parameter value: if an error occurs, all records in the batch are rolled back. In contrast, if the value is set to 1, each record is processed individually (not in batch) and errors are specific to a given record. We recommend setting the value to 1 when you need to diagnose problems with writing to a database.
Sample value: 500
Generate status files for exports
Select this option to generate success and error files when exporting data.
Sample value: true
N/A
When running Data Loader in batch mode, you can disable the generation of output files such as sendAccountsFile_lastRun.properties
.
Files of this type are saved by default to the conf directory. To stop the writing of these files, set this option to false .
309
Import Your Data Data Loader Process Configuration Parameters
Parameter Name process.encryptionKeyFile
process.initialLastRunDate
process.lastRunOutputDirectory
process.loadRowToStartAt
process.mappingFile
Data
Type string
(file name) date string
(directory)
Equivalent
Option in
Settings
Dialog
Description
Alternatively, you can change the location of the directory where these files are saved, using
process.lastRunOutputDirectory
.
Sample value: true
N/A
N/A
N/A
Name of the file that contains the encryption key.
See
Encrypting From the Command Line on
page 305.
Sample value: c:\dataloader\conf\my.key
The initial setting for the process.lastRunDate
parameter, which can be used in a SQL string and is automatically updated when a process has run successfully. For
an explanation of the date format syntax, see Date
Format must be yyyy-MM-ddTHH:mm:ss.SSS+/-HHmm . For example: 2006-04-13T13:50:32.423-0700
When running Data Loader in batch mode, you can change the location where output files such as sendAccountsFile_lastRun.properties
are written. Files of this type are saved by default to the
\conf
directory. To change the location, change the value of this option to the full path where the output files should be written.
Alternatively, you can stop the files from being written, using
.
number string
(file name)
Start at row
N/A
If your last operation failed, you can use this setting to begin where the last successful operation finished.
Sample value:
1008
Name of the field mapping file to use. See
Sample value: c:\dataloader\conf\accountExtractMap.sdl
310
Import Your Data Data Loader Process Configuration Parameters
Parameter Name process.operation
process.statusOutputDirectory
process.outputError
process.outputSuccess
process.useEuropeanDates
sfdc.assignmentRule
sfdc.bulkApiCheckStatusInterval
Data
Type string string
(directory)
Equivalent
Option in
Settings
Dialog
Description
N/A
The operation to perform. See
on page 316.
Sample value: extract
N/A
The directory where “success” and “error” output files are saved. The file names are automatically generated for each operation unless you specify otherwise in process-conf.xml
.
Sample value: c:\dataloader\status string
(file name) N/A
The name of the CSV file that stores error data from the last operation.
Sample value: c:\dataloader\status\myProcessErrors.csv
string
(file name) N/A
The name of the CSV file that stores success data from the last operation. See also
process.enableExtractSuccessOutput
on page 309.
Sample value: c:\dataloader\status\myProcessSuccesses.csv
boolean string integer
Use
European date format
Select this option to support the date formats dd/MM/yyyy
Sample value:
and dd/MM/yyyy HH:mm:ss
.
true
Specify the ID of the assignment rule to use for inserts, updates, and upserts. This option applies to inserts, updates, and upserts on cases and leads.
It also applies to updates on accounts if your organization has territory assignment rules on accounts. The assignment rule overrides
Owner values in your CSV file.
Assignment rule
Sample value:
03Mc00000026J7w
N/A
The number of milliseconds to wait between successive checks to determine if the asynchronous
Bulk API operation is complete or how many records have been processed. See also
5000.
Sample value: 5000
311
Import Your Data
Parameter Name sfdc.bulkApiSerialMode
sfdc.bulkApiZipContent
sfdc.connectionTimeoutSecs
sfdc.debugMessages
sfdc.debugMessagesFile
sfdc.enableRetries
Data Loader Process Configuration Parameters
Data
Type boolean boolean integer boolean string
(file name) boolean
Equivalent
Option in
Settings
Dialog
Description
Enable serial mode for
Bulk API
Select this option to use serial instead of parallel processing for Bulk API. Processing in parallel can cause database contention. When this is severe, the load may fail. Using serial mode guarantees that batches are processed one at a time. Note that using this option may significantly increase the processing time for a load. See also
Sample value: false
Upload
Bulk API
Batch as
Zip File
Select this option to use Bulk API to upload zip files containing binary attachments, such as
Attachment records or Salesforce CRM Content.
.
Sample value: true
N/A
The number of seconds to wait for a connection during API calls.
Sample value:
60
N/A
If true, enables SOAP message debugging. By default, messages are sent to STDOUT unless you specify an alternate location in sfdc.debugMessagesFile
.
Sample value: false
N/A
See
process.enableExtractSuccessOutput
on page 309. Stores SOAP messages sent to or from Salesforce. As messages are sent or received, they are appended to the end of the file. As the file does not have a size limit, please monitor your available disk storage appropriately.
Sample value:
\lexiloader\status\sfdcSoapTrace.log
N/A
If true, enables repeated attempts to connect to
Salesforce servers. See sfdc.maxRetries
page 314 and
page 314.
Sample value: true
312
Import Your Data
Parameter Name sfdc.endpoint
sfdc.entity
sfdc.externalIdField
sfdc.extractionRequestSize
sfdc.extractionSOQL
sfdc.insertNulls
sfdc.loadBatchSize
Data Loader Process Configuration Parameters
Data
Type
URL string string integer string boolean integer
Equivalent
Option in
Settings
Dialog
Description
Server host
Enter the URL of the Salesforce server with which you want to communicate. For example, if you are loading data into a sandbox, change the
URL to https://test.salesforce.com
.
Sample production value: https://login.salesforce.com/services/Soap/u/27.0
N/A
The Salesforce object used in the operation.
Sample value:
Lead
N/A
Used in upsert operations; specifies the custom field with the “External ID” attribute that is used as a unique identifier for data matching.
Sample value: LegacySKU__c
Query request size
In a single export or query operation, records are returned from Salesforce in increments of this size. The maximum value is 2,000 records. Larger values may improve performance but use more memory on the client.
Sample value:
500
N/A
The SOQL query for the data export.
Sample value:
SELECT Id, LastName,
FirstName, Rating, AnnualRevenue,
OwnerId FROM Lead
Insert null values
Select this option to insert blank mapped values as null
values during data operations. Note that when you are updating records, this option instructs Data Loader to overwrite any existing data in mapped fields.
Sample value: false
Batch size
In a single insert, update, upsert, or delete operation, records moving to or from Salesforce are processed in increments of this size. The maximum value is 200. We recommend a value between 50 and 100.
Sample value: 100
313
Import Your Data
Parameter Name sfdc.maxRetries
sfdc.minRetrySleepSecs
sfdc.noCompression
sfdc.password
sfdc.proxyHost
sfdc.proxyPassword
sfdc.proxyPort
sfdc.proxyUsername
sfdc.resetUrlOnLogin
Data Loader Process Configuration Parameters
Data
Type integer integer
Equivalent
Option in
Settings
Dialog
Description
The maximum number of repeated attempts to connect to Salesforce. See
Sample value:
3 N/A
The minimum number of seconds to wait between connection retries. The wait time increases with each try. See
Sample value:
2 N/A
Compression enhances the performance of Data
Loader and is turned on by default. You may want to disable compression if you need to debug the underlying SOAP messages. To turn off compression, enable this option.
Compression
Sample value: false boolean encrypted string N/A
An encrypted Salesforce password that corresponds to the username provided in
. See also
Sample value:
4285b36161c65a22
URL
Proxy host
The host name of the proxy server, if applicable.
Sample value: http://myproxy.internal.company.com
encrypted string
Proxy password integer string boolean
An encrypted password that corresponds to the proxy username provided in
on page 305.
Sample value:
4285b36161c65a22
Proxy port
The proxy server port.
Sample value: 8000
Proxy username
The username for proxy server authentication.
Sample value: jane.doe
Reset URL on Login
By default, Salesforce resets the URL after login
to the one specified in sfdc.endpoint
. To turn
314
Import Your Data
Parameter Name sfdc.timeoutSecs
sfdc.timezone
sfdc.truncateFields
Data Loader Process Configuration Parameters
Data
Type integer
Equivalent
Option in
Settings
Dialog
Description off this automatic reset, disable this option by setting it to false
.
Valid values: true (default), false
Timeout
Specify how many seconds Data Loader waits to receive a response back from the server before returning an error for the request.
Sample value:
540 string boolean
If a date value does not include a time zone, this value is used.
• If no value is specified, the time zone of the computer where Data Loader is installed is used.
• If an incorrect value is entered, GMT is used as the time zone and this fact is noted in the
Data Loader log.
Valid values are any time zone identifier which can be passed to the Java getTimeZone(java.lang.String)
method.
The value can be a full name such as
America/Los_Angeles
, or a custom ID such as
GMT-8:00
.
Time Zone
You can retrieve the default value by running the
TimeZone.getDefault()
method in Java.
This value is the time zone on the computer where Data Loader is installed.
Select this option to truncate data in the following types of fields when loading that data into
Salesforce: Email, Multi-select Picklist, Phone,
Picklist, Text, and Text (Encrypted).
In Data Loader versions 14.0 and earlier, values for fields of those types are truncated by Data
Loader if they are too large. In Data Loader version 15.0 and later, the load operation fails if a value is specified that is too large.
Allow field truncation
Selecting this option allows you to specify that the previous behavior, truncation, be used instead of the new behavior in Data Loader versions 15.0
315
Import Your Data
Parameter Name sfdc.useBulkApi
sfdc.username
Data Loader Command Line Operations
Data
Type boolean
Equivalent
Option in
Settings
Dialog
Description and later. This option is selected by default and has no effect in versions 14.0 and earlier.
This option is not available if the Use Bulk
API
option is selected. In that case, the load operation fails for the row if a value is specified that is too large for the field.
Sample value: true
Use Bulk
API
Select this option to use the Bulk API to insert, update, upsert, delete, and hard delete records.
The Bulk API is optimized to load or delete a large number of records asynchronously. It’s faster than the default SOAP-based API due to parallel processing and fewer network round-trips. See also
Sample value: true string N/A
Salesforce username. See sfdc.password
.
Sample value: [email protected]
Data Loader Command Line Operations
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When running Data Loader in batch mode from the command line, several operations are supported. An operation represents the flow of data between Salesforce and an external data source such as a CSV file or a database. See the following list of operation names and descriptions.
Extract
Uses a Salesforce Object Query Language to export a set of records from Salesforce, then writes the exported data to a data source. Soft-deleted records are not included.
Extract All
Uses a Salesforce Object Query Language to export a set of records from Salesforce, including both existing and soft-deleted records, then writes the exported data to a data source.
Insert
Loads data from a data source into Salesforce as new records.
316
Import Your Data Configuring Database Access
Update
Loads data from a data source into Salesforce, where existing records with matching ID fields are updated.
Upsert
Loads data from a data source into Salesforce, where existing records with a matching custom external ID field are updated; records without matches are inserted as new records.
Delete
Loads data from a data source into Salesforce, where existing records with matching ID fields are deleted.
Hard Delete
Loads data from a data source into Salesforce, where existing records with matching ID fields are deleted without being stored first in the Recycle Bin.
Configuring Database Access
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When you run Data Loader in batch mode from the command line, use \samples\conf\database-conf.xml
to configure database access objects, which you use to extract data directly from a database.
DatabaseConfig Bean
The top-level database configuration object is the DatabaseConfig bean, which has the following properties: sqlConfig
The
for the data access object that interacts with a database.
dataSource
The bean that acts as database driver and authenticator. It must refer to an implementation of javax.sql.DataSource
such as org.apache.commons.dbcp.BasicDataSource
.
The following code is an example of a DatabaseConfig bean:
<bean id="AccountInsert" class="com.salesforce.dataloader.dao.database.DatabaseConfig" singleton="true">
<property name="sqlConfig" ref="accountInsertSql"/>
</bean>
DataSource
The
DataSource
bean sets the physical information needed for database connections. It contains the following properties: driverClassName
The fully qualified name of the implementation of a JDBC driver.
url
The string for physically connecting to the database.
317
Import Your Data Configuring Database Access username
The username for logging in to the database.
password
The password for logging in to the database.
Depending on your implementation, additional information may be required. For example, use org.apache.commons.dbcp.BasicDataSource
when database connections are pooled.
The following code is an example of a DataSource bean:
<bean id="oracleRepDataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
<property name="driverClassName" value="oracle.jdbc.driver.OracleDriver"/>
<property name="url" value="jdbc:oracle:thin:@myserver.salesforce.com:1521:TEST"/>
<property name="username" value="test"/>
<property name="password" value="test"/>
</bean>
See Also:
Spring Framework Overview
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The Data Loader configuration files are based on the Spring Framework , which is an open source full-stack Java/J2EE application framework.
The Spring Framework allows you to use XML files to configure beans. Each bean represents an instance of an object; the parameters correspond to each object's setter methods. A typical bean has the following attributes: id
Uniquely identifies the bean to
XmlBeanFactory
, which is the class that gets objects from an XML configuration file.
class
Specifies the implementation class for the bean instance.
For more information on the Spring Framework, see the official documentation and the support forums . Note that salesforce.com
cannot guarantee the availability or accuracy of external websites.
See Also:
318
Import Your Data Configuring Database Access
Data Access Objects
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When running Data Loader in batch mode from the command line, several data access objects are supported. A data access object allows access to an external data source outside of Salesforce. They can implement a read interface (
DataReader
), a write interface ( DataWriter ), or both. See the following list of object names and descriptions.
csvRead
Allows the reading of a comma or tab-delimited file. There should be a header row at the top of the file that describes each column.
csvWrite
Allows writing to a comma-delimited file. A header row is added to the top of the file based on the column list provided by the caller.
databaseRead
Allows the reading of a database. Use database-conf.xml
to configure database access.
databaseWrite
Allows writing to a database. Use database-conf.xml
to configure database access.
See Also:
SQL Configuration
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When running Data Loader in batch mode from the command line, the
SqlConfig
class contains configuration parameters for accessing specific data in the database. As shown in the code samples below, queries and inserts are different but very similar. The bean must be of type com.salesforce.dataloader.dao.database.SqlConfig
and have the following properties: sqlString
The SQL code to be used by the data access object.
The SQL can contain replacement parameters that make the string dependent on configuration or operation variables.
Replacement parameters must be delimited on both sides by “@” characters. For example,
@process.lastRunDate@
.
sqlParams
A property of type map that contains descriptions of the replacement parameters specified in sqlString . Each entry represents one replacement parameter: the key is the replacement parameter's name, the value is the fully qualified Java
319
Import Your Data Configuring Database Access type to be used when the parameter is set on the SQL statement. Note that “java.sql” types are sometimes required, such as java.sql.Date
instead of java.util.Date
. For more information, see the official JDBC API documentation .
columnNames
Used when queries (
SELECT
statements) return a JDBC
ResultSet
. Contains column names for the data outputted by executing the SQL. The column names are used to access and return the output to the caller of the
DataReader interface.
SQL Query Bean Example
<bean id="accountMasterSql" class="com.salesforce.dataloader.dao.database.SqlConfig" singleton="true">
<property name="sqlString"/>
<value>
SELECT distinct
'012x00000000Ij7' recordTypeId, accounts.account_number, org.organization_name, concat (concat(parties.address1, ' '), parties.address2) billing_address, locs.city, locs.postal_code, locs.state, locs.country, parties.sic_code
from ar.hz_cust_accounts accounts, ar.hz_organization_profiles org, ar.hz_parties parties, ar.hz_party_sites party_sites, ar.hz_locations locs where accounts.PARTY_ID = org.PARTY_ID
and parties.PARTY_ID = accounts.PARTY_ID
and party_sites.PARTY_ID = accounts.PARTY_ID
and locs.LOCATION_ID = party_sites.LOCATION_ID
and (locs.last_update_date > @process.lastRunDate@ OR accounts.last_update_date > @process.lastRunDate@
</value>
</property>
<property name="columNames">
<list>
<value>recordTypeId</value>
<value>account_number</value>
<value>organization_name</value>
<value>billing_address</value>
<value>city</value>
<value>postal_code</value>
<value>state</value>
<value>country</value>
<value>sic_code</value>
</list>
</property>
<property name="sqlParams">
<map>
<entry key="process.lastRunDate" value="java.sql.Date"/>
</map>
</property>
</bean>
320
Import Your Data
SQL Insert Bean Example
<bean id="partiesInsertSql" class="com.salesforce.dataloader.dao.database.SqlConfig" singleton="true">
<property name="sqlString"/>
<value>
INSERT INTO REP.INT_PARTIES (
BILLING_ADDRESS, SIC_CODE)
VALUES (@billing_address@, @sic_code@)
</value>
</property>
<property name="sqlParams"/>
<map>
<entry key="billing_address" value="java.lang.String"/>
<entry key="sic_code" value="java.lang.String"/>
</map>
</property>
</bean>
Mapping Columns
See Also:
Mapping Columns
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When running Data Loader in batch mode from the command line, you must create a properties file that maps values between
Salesforce and data access objects.
1. Create a new mapping file and give it an extension of .sdl
.
2. Observe the following syntax:
• On each line, pair a data source with its destination.
• In an import file, put the data source on the left, an equals sign (=) as a separator, and the destination on the right. In an export file, put the destination on the left, an equals sign (=) as a separator, and the data source on the right.
• Data sources can be either column names or constants. Surround constants with double quotation marks, as in
“sampleconstant”. Values without quotation marks are treated as column names.
• Destinations must be column names.
• You may map constants by surrounding them with double quotation marks, as in:
"Canada"=BillingCountry
3. In your configuration file, use the parameter process.mappingFile
to specify the name of your mapping file.
Note: If your field name contains a space, you must escape the space by prepending it with a backslash (
\
). For example:
Account\ Name=Name
321
Import Your Data Mapping Columns
Column Mapping Example for Data Insert
The Salesforce fields are on the right.
SLA__C=SLA__c
BILLINGCITY=BillingCity
SYSTEMMODSTAMP=
OWNERID=OwnerId
CUSTOMERPRIORITY__C=CustomerPriority__c
ANNUALREVENUE=AnnualRevenue
DESCRIPTION=Description
BILLINGSTREET=BillingStreet
SHIPPINGSTATE=ShippingState
Column Mapping Example for Data Export
The Salesforce fields are on the left.
Id=account_number
Name=name
Phone=phone
Column Mapping for Constant Values
Data Loader supports the ability to assign constants to fields when you insert, update, and export data. If you have a field that should contain the same value for each record, you specify that constant in the
.sdl
mapping file instead of specifying the field and value in the CSV file or the export query.
The constant must be enclosed in double quotation marks. For example, if you’re importing data, the syntax is
"constantvalue"=field1 .
If you have multiple fields that should contain the same value, you must specify the constant and the field names separated by commas. For example, if you’re importing data, the syntax would be
"constantvalue"=field1, field2
.
Here’s an example of an
.sdl
file for inserting data. The Salesforce fields are on the right. The first two lines map a data source to a destination field, and the last three lines map a constant to a destination field.
Name=Name
NumEmployees=NumberOfEmployees
"Aerospace"=Industry
"California"=BillingState, ShippingState
"New"=Customer_Type__c
A constant must contain at least one alphanumeric character.
Note: If you specify a constant value that contains spaces, you must escape the spaces by prepending each with a backslash (
\
). For example:
"Food\ &\ Beverage"=Industry
322
Data Loader Running Individual Batch Processes
Running Individual Batch Processes
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To start an individual batch process use \bin\process.bat
, which requires the following parameters:
A configuration directory
The default is
\conf
.
To use an alternate directory, create a new directory and add the following files to it:
• If your process is not interactive, copy process-conf.xml
from \samples\conf .
• If your process requires database connectivity, copy database-conf.xml
from
\samples\conf
.
• Copy config.properties
from
\conf
.
A process name
The name of the ProcessRunner bean from
\samples\conf\process-conf.xml
.
Process Example process ../conf accountMasterProcess
Note: You can configure external process launchers such as the Microsoft Windows XP Scheduled Task Wizard to run processes on a schedule.
C
OMMAND
L
INE
Q
UICK
S
TART
Introduction
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Watch a Demo: Importing Accounts Using the Data Loader Command Line Interface (5:20 minutes)
In addition to using Data Loader interactively to import and export data, you can also run it from the command line. This enables you to automate the import and export of data.
This quick start shows you how to use the Data Loader command line functionality to import data. You'll follow these steps:
•
Step 1: Create the encryption key
•
Step 2: Create the encrypted password for your login username
323
Import Your Data Prerequisites
•
Step 3: Create the Field Mapping File
•
Step 4: Create a process-conf.xml
file that contains the import configuration settings
•
Step 5: Run the process and import the data
Prerequisites
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To step through this quick start, you should have the following:
• Data Loader installed on the computer that runs the command line process.
• The Java Runtime Environment (JRE) installed on the computer that runs the command line process.
• Familiarity with importing and exporting data by using the Data Loader interactively through the user interface. This makes it easier to understand how the command line functionality works.
Tip: When you install Data Loader, sample files are installed in the samples directory. This directory is found below the program directory, for example, C:\Program Files (x86)\salesforce.com\Apex Data Loader
22.0\samples\
. Examples of files that are used in this quick start can be found in the
\samples\conf
directory.
Step One: Create the Encryption Key
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
When you use Data Loader from the command line, there’s no user interface. Therefore, you’ll need to provide the information that you would normally enter in the user interface by using a text file named process-conf.xml
. For example, you’ll need to add to this file the username and password that Data Loader uses to log in to Salesforce. The password must be encrypted before you add it to the process-conf.xml
file, and creating the key is the first step in that process.
1. Open a command prompt window by clicking Start > All Programs > Accessories > Command Prompt. Alternatively, you can click Start > Run, enter cmd in the Open field, and click OK.
2. In the command window enter cd\ to navigate to the root directory of the drive where Data Loader is installed.
3. Navigate to the Data Loader \bin directory by entering this command. Be sure to replace the file path with the path from your system.
cd C:\Program Files (x86)\salesforce.com\Apex Data Loader 22.0\bin
4. Create an encryption key by entering the following command. Replace <seedtext> with any string.
encrypt.bat —g <seedtext>
324
Import Your Data Step Two: Create the Encrypted Password
Note: To see a list of command-line options for encrypt.bat
, type encrypt.bat
from the command line.
5. Copy the generated key from the command window to a text file named key.txt
and make a note of the file path. In this example, the generated key is e8a68b73992a7a54
.
Note: Enabling quick edit mode on a command window can make it easier to copy data to and from the window.
To enable quick edit mode, right-click the top of the window and select Properties. On the Options tab, select
QuickEdit Mode.
The encryption utility is used to encrypt passwords, but data that you transmit using Data Loader is not encrypted.
See Also:
Step Two: Create the Encrypted Password
Step Two: Create the Encrypted Password
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
In this step, you’ll create the encrypted password using the key that you generated in the previous step.
1. In the same command prompt window, enter the following command. Replace <password>with the password that Data
Loader uses to log in to Salesforce. Replace <filepath> with the file path to the key.txt
file that you created in the previous step.
encrypt.bat –e <password> "<filepath>\key.txt"
325
Import Your Data Step Three: Create the Field Mapping File
2. Copy the encrypted password that is generated by the command. You'll use this value in a later step.
See Also:
Step Three: Create the Field Mapping File
Step Three: Create the Field Mapping File
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The field mapping file associates data sources with destinations. This is a text file, typically with an .sdl
file extension.
1. Copy the following to a text file and save it with a name of accountInsertMap.sdl
. This is a data insert so the data source is on the left of the equals sign and the destination field is on the right.
#Mapping values
#Thu May 26 16:19:33 GMT 2011
Name=Name
NumberOfEmployees=NumberOfEmployees
Industry=Industry
Tip: For complex mappings, you can use the Data Loader user interface to map source and destination fields and then save those mappings to an .sdl
file. This is done on the Mapping dialog box by clicking Save Mapping.
See Also:
Step Four: Create the Configuration File
Step Four: Create the Configuration File
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The process-conf.xml
file contains the information that Data Loader needs to process the data. Each <bean> in the process-conf.xml
file refers to a single process such as an insert, upsert, export, and so on. Therefore, this file can contain multiple processes. In this step, you'll edit the file to insert accounts into Salesforce.
1. Make a copy of the process-conf.xml
file from the \samples\conf directory. Be sure to maintain a copy of the original because it contains examples of other types of Data Loader processing such as upserts and exports.
2. Open the file in a text editor and replace the contents with the following XML:
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN"
"http://www.springframework.org/dtd/spring-beans.dtd">
<beans>
<bean id="accountInsert"
326
Import Your Data Step Four: Create the Configuration File class="com.salesforce.dataloader.process.ProcessRunner" singleton="false">
<description>accountInsert job gets the account record from the CSV file and inserts it into Salesforce.</description>
<property name="name" value="accountInsert"/>
<property name="configOverrideMap">
<map>
<entry key="sfdc.debugMessages" value="true"/>
<entry key="sfdc.debugMessagesFile" value="C:\DLTest\Log\accountInsertSoapTrace.log"/>
<entry key="sfdc.endpoint" value="https://servername.salesforce.com"/>
<entry key="sfdc.username" value="[email protected]"/>
<!--Password below has been encrypted using key file, therefore, it will not work without the key setting: process.encryptionKeyFile.
The password is not a valid encrypted value, please generate the real value using the encrypt.bat utility -->
<entry key="sfdc.password" value="e8a68b73992a7a54"/>
<entry key="process.encryptionKeyFile" value="C:\DLTest\Command Line\Config\key.txt"/>
<entry key="sfdc.timeoutSecs" value="600"/>
<entry key="sfdc.loadBatchSize" value="200"/>
<entry key="sfdc.entity" value="Account"/>
<entry key="process.operation" value="insert"/>
<entry key="process.mappingFile" value="C:\DLTest\Command Line\Config\accountInsertMap.sdl"/>
<entry key="dataAccess.name" value="C:\DLTest\In\insertAccounts.csv"/>
<entry key="process.outputSuccess" value="c:\DLTest\Log\accountInsert_success.csv"/>
<entry key="process.outputError" value="c:\DLTest\Log\accountInsert_error.csv"/>
<entry key="dataAccess.type" value="csvRead"/>
<entry key="process.initialLastRunDate" value="2005-12-01T00:00:00.000-0800"/>
</map>
</property>
</bean>
3. Modify the following parameters in the process-conf.xml
file. For more information about the process configuration parameters, see
Data Loader Process Configuration Parameters on page 308.
• sfdc.endpoint
—Enter the URL of the Salesforce instance for your organization; for example, https://na1.salesforce.com
.
• sfdc.username
—Enter the username Data Loader uses to log in.
• sfdc.password
—Enter the encrypted password value that you created in step 2.
• process.mappingFile
—Enter the path and file name of the mapping file.
• dataAccess.Name
—Enter the path and file name of the data file that contains the accounts that you want to import.
• sfdc.debugMessages
—Currently set to true for troubleshooting. Set this to false after your import is up and running.
• sfdc.debugMessagesFile
—Enter the path and file name of the command line log file.
• process.outputSuccess
—Enter the path and file name of the success log file.
• process.outputError
—Enter the path and file name of the error log file.
327
Import Your Data Step Five: Import the Data
Warning: Use caution when using different XML editors to edit the process-conf.xml
file. Some editors add XML tags to the beginning and end of the file which will cause the import to fail.
See Also:
Step Five: Import the Data
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
To insert records:
To update records:
To upsert records:
To delete records:
To hard delete records:
User Permissions Needed
“Create” on the record
“Edit” on the record
“Create” or “Edit” on the record
“Delete” on the record
“Delete” on the record
Now that all the pieces are in place, you can run Data Loader from the command line and insert some new accounts.
1. Copy the following data to a file name accountInsert.csv
. This is the account data that you'll import into your organization.
Name,Industry,NumberOfEmployees
Dickenson plc,Consulting,120
GenePoint,Biotechnology,265
Express Logistics and Transport,Transportation,12300
Grand Hotels & Resorts Ltd,Hospitality,5600
2. In the command prompt window, enter the following command: process.bat "<file path to process-conf.xml>" <process name>
• Replace <file path to process-conf.xml> with the path to the directory containing process-conf.xml
.
• Replace <process name> with the process specified in process-conf.xml
.
Your command should look something like this: process.bat "C:\DLTest\Command Line\Config" accountInsert
After the process runs, the command prompt window displays success and error messages. You can also check the log files: insertAccounts_success.csv
and insertAccounts_error.csv
. After the process runs successfully, the insertAccounts_success.csv
file will contain the records that you imported along with the ID and status of each
record. For more information about the status files, see Reviewing Output Files on page 303.
328
Data Loader Data Loader Third-Party Licenses
Data Loader Third-Party Licenses
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The following third-party licenses are included with the installation of Data Loader:
Technology
Apache Jakarta Commons
BeanUtils
Apache Commons Collections
Version Number
1.6
Apache Commons Database
Connection Pooling (DBCP)
Apache Commons Logging
3.1
1.2.1
1.0.3
Apache Commons Object Pooling
Library
1.2
Apache Log4j 1.2.8
Eclipse SWT 3.452
OpenSymphony Quartz Enterprise
Job Scheduler
1.5.1
Rhino JavaScript for Java
Spring Framework
1.6R2
1.2.6
License http://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/LICENSE-1.1
http://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/LICENSE-2.0
http://www.eclipse.org/legal/epl-v10.html
http://www.opensymphony.com/quartz/license.action
http://www.mozilla.org/MPL/MPL-1.1.txt
http://www.apache.org/licenses/LICENSE-2.0.txt
Note: Salesforce.com is not responsible for the availability or content of third-party websites.
I
MPORTING
FAQ
General Importing Questions
Available in: All Editions.
•
Can I mass upload data into Salesforce?
•
Should I use the import wizards or Connect for Outlook to upload my data into Salesforce?
329
Import Your Data General Importing Questions
•
Who in my organization can use the import wizards?
•
What permissions do I need to import records?
•
What file formats can the import wizards handle?
•
•
Are there size restrictions on my import data?
•
Why can’t I log in to Data Loader?
•
Why isn’t Data Loader importing special characters?
•
Can I import into custom fields?
•
Can I import into fields that are not on my page layout?
•
What's the difference between importing data into a custom field or into a picklist?
•
Can I delete my imported data if I make a mistake?
•
How do I update records using the Import Wizard?
•
Why do date fields import incorrectly when I use the Data Loader?
•
What does the Import Queue show me?
•
How long does it take to import a file?
•
Why might there be a delay in importing my file?
•
Can I import amounts in different currencies?
•
Can Customer Support help me import my data?
•
Can I import data in more than one language?
•
How do I perform mass updates to records?
•
How do I update fields with blank values?
•
See Also:
Importing Business Accounts and Contacts
Can I mass upload data into Salesforce?
Professional, Unlimited, Enterprise, and Developer editions have a mass import wizard for accounts, contacts, leads, and custom objects that will allow you to mass import data. In addition, Unlimited, Enterprise, and Developer editions have API access to use database mass upload tools like Data Loader.
330
Import Your Data General Importing Questions
Should I use the import wizards or Connect for Outlook to upload my data into Salesforce?
In organizations that do not use person accounts:
If you want to upload accounts and contacts for multiple users at one time, your administrator should use the Import
My Organization’s Accounts and Contacts wizard. If you want to upload your own contacts from any application other than Outlook, you should use the Import My Contacts wizard.
If you use Microsoft Outlook and want to keep your Outlook contacts, accounts, and calendar events up to date with
Salesforce, we recommend you use Salesforce for Outlook to initially sync your data and for all subsequent updates. You can also sync your Outlook data, including tasks, using Connect for Outlook.
For custom objects, leads, and solutions, your administrator must use the respective import wizard to import those kinds of records into Salesforce. You can't sync those records using Salesforce for Outlook or Connect for Outlook.
In organizations that use person accounts:
Person accounts are not supported in Salesforce for Outlook or Connect for Outlook.
If you want to upload person accounts for multiple users at one time, your administrator should use the Import My
Organization’s Person Accounts wizard. If you want to upload business accounts and contacts for multiple users at one time, your administrator should use the Import My Organization’s Business Account/Contacts wizard. If you want to upload your own person accounts, you should use the Import My Person Accounts wizard. If you want to upload your own contacts from any application other than Outlook, you should use the Import My Contacts wizard.
For custom objects, leads, and solutions, your administrator must use the respective import wizard to import those kinds of records into Salesforce.
Who in my organization can use the import wizards?
All users in your organization can use the Import My Contacts wizard. In Enterprise, Unlimited, or Developer Edition organizations with person accounts enabled, all users can use the Import My Person Accounts wizard.
Only an administrator can use the organization-wide “Import My Organization's” wizards to import accounts, contacts, leads, solutions, or custom objects for multiple users at one time. In Personal Edition, none of the organization-wide wizards are available. In Contact Manager and Group Edition, the “Import My Organization's Leads” and “Import My Organization's
Solutions” wizards are not available.
What permissions do I need to import records?
Data Loader
To import records with the Data Loader, you need “Create” permission on the record you want to import.
Import Wizard for Records You Own
Records being imported
My Contacts
Access needed
Any user
331
Import Your Data General Importing Questions
Records being imported
My Person Accounts
Access needed
“Create” on accounts
AND
“Read” on contacts
AND
“Import Personal Contacts”
AND
At least one person account record type available for your profile
Import Wizard for Records Owned By Other Users
Records being imported
My Organization’s Accounts and Contacts
My Organization’s Person Accounts
My Organization’s Leads
My Organization’s Solutions
My Organization’s Custom Objects
Access needed
Administrators
Users with the “Modify All Data” permission
Any user with “Import Person Accounts” permission
“Read”, “Create”, and “Edit” on leads
AND
“Import Leads”
Any user with “Import Solutions” permission
Any user with “Modify All Data” permission
Import Wizard for Campaign Members
Records being imported
New Campaign Members (Lead Import Wizard)
Updated Campaign Members (Campaign Update Wizard)
Access needed
“Edit” on campaigns
AND
Marketing User
checked in your user information
AND
“Import Leads”
“Edit” on campaigns
AND
“Import Leads”
AND
“Read” on contacts
Marketing User
checked in your user information
332
Import Your Data General Importing Questions
What file formats can the import wizards handle?
You can import contacts and business accounts directly from an ACT! or Outlook file, or from any CSV (comma-separated values) file, such as a GoldMine or Excel file. You can import leads, solutions, custom objects, or person accounts from any
CSV file.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
What data can be imported?
You can use import wizards to import the following records:
Contacts and business accounts
Use the Import My Contacts wizard and the Import My Organization’s Accounts and Contacts wizard to import contacts and business accounts. In organizations with person accounts, note that the Import My Organization’s Accounts and
Contacts wizard is called the Import My Organization’s Business accounts/Contacts wizard.
In Professional, Enterprise, Unlimited, and Developer Edition organizations, you can also import contact and business account notes.
Person accounts
In Enterprise, Unlimited, and Developer Edition organizations, use the Import My Person Accounts wizard to import person accounts that you own. Administrators can use the Import My Organization's Person Accounts wizard to import person accounts for multiple users.
Leads
In Professional, Enterprise, Unlimited, and Developer Edition organizations, use the Import My Organization’s Leads wizard to import leads.
Solutions
In Professional, Enterprise, Unlimited, and Developer Edition organizations, use the Import My Organization's Solutions wizard to import solutions.
Custom objects
In Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Edition organizations, use the Import
My Organization's Custom Objects wizard to import custom objects.
In the “Import My Organization's...” wizards for accounts, contacts, leads, solutions, and custom objects, administrators can import into any of the listed fields, even if a field is hidden or read-only in their page layout or field-level security settings.
Individual users can import only into the fields that are accessible to them via their page layout or field-level security settings.
Import wizards for other records are not available.
333
Import Your Data General Importing Questions
Are there size restrictions on my import data?
Yes. Your import file cannot exceed 100MB in size, and each record in the file cannot be bigger than 400KB. In addition, each imported note and each imported description cannot exceed 32KB. Descriptions longer than 32KB are truncated.
In addition to the import file limits, your import is also subject to the overall storage limits for your organization. Note that the size of your import file does not directly correlate to the storage space needed for those records. For example, an import file of 50MB in size may not create 50MB of data in Salesforce.
Why can’t I log in to Data Loader?
If you’re having trouble logging in to Data Loader, try the following solutions.
• Add a security key to the end of your password to log in to Data Loader.
• Change the Server host to point to the appropriate server in Data Loader by following these steps:
1. Start the Data Loader by navigating to Start > Programs > salesforce.com > Data Loader > Data Loader.
2. Navigate to Settings > Settings.
3. Set
Server host
to https://instance_name.salesforce.com
, where instance_name
is the Salesforce instance you’re on.
4. Click OK to save your settings.
• Ask your administrator whether you’re working behind a proxy server. If so, adjust your Data Loader settings. If you’re using APIs that are behind a proxy server, the proxy server prevents the APIs from connecting with Salesforce servers; you won’t see information about the APIs under Login History.
Why isn’t Data Loader importing special characters?
If Data Loader fails to import special characters such as ö, ñ, or é, your source data file might not be properly encoded. To ensure the file is properly encoded:
1. Make any modifications to your source data file in .xls format.
2. In Microsoft ® Excel ® , save a copy of your file as a Unicode Text file.
3. Open the Unicode Text file you just saved with a text editor.
4. Click File > Save As to change the following file settings:
• File name extension—
.csv
• Save as type—All Files
• Encoding—UTF-8
5. Click Save, and close the file.
Note: Don’t open the file after you have saved the settings or you may revert the encoding changes.
334
Import Your Data
6. Import the data using Data Loader as you normally would, and select the newly created .csv file.
General Importing Questions
Can I import into custom fields?
Yes. Your administrator must create the custom fields prior to import.
For checkbox fields, records with a value of 1 in the field are imported as checked while a value of 0 is not checked.
Can I import into fields that are not on my page layout?
No. You can import only into the fields that are accessible to you via your page layout or field-level security settings. However, in the organization-wide import wizards for accounts, contacts, leads, solutions, and custom objects, administrators have access to import into any of the listed fields, even if a field is hidden or read-only in their page layout or field-level security settings.
What's the difference between importing data into a custom field or into a picklist?
When you have data that does not match any of the standard fields, your administrator can create a custom field for that data prior to import. For example, you might want a Middle Name field for contacts. During import, you map your data to that custom field.
A picklist is a field with a predefined set of values from which you pick. For example, the Rating picklist has predefined values of “Hot,” “Warm,” and “Cold.” You should import your data into an existing picklist when that picklist accurately represents your data, even if the exact values do not match. The import wizards warn you before importing any new picklist values. However, the wizards will accept any value for a picklist field, even if the value is not predefined. Your administrator can later edit the picklist to include the needed values. Note that the import wizards do not allow you to import more than
100 new picklist or multi-select picklist values for any field during a single import.
Can I delete my imported data if I make a mistake?
Your administrator can choose
Your Name
> Setup > Data Management > Mass Delete Records to perform a mass delete of accounts, contacts, leads, or solutions that you mistakenly imported. You cannot mass delete mistakenly imported custom objects.
View the Using Mass Delete to Undo Imports document for instructions.
For organization imports that have not begun processing, you can cancel an import in the Import Queue. Click
Your Name
> Setup > Monitoring > Imports. Alternatively, click
Your Name
> Setup > Data Management, choose one of the import wizards, and then select the import queue link. The import queue is not accessible to Personal Edition organizations.
335
Import Your Data General Importing Questions
How do I update records using the Import Wizard?
You can use the Import Wizard to update leads, contacts, or accounts using the record’s ID as the unique identifier. These steps do not apply to custom objects.
Note: These steps assume you have administrator-level of knowledge with Salesforce.
Before you begin, prepare the data you’re updating.
1. Create a tabular report for the records you’re updating, including the record ID and the fields you’re updating.
2. Save the report locally as a .csv file for backup purposes.
3. Click Save As to create a new version of the .csv file and make your changes to the data.
4. Click Save.
After you have updated the report, import the .csv file into Salesforce. The steps vary based on the records you’re updating.
To Update Leads
1. Click Setup > Administration Setup > Data Management > Import Leads > Start the Import Wizard!.
2. Under Matching Type, choose Salesforce.com ID. Click Next.
3. Select Overwrite existing lead values.
4. Map the Lead ID field to the Lead ID column in your local file, as well as all other fields.
5. Review, and click Import Now!.
To Update Accounts or Contacts
1. Click Setup > Administration Setup > Data Management > Import Accounts/Contacts > Start the Import Wizard!.
2. Click Next, and then click Choose File to select the file you’re importing.
3. Under Contact Matching Type, choose Salesforce.com ID. The Account Matching Type automatically matches the
Contact Matching Type. Click Next.
4. Map the
Contact Id
field to the Contact ID column in your local file, and map the other contact fields. Click Next.
5. Map the contact phone and address fields. Click Next.
6. Select Overwrite existing account values, map the Account Id field to the Account ID column in your local file, and map the other account fields. Click Next.
7. Map the extra import fields, and click Next.
8. Click Import Now!.
The import wizard matches the record IDs in your file with the record IDs in Salesforce and updates the fields that were mapped.
Why do date fields import incorrectly when I use the Data Loader?
When importing date fields using the Data Loader, sometimes dates import incorrectly because the Data Loader converts the date specified in the imported .csv file to GMT. If your machine’s time zone isn’t GMT or if your machine’s clock adjusts for daylight savings time (DST), your dates may be off by a day.
336
Import Your Data General Importing Questions
To prevent the Data Loader from adjusting the date when it converts to GMT, directly change the format of cells containing dates to reflect the native time zone.
1. Open your .csv file in Microsoft ® Excel ® .
2. In each cell in which you entered dates, add hour data to represent the native time zone. For example, if the date is June
9, 2011 and the time zone is GMT+8, enter June 9, 2011 8:00 . Excel will reformat this to 6/9/2011 8:00.
3. Right-click the cell in which you entered dates, and click Format Cells.
4. Click Number > Custom.
5. In
Type
, enter yyyy-mm-ddThh:mm:ss.sssZ
. For example, if the cell was 6/9/2011 8:00 , it’s now
2011–06–09T08:00:00.00Z
.
What does the Import Queue show me?
Click
Your Name
> Setup > Monitoring > Imports. The Import Queue
shows all of the unprocessed files you have submitted using the import wizards under
Your Name
> Setup > Data Management. You can see when each file was submitted, its status, and a processing time estimate. Click Del to cancel an import file that has not begun processing. The import queue is not accessible to Personal Edition organizations.
How long does it take to import a file?
For the individual user import wizard, the length of time required depends on the amount of data, but on average it only takes a few minutes.
The administrator import wizards work asynchronously, and you will receive a notification email after your file has been successfully imported. The asynchronous import can take a few minutes to no more than 24 hours.
Administrators, except in Personal Edition, can also check the Import Queue to view the progress of import files. Click
Your
Name
> Setup > Monitoring > Imports. To expedite the import process, we recommend you review the directions in
on page 238.
Why might there be a delay in importing my file?
In order to manage the volume of imports and ensure that all users receive the highest level of performance, organization import files are accepted in “asynchronous” mode. This means that your file passes through a controlled queue and will be imported when the system can best manage the data, however your organization import will not take longer than 24 hours to complete. You will receive a notification email when the import is complete.
Can I import amounts in different currencies?
If your Group, Professional, Enterprise, Unlimited, or Developer Edition organization has set up the ability to use multiple currencies, you can import amounts in different currencies using the
Currency ISO Code
column in your import file.
337
Import Your Data General Importing Questions
Can Customer Support help me import my data?
Customer Support is available to assist Group, Professional, Enterprise, and Unlimited Edition organizations throughout the import process.
Can I import data in more than one language?
The import wizard imports one language at a time, the language of the user doing the import. If you have the same data in different languages, run an import for each additional language.
How do I perform mass updates to records?
To update more than 50,000 but less than 5 million records, use Data Loader.
To update more than 5 million records, we recommend you work with a salesforce.com partner or visit the App Exchange for a suitable partner product.
How do I update fields with blank values?
To replace fields with null values, you must use Data Loader.
1. Choose Start > All Programs > salesforce.com > Data Loader > Data Loader to open Data Loader.
2. Click Export and complete the wizard. When the operation finishes, click View Extraction.
3. Click Open in external program to open your data in Excel. Blank out the fields you want to update.
4. In Data Loader, choose Settings > Settings, and select Insert null values. Click OK to save your settings.
5. Click Update and follow the wizard to reimport your data.
What is an external ID?
When importing custom objects, solutions, or person accounts, you can use external IDs to prevent duplicate records from being created as a result of the import operation.
An external ID is a custom field that has the “External ID” attribute, meaning that it contains unique record identifiers from a system outside of Salesforce. When you select this option, the import wizard will detect existing records in Salesforce that have the same external ID. Note that this operation is not case-sensitive - for example, “ABC” will be matched with “abc”.
However, there is an exception: if the custom field has the separate “Unique” attribute and the case-sensitive option for that attribute is selected, uppercase and lowercase letters will not be considered identical.
338
Importing FAQ Importing Business Accounts and Contacts
Importing Business Accounts and Contacts
Available in: All Editions
•
How many contact and business account records can I import?
•
How do I prepare my contact data?
•
What do I do with extra data that does not match any contact or business account fields?
•
Can the import wizards de-duplicate my contact and business account data?
•
When do the import wizards create new contacts and business accounts?
•
Can the import wizards change the ownership of existing contacts and business accounts?
•
Can I import contact and business account records that are owned by different people?
•
Can the contact and business account import wizards recognize similar names?
•
Can I import existing contact and business account data to add information?
•
How do the import wizards associate contacts and business accounts?
•
What type of data integrity warnings can I possibly expect?
•
Can I synchronize my contact and business account data after I’ve imported it?
How many contact and business account records can I import?
For organizations without person accounts, individual users can import up to 500 records during each import session, and administrators can import up to 50,000 records at a time running the Import My Organization’s Accounts and Contacts wizard.
For organizations with person accounts, users can run the Import My Organization’s Accounts and Contacts wizard.
If you have more than the allowable number of records, simply repeat the import process. In addition to the record limits on each import, your import is also subject to the overall storage limits for your organization.
How do I prepare my contact data?
1. Export your contacts and business accounts from their source.
2. For individual imports from ACT! or Outlook, review the default field mappings and modify your data if necessary. For individual imports from other sources or organization imports, use Excel to clean up your data and label your import columns with the field names listed under
Field Mapping for Other Data Sources and Organization Import
.
3. Save the file in a CSV format and start the appropriate import wizard.
339
Import Your Data Importing Business Accounts and Contacts
What do I do with extra data that does not match any contact or business account fields?
In the import wizards, Professional, Enterprise, Unlimited, and Developer Edition users can choose to import miscellaneous data into business account or contact
Note
fields, or not import it at all. When importing into notes, the wizard creates a single business account or contact
Note
field for the data.
Alternatively, your administrator can create custom fields for the miscellaneous data prior to the import. In Personal, Contact
Manager, and Group Edition organizations, miscellaneous data is not imported unless your administrator creates custom fields.
Can the import wizards de-duplicate my contact and business account data?
The Import My Contacts wizard and the Import My Organization’s Accounts and Contacts wizard attempt to eliminate duplicate contacts and business accounts. In organizations with person accounts, note that the Import My Organization’s
Accounts and Contacts wizard is called the Import My Organization’s Business accounts/Contacts wizard. The import wizards can merge data in your import file with existing records in Salesforce only if you are the owner of or have read/write access to the existing records. You can specify criteria for avoiding duplicates by choosing a
Matching Type
. Your personal contacts can be matched by name or email. Your organization’s contacts can be matched by Salesforce ID, name, or email. Your organization’s business accounts can be matched by Salesforce ID or by name and site.
Avoiding Duplicate Business Accounts
The import wizards attempt to avoid duplicate business accounts based on:
• If
Salesforce ID
is the
Account Matching Type
:
Business accounts are matched according to their account ID. That is, if there is a record in your import file that has the same ID as a record in Salesforce, then that record will be updated in Salesforce.
• If
Name and Site
is the
Account Matching Type
:
◊ If two accounts have the same
Account Name
and
Account Site
, the wizards add your import data to the existing data in Salesforce.
◊ If more than one record in your import file has the same Account Name and Account Site , the wizards merge those records and create only one account in Salesforce.
◊ If two accounts have “similar”
Account Name
and
Account Site
values, the wizards add your import data to the existing data in Salesforce
◊ If the
Account Site
field is empty in your import file, the wizards match just on the
Account Name
field, ignoring any site values that may exist in Salesforce.
◊ Local name fields are imported but not checked for duplicates.
• The wizards do not overwrite any existing business account fields unless you check the Overwrite existing account values
box in the wizard.
With this box checked, you can insert or update existing business account fields with new data. However, you cannot use this checkbox to update existing field data with blank values. With this box unchecked, the wizard updates any empty business account fields, but does not touch any fields with existing data.
Avoiding Duplicate Contacts
340
Import Your Data Importing Business Accounts and Contacts
The import wizards attempt to avoid duplicate contacts based on:
• If Salesforce ID is the Contact Matching Type :
Contacts are matched according to their contact ID. That is, if there is a record in your import file that has the same ID as a record in Salesforce, then that record will be updated in Salesforce.
• If Name is the Contact Matching Type :
◊ For contacts with the same Account Name , Account Site , First Name , and Last Name (or the same Account
Name
,
Account Site
, and
Full Name
), the wizards merge your import data with existing data in Salesforce. The contact name by itself is not sufficient information for matching; you must also include the contact’s business account.
◊ If two contacts have “similar” names in the Account Name , Account Site , and First Name and Last Name (or
Full Name ) fields, the wizards merge the contacts into one record in Salesforce. However, if two contacts have the same First Name (Local) or Last Name (Local), the wizard will not merge those records.
• If
is the
Contact Matching Type
:
Contacts are matched according to their email within the scope of a given business account. That is, within a specified business account, if a contact in your import file has the same email as a contact in Salesforce, then that contact will be updated in Salesforce. If you are not matching by email and there is an existing contact in Salesforce with the same email, then a new contact will be created for that business account.
• In the absence of any record matching between your import file and Salesforce, the wizards merge duplicate records in your import file to create only one new contact in Salesforce.
For business account and contact notes in Professional, Enterprise, Unlimited, and Developer Edition organizations, the wizards de-duplicate the notes in your import file if an existing business account or contact note has the exact same text.
Avoiding Duplicate Leads
The Import My Organization’s Leads wizard can eliminate duplicate leads if you choose a Matching Type of Salesforce
ID , Name , or Email .
When do the import wizards create new contacts and business accounts?
• If any of the contacts or business accounts in your import file do not match an existing record, the wizard creates a new contact or business account.
• If you do not have object-level permission to update an object or read/write sharing access to an existing business account or contact record that matches your import data, the wizard creates a new record owned by you.
• If you are matching records by name, the wizards create new records based on specific fields in your import file:
Field in Your Import File
Account Site
Record Created in Salesforce
The wizards attempt to match this field to an existing business account with the same
Account Name
. If the
Account Name matches but the Account Site does not, a new business account is created.
If the Account Name matches but the Account Site is empty in the import file, the wizard updates the existing business account but does not overwrite the existing site value unless you check the
Overwrite existing account values box in the wizard.
341
Import Your Data
Field in Your Import File
Outlook Manager's Name
Reports To
Parent Account
Importing Business Accounts and Contacts
Record Created in Salesforce
When this field is mapped to the contact
Reports To
field, the wizards attempt to match the manager’s name to an existing contact within the same business account. If no contact exists for the manager within the same business account, a new one is created. For contacts that are not attached to business accounts, the wizards try to match the
Manager's Name
field to a contact from any business account.
The wizards attempt to match the name to an existing contact within the same business account. If no contact exists with that name in the same business account, a new one is created. For contacts that are not attached to business accounts, the wizards try to match the
Reports To
field to any matching contact from any business account.
The wizards attempt to match the name in this field to an existing business account. If no business account exists with that name, a new one is created.
Can the import wizards change the ownership of existing contacts and business accounts?
No. For individual imports, the wizard creates new records with you as the owner. For existing records that have matching names, the wizard only updates records that you own or records to which you have read/write access. The ownership of these records is not changed.
For organization imports, the wizard tries to merge existing data that matches, but it never changes the record ownership, regardless of the Record Owner values in your import file. New and updated records are marked as having been created or modified by the administrator doing the import. This does not affect the record ownership.
Can I import contact and business account records that are owned by different people?
Yes, but only if you are the administrator, are using the organization import wizard, and are not in a Personal Edition organization.
If your sharing model is Public Read/Write, new duplicate records that are owned by different users are de-duplicated and merged into a single record whenever possible. For example, if two users have new records for Trident Inc. in your import file, only one account named “Trident Inc.” is created. If the record in your import file matches an existing record in Salesforce, the two records are merged if the record owner has access to edit the existing Salesforce record.
If your organization has Private or Public Read Only sharing, then two records are always created, unless the record already exists and the relevant users have access to edit that existing record.
342
Import Your Data Importing Business Accounts and Contacts
You must add a
Record Owner
column to your import file so that the owner of the original data becomes the owner in the system. In the Record Owner column, enter the users’ full usernames (for example, “[email protected]”) or first and last names (for example, “Joe Smith”, or “Smith Joe” for Asian locales). This enables each user to maintain ownership of their records, without overriding the sharing model. When importing records by Salesforce record ID, the Record Owner field in your import file is ignored. All records retain their existing owners; record owners cannot be updated using the import wizard.
Can the contact and business account import wizards recognize similar names?
The wizards can recognize slight differences between business account names, business account sites, and contact names. The wizards use the following rules in determining whether business account names, business account sites, or contact names are the same and should be merged:
• Case is ignored, “Tom Jones” = “Tom JONES”
• Punctuation is ignored in business account names and sites, “I.B.M.” = “IBM”
• Spaces are ignored in business account names and sites, “Home Link” = “HomeLink”
• The following words are ignored if they appear at the beginning or end of the business account name and are separated by spaces or punctuation. For example, “The Gap”, “Gap, The”, and “Gap Company” are all merged into one business account.
The
Corp
Incorporated
PLC
Co
Corporation
Ltd
LLC
Inc
Company
International
Intl
• Salutations are ignored in contact names, “Mr. Tom Jones” = “Tom Jones”
• “.com” is NOT ignored in business account names, for example, “acme.com” is not merged with “Acme”
• Middle names and initials are NOT ignored in contact names, “Tom T. Jones” is not merged with “Tom Jones”
Can I import existing contact and business account data to add information?
When you import existing contacts, new information is added to the contact. Note that the contact in your import file must match the existing contact in the system.
To import existing business account data, check the
Overwrite existing account values
box on the mapping page of the wizard. With this box checked, you can insert or update existing business account fields with new data. However, you cannot use this checkbox to update existing field data with blank values. You can update existing data only if you own the record or have read/write access to it. With this box unchecked, the wizard updates any empty business account fields, but does not touch any fields with existing data.
343
Importing FAQ Importing Person Accounts
How do the import wizards associate contacts and business accounts?
Import file rows that have both a business account name and a contact name create a business account and a contact, with the contact(s) attached to that business account. You can have multiple contacts listed with the same business account name.
Business accounts without related contacts just create a business account record. Contacts without business account names just create a contact record.
What type of data integrity warnings can I possibly expect?
Typical data integrity issues include values that are too long and invalid data, such as dates in the wrong format. The wizards simply truncate data that is too long and ignore invalid data, but the records are still imported. In addition, the administrator wizards offer you the chance to review the warnings before proceeding with the import.
Can I synchronize my contact and business account data after I’ve imported it?
Yes. However, if you plan to regularly synchronize with Outlook, we recommend that you simply synchronize your data rather than importing it via one of the import wizards.
Importing Person Accounts
Available in: Enterprise, Unlimited, and Developer Editions
•
How do I prevent duplicate person accounts?
•
How do I use the import wizard to mass update existing person accounts?
•
Which person account fields are required for importing?
•
Can I update lookup fields for my person accounts?
How do I prevent duplicate person accounts?
To prevent duplicate person account records from being created as a result of your import, populate a column in your import file with the names, email addresses, Salesforce IDs, or external IDs of the person accounts. These are the fields that can be used to match rows in your import file with existing records in Salesforce. In the wizard, you can specify the field you are using for record matching and what action to take when a matching existing record is found.
344
Import Your Data Importing Person Accounts
How do I use the import wizard to mass update existing person accounts?
To mass update existing person account records via the import wizards:
1. Run a person account report and export the results to Excel. To enable record matching, make sure to include the name, email address, Salesforce ID, or external ID field in the report.
2. Use Excel or a similar application to update field values in the import file as desired.
3. If you own the records in your import file, launch the Import My Person Accounts wizard at
Your Name
> Setup > Import
> Import Person Accounts. If the records in your import file are owned by multiple different users, launch the Import
My Organization's Person Accounts wizard at
Your Name
> Setup > Data Management > Import Person Accounts.
4. At the Prevent Duplicates step:
• If you are using the Import My Organization's Person Accounts wizard, choose the
Yes
radio button. This option is not included in the other wizard.
• In the “Which field...” section, choose the field in your file to use for record matching: name, Salesforce ID, email address, or external ID.
• In the “If existing records...” section, choose the second option,
Update existing records and do not insert any new records .
5. Proceed with the remaining steps in the wizard.
6. After finishing the wizard and receiving the email notification that the process has completed, verify in Salesforce that the records have been updated as you intended.
Which person account fields are required for importing?
Each person account has a name field that should be included in your import file. In addition, if your administrator has defined universally required custom fields for person accounts, those fields should be included in your import file.
Can I update lookup fields for my person accounts?
Yes, if person accounts have a lookup relationship with another object, you can use the import wizard to update the value of that lookup field. We recommend the following procedure:
1. Run a person account report and export the results to Excel. In the report, include the Salesforce IDs of both the person account and the object referenced in the lookup field.
2. Use Excel or a similar application to update field values in the import file as desired.
3. Start the Import My Organization's Person Accounts wizard by going to Your Name > Setup > Data Management >
Import Person Accounts.
4. At the Prevent Duplicates step:
• Choose the
Yes
radio button.
• Choose
Salesforce ID
.
•
Update existing records and do not insert any new records
is automatically selected because you are matching by Salesforce ID.
5. At the Specify Relationships step:
345
Importing FAQ Importing Leads
• Specify the record owner field in your import file.
• Check the box that corresponds to the lookup field you are including in your import file.
6. At the Define Lookup Matching step, choose
Salesforce ID
.
Note: Any related records must already exist in Salesforce before proceeding. Related records will not be updated during your import even if your import file contains different values for fields on those related records.
7. After finishing the wizard and receiving the email notification that the process has completed, verify in Salesforce that the person account records have been updated as you intended.
Importing Leads
Available in: Professional, Enterprise, Unlimited, and Developer Editions
•
•
•
Who are imported leads assigned to?
•
What happens to duplicate leads in my import file?
•
Can I update existing leads during lead import?
•
How do I prepare my lead import file?
•
How many leads can I import?
50,000 at a time.
In addition to the record limits on each import, your import is also subject to the overall storage limits for your organization.
Who can import leads?
Only administrators, and users with the “Import Leads” permission, can import leads using the Import My Organization’s
Leads wizard.
Who are imported leads assigned to?
Imported leads are assigned to users or queues according to the lead assignment rule chosen in the wizard. If you do not choose an assignment rule or if the rule fails to properly assign the lead, then the administrator doing the import is assigned as the owner of the imported leads. Alternatively, you can add a
Record Owner
column to your import file to specify the lead owners (either users or queues). In addition, when importing records by Salesforce record ID, the
Record Owner
field in your import file is ignored. All records retain their existing owners; record owners cannot be updated using the import wizard.
346
Import Your Data Importing Leads
What happens to duplicate leads in my import file?
The import wizard de-duplicates leads in your import file if you choose a
Matching Type
of
Salesforce ID
,
Name
, or
Email . Alternately, if you choose a Matching Type of None , duplicate leads will be created in Salesforce and you can merge them later.
When importing new leads for a campaign via the Lead Import Wizard, the Matching Type option is not available; the wizard does not merge duplicate records. However, if you are using the Campaign Update Wizard, duplicate leads are not created. The
Lead ID
field in your import file ensures that the correct, existing lead will be updated with the campaign status information.
Can I update existing leads during lead import?
Yes, if you use a Matching Type of Salesforce ID , Name , or Email . For example, if you are matching by email and a record in your source file has the same email as a lead in Salesforce, then that lead will be updated in Salesforce, provided you have read/write access to that lead. If you are not matching by email and there is a record in Salesforce with the same email, then a new lead will be created.
How do I prepare my lead import file?
Save your import data as a CSV (comma-separated values) file, then mark each column in your file with the appropriate lead field label, as specified in Field Mapping for Importing Leads.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
Can I mass-convert leads?
No, Salesforce doesn’t support mass-converting leads. Consider the following alternatives.
• Export the leads you want to convert through the Data Loader or one of the APIs, ensure that you have an account created for the lead you’re importing, and insert them back into Salesforce as contacts.
Note: In the activity history there won’t be an entry noting that the contact was created by the Data Loader or an API call.
• Use the convertLead DML operation. The convertLead DML operation converts a lead into an account and contact, as well as (optionally) an opportunity.
Note: Before you convert the leads, be sure to start with clean data. Your leads won’t convert if they:
◊ Belong to different companies
◊ Already exist as a contact
347
Importing FAQ Importing Campaign Members
◊ Match multiple contacts
• Find a third-party app on AppExchange .
Note: Third-party apps are likely at an additional cost and may not have the exact functionality you want.
Importing Campaign Members
Available in: Professional, Enterprise, Unlimited, and Developer Editions
•
Why are there two campaign import wizards?
•
How many campaign members can I import?
•
Who can import campaign members?
•
What status is assigned to campaign members?
•
How do I prepare my campaign import file?
Why are there two campaign import wizards?
You can access the campaign import wizards via the Add Members - Import File and Update & Add Members - Import
File links on the Manage Members page, which is available from any campaign detail page. The wizards are:
• Lead Import Wizard: To access this wizard from a campaign detail page, click Manage Members > Add Members -
Import File > Import Leads. Use this wizard to import leads. It imports a list of names, creates or updates leads in the system, and associates those leads with your campaign.
• Campaign Update Wizard: To access this wizard from a campaign detail page, click Manage Members > Update & Add
Members - Import File > Update & Add Campaign Members. Use this wizard to update the campaign member statuses of existing leads and contacts. It imports a list of existing Salesforce contacts and leads, associates them with your campaign, and updates their response history.
How many campaign members can I import?
The number of campaign members that can be imported is determined by the following wizards:
• Lead Import Wizard: Import up to 50,000 leads at one time.
• Campaign Update Wizard: Update up to 50,000 existing contacts and leads at one time.
In addition to the record limits, your import is also subject to the overall storage limits for your organization.
348
Importing FAQ Importing Solutions
Who can import campaign members?
In order to use the campaign import wizards to import new leads for a campaign or update the campaign history for multiple leads and contacts, users must have the
Marketing User
checkbox selected on their personal information. They must also have the Marketing User profile (or the “Edit” permission on campaigns and “Import Leads” permission).
What status is assigned to campaign members?
With the campaign import wizards, you can assign a campaign member status to a lead or contact in one of two ways:
• Add a
Status
column to your import file. Enter the status for each lead or contact on the campaign.
• Select a default status in the campaign import wizard. Any lead or contact with a blank or invalid status in your import file will automatically be assigned to the default status.
How do I prepare my campaign import file?
A campaign import file can be prepared by using one of the following wizards:
• Lead Import Wizard: Prepare your import file of new leads using Excel.
• Campaign Update Wizard: Update only the member status of an existing lead or contact. Your import file must include a
Status
column plus a Record Id column that contains the unique Salesforce
Contact ID
or
Lead ID
values for the leads and contacts.
Importing Solutions
Available in: Professional, Enterprise, Unlimited, and Developer Editions
•
How many solutions can I import into my organization?
•
How do I prevent duplicate solutions?
•
Can I use the import wizard to mass update existing solution records?
•
Can I update lookup fields for my solutions?
•
Can I import solution categories?
•
Can I import solutions written in HTML format?
•
Which solution fields are required for importing?
How many solutions can I import into my organization?
50,000 at a time.
349
Import Your Data Importing Solutions
In addition to the record limits on each import, your import is also subject to the overall storage limits for your organization.
How do I prevent duplicate solutions?
To prevent duplicate solutions from being created as a result of your import, include a column in your import file that has either solution titles, Salesforce IDs, or external IDs. These are the fields that can be used to match rows in your import file with existing records in Salesforce. In the wizard, you can specify the field you are using for record matching and what action to take when a matching existing record is found.
Can I use the import wizard to mass update existing solution records?
Yes, you can mass update existing solution records via the import wizard:
1. Run a solution report and export the results to Excel. To enable record matching, make sure to include the solution title,
Salesforce ID, or external ID field in the report.
2. Use Excel or a similar application to update field values in the import file as desired.
3. Start the Import My Organization's Solutions wizard by going to
Your Name
> Setup > Data Management > Import
Solutions.
4. At the Prevent Duplicates step:
• Choose the
Yes
radio button.
• Choose the field for record matching that you included in your file: name, Salesforce ID, or external ID.
• Choose the option
Update existing records and do not insert any new records
.
5. After finishing the wizard and receiving the email notification that the process has completed, verify in Salesforce that the solution records have been updated as you intended.
Can I update lookup fields for my solutions?
Yes. If your solutions have a custom field that creates a lookup relationship with a custom object, you can use the import wizard to update the value of that field. We recommend the following procedure:
1. Run a solution report and export the results to Excel. Include the Salesforce IDs of both the solution and the lookup field in the report.
2. Use Excel or a similar application to update field values in the import file as desired.
3. Start the Import My Organization's Solutions wizard by going to
Your Name
> Setup > Data Management > Import
Solutions.
4. At the Prevent Duplicates step:
• Choose the Yes radio button.
• Choose Salesforce ID .
•
Update existing records and do not insert any new records is automatically selected because you are matching by Salesforce ID.
5. At the Specify Relationships step:
350
Importing FAQ Importing Custom Objects
• Choose the author field, if any, in your import file.
• Check the box that corresponds to the lookup field you are including in your import file.
6. At the Define Lookup Matching step, choose
Salesforce ID
.
7. After finishing the wizard and receiving the email notification that the process has completed, verify in Salesforce that the solution records have been updated as you intended.
Can I import solution categories?
Categories for solutions cannot be imported at this time.
Can I import solutions written in HTML format?
Yes. However, unless your organization has enabled HTML solutions, HTML tags will display in the solutions after they are imported.
Which solution fields are required for importing?
For data quality reasons, you should provide a solution title for each solution you are importing. If you are updating existing solutions and a row in your import file does not have a solution title or you do not map the solution title field, the wizard does not change the existing solution title. However, if you are importing new solutions and a row in your import file does not have a solution title or you do not map the solution title field, the record will be created with the value “[Not Provided]” as the solution title. In addition, if your administrator has defined universally required custom fields for solutions, those fields should be included in your import file.
Importing Custom Objects
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Editions
•
How many custom objects can I import into my organization?
•
How do I prevent duplicate custom object records?
•
Can I use the import wizard to mass update existing custom object records?
•
Which fields are required to import custom objects?
•
Can I update lookup fields for my custom object?
•
Why does the import wizard not allow me to match on the record owner?
•
Can I use the import wizard to transfer custom objects to other users?
351
Import Your Data Importing Custom Objects
How many custom objects can I import into my organization?
You can import up to 50,000 records for a given custom object at one time.
In addition to the record limits on each import, your import is also subject to the overall storage limits for your organization.
How do I prevent duplicate custom object records?
To prevent duplicate custom object records from being created as a result of your import, include a column in your import file that has either record names, Salesforce IDs, or external IDs. These are the fields that can be used to match rows in your import file with existing records in Salesforce. In the wizard, you can specify the field you are using for record matching and what action to take when a matching existing record is found.
Can I use the import wizard to mass update existing custom object records?
Yes, you can mass update existing custom object records via the import wizard:
1. Run a custom object report and export the results to Excel. To enable record matching, make sure to include the name,
Salesforce ID, or external ID field in the report.
2. Use Excel or a similar application to update field values in the import file as desired.
3. Start the Import My Organization's Custom Objects wizard by going to
Your Name
> Setup > Data Management >
Import Custom Objects.
4. At the Prevent Duplicates step:
• Choose the
Yes
radio button.
• Choose the field for record matching that you included in your file: name, Salesforce ID, or external ID.
• Choose the option
Update existing records and do not insert any new records
.
5. After finishing the wizard and receiving the email notification that the process has completed, verify in Salesforce that the custom object records have been updated as you intended.
Which fields are required to import custom objects?
Each custom object has a name field that should be included in your import file. In addition, if your custom object has a master-detail relationship with another kind of record, then you must provide the name, Salesforce ID, or external ID of the master record. If the wizard does not find a match for the master record, that custom object record will not be imported. Also, if your administrator has defined universally required custom fields for the custom object, those fields should be included in your import file.
352
Import Your Data Importing Custom Objects
Can I update lookup fields for my custom object?
Yes, if your custom object has a lookup relationship with another object, you can use the import wizard to update the value of that field. We recommend the following procedure:
1. Run a custom object report and export the results to Excel. Include the Salesforce IDs of both the custom object and the lookup field in the report.
2. Use Excel or a similar application to update field values in the import file as desired.
3. Start the Import My Organization's Custom Objects wizard by going to
Your Name
> Setup > Data Management >
Import Custom Objects.
4. At the Prevent Duplicates step:
• Choose the
Yes
radio button.
• Choose Salesforce ID .
•
Update existing records and do not insert any new records is automatically selected because you are matching by Salesforce ID.
5. At the Specify Relationships step:
• Choose the record owner field, if any, in your import file.
• Check the box that corresponds to the lookup field you are including in your import file.
6. At the Define Lookup Matching step, choose
Salesforce ID
.
7. After finishing the wizard and receiving the email notification that the process has completed, verify in Salesforce that the custom object records have been updated as you intended.
Note that if a custom object has a master-detail relationship with another object, you cannot update the value of the required master record via the import wizard.
Why does the import wizard not allow me to match on the record owner?
If your custom object has a master-detail relationship with another kind of record, then the record owner of the custom object is automatically set to the owner of the master record and cannot be changed.
Can I use the import wizard to transfer custom objects to other users?
Yes, as long as the user to whom you are transferring the record has the “Read” permission for the custom object.
353
Manage Data Exporting Backup Data
M
ANAGE
D
ATA
Exporting Backup Data
Weekly export available in: Enterprise and Unlimited Editions
Monthly export available in: All editions, except for Database.com
To export data:
User Permissions Needed
“Data Export”
Your organization can generate backup files of your data on a weekly or monthly basis depending on your edition. You can export all of your organization's data into a set of comma-separated values (CSV) files.
Note: Users with the “Data Export” permission can view all exported data and all custom objects and fields in the
Export Service page. This permission is granted by default only to the System Administrator profile because it enables wide visibility.
You can generate backup files manually once every six days (for weekly export) or 28 days (for monthly export). You can also schedule backup files to generate automatically at weekly or monthly intervals.
1. Click Your Name > Setup > Data Management > Data Export and Export Now or Schedule Export.
• The Export Now option prepares your files for export immediately. This option is only available if enough time has passed since your last export.
• The Schedule Export option allows you to schedule the export process for weekly or monthly intervals.
2. Select the desired encoding for your export file.
3. Select
Include images, documents, and attachments
and
Include Chatter files and Salesforce
CRM Content document versions to include these items in your export data.
4. Select
Replace carriage returns with spaces
to have spaces instead of carriage returns or line breaks in your export files. This is useful if you plan to use your export files for importing or other integrations.
5. If you're scheduling your export, select the frequency (only available for organizations with monthly exports), start and end dates, and time of day for your scheduled export.
6. Under Exported Data, select the types of data to include in your export. We recommend that you select Include all data if you are not familiar with the terminology used for some of the types of data. Note the following:
• Formula and roll-up summary fields are always excluded from exports.
• If your organization uses divisions, data from all divisions is included in the export.
• If your organization uses person accounts and you are exporting accounts, all account fields are included in the account data.
• If your organization uses person accounts and you are exporting contacts, person account records are included in the contact data. However, the contact data only includes the fields shared by contacts and person accounts.
354
Manage Data Exporting Backup Data
• For information on field limitations, see the Salesforce Field Reference Guide .
7. Click Start Export or Save.
Salesforce creates a zip archive of CSV files and emails you when it's ready. Exports typically finish within 48 hours of submission, and large exports are broken up into multiple files. Follow the link in the email or click Data Export to download the zip file. Zip files are deleted 48 hours after the email is sent. The 48-hour time limit doesn't include weekends, which means if your download file is ready on Thursday at 4 p.m., that file isn't deleted until Monday at 4 p.m.
Note: For security purposes, Salesforce may require users to pass a CAPTCHA user verification test to export data from their organization. This simple text-entry test prevents malicious programs from accessing your organization's data. To pass the test, users must correctly type the two words displayed on the overlay into the overlay's text box field. Note that the words entered into the text box field must be separated by a space.
Tip: Any automated processes that process the export files should rely on the column headings in the CSV files, rather than the position of the columns.
Depending on the encoding selected, you may have to make adjustments to the export file before viewing it. Use the following instructions that apply to the character encoding you selected.
Viewing Unicode (UTF-8) Encoded Export Files
If you have Microsoft Excel 2003:
1. Open Microsoft Excel.
2. Click File > New.
3. Click Data > Import External Data > Import Data.
4. Select the CSV file to open and Microsoft Excel will launch the text import wizard.
5. Select “Delimited” and choose the “Unicode (UTF-8)” option for File origin.
6. Click Next.
7. Select “Comma” in the Delimiters section and click Finish. You may be prompted to select a range of cells.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
8. Repeat these steps for each file.
If you have an earlier version of Microsoft Excel (pre 2003):
1. Open the file in Microsoft Excel.
2. Select File > Save As.
3. Save the file as type Web Page.
4. Select Tools > Options > General tab and click the Web Options button.
5. Select the Encoding tab, and then choose the “Unicode (UTF-8)” option.
6. Click OK to close the dialog boxes.
7. Select File > Save to save the file with selected encoding.
8. Repeat these steps for each file.
Viewing Unicode (UTF-16, Big Endian) Encoded Export Files
Open the export files in a text editor that supports this character set. Microsoft Excel does not support this character set.
355
Manage Data Transferring Records Overview
Viewing Unicode (Little Endian) Encoded Export Files
1. Open the file in Microsoft Excel.
2. Click on column A to highlight the entire first column.
3. Open the Data menu and choose Text to Columns.
4. Select the “Delimited” radio button and click Next.
5. Select “Comma” in the Delimiters section and click Finish.
Note: If commas are not appropriate for your locale, use a tab or other delimiter.
6. Repeat these steps for each file.
Transferring Records Overview
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Accounts, Campaigns, Contacts, Contracts, Leads, and Cases are not available in Database.com.
User Permissions Needed
To transfer multiple accounts, campaigns, contacts, contracts, and custom objects:
“Transfer Record”
AND
“Edit” on the object type
To transfer multiple leads:
To transfer multiple cases:
“Transfer Leads” OR “Transfer Record”
AND
“Edit” on leads
“Transfer Cases” OR “Transfer Record”
AND
“Edit” on cases
A record owner, or any user above the owner in the role or territory hierarchy, can transfer a single record to another user.
With some objects, like cases, leads, and campaigns, a user may be granted access to transfer records through sharing. Depending on the type of object, there may be multiple ways to transfer records to another user:
Method
Transfer a single record
Available for
Accounts, campaigns, cases, contacts, contracts, leads, and custom objects
Transfer multiple records by selecting the records from a list view and clicking Change Owner
Cases, leads, and custom objects, which can belong to either a user or a queue
356
Manage Data Transferring Records Overview
Method
Transfer multiple records using the Mass Transfer tool
Available for
Accounts, leads, and custom objects
Ability to Change Ownership
• Users with the “Modify All Data” permission, or users with the “Modify All” permission for the given object, can transfer any record, regardless of who owns the record.
• To transfer a single record or multiple records from a list view, the new owner must have at least the “Read” permission on the object type. This rule does not apply if you use the mass transfer tool.
• To transfer ownership of any single record in an organization that does not use territory management, a user must have the appropriate “Edit” permission and either own the record or be above the owner in the role hierarchy.
For example, to transfer ownership of an account, a user must have the “Edit” permission on accounts and read sharing access to the account. Additionally, the new owner of the record must have at least “Read” permission on accounts.
The Public Full Access and Public Read/Write/Transfer sharing settings give all users the ability to transfer ownership of that type of record as long as they have the appropriate “Edit” permission.
• In organizations that use territory management, users that have been assigned to territories can be enabled to transfer the accounts in their territories, even if they are not the record owner.
• To transfer campaigns, users must also have the
Marketing User
checkbox selected on their user record.
• Partner accounts can only be transferred to users with the “Manage Partners” permission.
• You cannot assign an account with Customer Portal users to an owner who is a partner user.
See Also:
357
Manage Data Transferring Records Overview
Mass Transferring Records
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer Database.com Editions
Accounts, Service Contracts, and Leads are not available in Database.com.
To mass transfer accounts and service contracts:
User Permissions Needed
“Transfer Record”
AND
“Edit” on the object type
AND
“Transfer Leads”
To mass transfer custom objects:
To mass transfer leads:
“Transfer Record”
AND
“Edit” on the object type
“Transfer Leads” OR “Transfer Record”
AND
“Edit” on leads
Use the Mass Transfer tool to transfer multiple accounts, leads, service contracts, and custom objects from one user to another.
Note: To transfer any records that you do not own, you must have the required user permissions as well as read sharing access on the records.
1. Choose Your Name > Setup > Data Management > Mass Transfer Records.
2. Click the link for the type of record to transfer.
3. Optionally, fill in the name of the existing record owner in the
Transfer from
field. For leads, you can transfer from users or queues.
4. In the
Transfer to
field, fill in the name of new record owner. For leads, you can transfer to users or queues.
5. If your organization uses divisions, select the
Change division...
. checkbox to set the division of all transferred records to the new owner’s default division.
6. When transferring accounts, you can:
• Select Transfer open opportunities not owned by the existing account owner if you want to transfer open opportunities owned by other users that are associated with the account.
• Select Transfer closed opportunities if you want to transfer closed opportunities associated with the account.
This option applies only to closed opportunities owned by the account owner; closed opportunities owned by other users are not changed.
358
Manage Data Transferring Records Overview
• Select
Transfer open cases owned by the existing account owner
if you want to transfer open cases that are owned by the existing account owner and associated with the account.
• Select
Transfer closed cases
if you want to transfer closed cases that are owned by the existing account owner and associated with the account.
• Select Keep Account Team if you want to maintain the existing account team associated with the account. Deselect this checkbox if you want to remove the existing account team associated with the account.
• Select Keep Opportunity Team on all opportunities...
if you want to maintain the existing opportunity team on any opportunities associated with this account.
Note: If you transfer closed opportunities, the opportunity team is maintained, regardless of this setting.
7. Enter search criteria that the records you are transferring must match. For example, you could search accounts in California by specifying Billing State/Province equals CA .
8. Click Find.
9. Select the checkbox next to the records you want to transfer. Optionally, check the box in the column header to select all currently displayed items.
Note: If duplicate records are found, you must select only one of the records to transfer. Transferring duplicate records results in an error.
Duplicate records may display if you filter leads based on Campaign Member Status and a matching lead has the same campaign member status on multiple campaigns. For example, if you specify Campaign Member Status equals Sent , and a matching lead named John Smith has the status Sent on two campaigns, his record will display twice.
10. Click Transfer.
Transfer of Associated Items
When you change record ownership, some associated items that are owned by the current record owner are also transferred to the new owner.
Record
Accounts
Leads
Associated items that are also transferred
Contacts (on business accounts only), attachments, notes, open activities, open opportunities owned by the current account owner, and optionally, closed opportunities and open opportunities owned by other users.
Open activities. When transferring leads to a queue, open activities are not transferred.
Access to Transferred Items
When transferring accounts and their related data in Professional, Enterprise, Unlimited, and Developer Editions, all previous access granted by manual sharing, Apex managed sharing, or sharing rules is removed. New sharing rules are then applied to
359
Manage Data Deleting Mass Data the data based on the new owner. The new owner may need to manually share the transferred accounts and opportunities as necessary to grant access to certain users.
See Also:
Deleting Mass Data
Available in: All Editions
This feature is only available in Database.com via the API. You can only mass delete records of custom objects in
Database.com.
To mass delete data:
User Permissions Needed
“Modify All Data”
You can delete multiple cases, solutions, accounts, contacts, leads, products, or activities at one time. Before you use mass delete, we strongly suggest you run a report to archive your information. We also strongly advise you to run a weekly export
of your data; see Exporting Backup Data
on page 354.
To delete multiple records:
1. Click
Your Name
> Setup > Data Management > Mass Delete Records.
2. Click the link for the type of record to delete.
3. Review the information that will be deleted along with the records.
4. Specify conditions that the selected items must match, for example, “State equals California.”
5. When deleting accounts, check the appropriate boxes if you want to delete accounts with attached closed/won opportunities or attached opportunities owned by other users.
6. When deleting products, check
Archive Products...
if you want to include products that are on opportunities.
Archived products are not moved to the Recycle Bin. Check this option to:
• Delete products that are not on opportunities and move them to the Recycle Bin.
• Archive products that are on opportunities. These products are not moved to the Recycle Bin and cannot be recovered.
Leave this box unchecked to delete only those products that are not on opportunities. Selected products that are on opportunities will remain checked after the deletion to indicate they were not included in the deletion.
7. Choose Search to find records that match.
8. Select the box next to the items you want to delete. Optionally, check the box in the column header to select all currently displayed items.
9. To permanently delete records, select
Permanently delete the selected records
. Please note that selecting this option prevents you from recovering the selected records from the Recycle Bin.
10. Click Delete. If you did not select
Permanently delete the selected records
, deleted items are moved to the
Recycle Bin.
360
Manage Data Deleting Mass Data
Notes on Using Mass Delete
Consider the following when using mass delete:
• You can delete up to 250 items at one time.
• When you delete a record, any associated records that display on that record's related lists are also deleted.
• Accounts and contacts associated with cases cannot be deleted.
• Partner accounts with partner users cannot be deleted.
• Contacts enabled for Self-Service, and their associated accounts, cannot be deleted.
• When deleting products, all related price book entries are deleted with it.
• Products on opportunities cannot be deleted, but they can be archived.
• When you delete activities:
◊ Any archived activities that meet the conditions are also deleted.
◊ Requested meetings aren't included in the mass-delete until they're confirmed and automatically converted to events.
• The child events of a recurring event are not displayed in the list of possible items to delete, but they are deleted along with their associated event series.
• Deleting a master solution does not delete the translated solutions associated with it. Instead, each translated solution becomes a master solution.
• Deleting a translated solution removes the association with its master solution.
Sample Uses for Mass Delete
The following examples illustrate some common uses of mass delete.
• You imported your organization's leads incorrectly and you want to delete those imported leads. View the Using Mass
Delete to Undo Imports document for complete instructions.
• A user named John Smith recently left your organization, and he had several contacts that were duplicates of other users' data. To delete these duplicate contacts, select contacts as the record type to delete and enter “Owner Alias equals jsmith.”
• Your organization may have formerly entered all leads as accounts with the Type field set to “Prospect.” You now want to convert these accounts into leads. To do this, run a report of these accounts, export it to Excel, and then use the Import
My Organization’s Leads wizard to import the data as leads. Then using mass delete, select accounts as the record type to delete and enter “Type equals Prospect” to locate all accounts you want to delete.
• You want to delete all the leads that have been converted for your organization. Select the lead record type, enter “Converted equals 1” for the search criteria, then choose Search.
You might also want to use mass delete to clean up any old records you may have, to delete web-generated leads that were created incorrectly, or to delete accounts and contacts with whom you no longer do business.
See Also:
361
Manage Data Mass Updating Addresses
Mass Updating Addresses
Available in: All Editions except for Database.com.
To mass update addresses:
To mass update addresses of contracts:
User Permissions Needed
“Modify All Data”
“Modify All Data”
AND
“Activate Contracts”
Use mass updating addresses to standardize on one naming convention for a country and state/province for your organization’s existing address fields in accounts, contacts, contracts, and leads. For example, instead of having multiple records with US,
USA, or United States in the address fields, you can use mass updating addresses to enter one name, such as US, for all of the records.
Note: Mass updating addresses allows you to make data in text-based state and country fields more consistent. An
1. Choose
Your Name
> Setup > Data Management > Mass Update Addresses.
2. Select the type of data to update - Countries or State/Province . If you chose State/Province , enter the country in which to update the state or province. Click Next to continue.
3. Select the values to update and click Add. The Selected Values box displays the values that will be updated. To remove values, click Remove.
The Available Values box displays the address values found in existing records. To find additional addresses to update together as a group, enter all or part of a value and click Find.
If your organization has large amounts of data, instead of using the Available Values box, enter existing values to update in the text area. Each value should be separated by a new line.
4. In the Replace selected values with field, enter the value with which to replace the specified address data, and click Next. If your organization has large amounts of data, this field is called
Replace entered values with
.
The number and type of address records which will be updated in your organization are displayed. If your organization has large amounts of data, only the values that will be updated are displayed.
5. Click Replace to update the values.
Tips on Mass Updating Addresses
• As a best practice, update countries first, and then update states or provinces within that newly standardized country value.
• Use the mass updating address tool to convert inconsistent address formats to one international standard, such as ISO codes. For a list of ISO codes, see the International Organization for Standardization website.
• Use the mass updating tool regularly to cleanse your address data of inconsistent values created by users or via import, sync, or the Force.com API.
362
Manage Data Scalability FAQ
• Any country or state/province value can be created manually or via import, sync, or the Force.com API. Address values are not validated upon creation.
• Remember to change filter conditions to reflect any address updates. For example, if you change “United States” to “US,” then assignment rules, Web-to-Lead, Web-to-Case, Email-to-Case, and On-Demand Email-to-Case will continue to use “United States” unless updated to “US.”
Scalability FAQ
•
•
Will I see a degradation in performance as Salesforce’s subscriber base grows?
•
Can I house a backup of my data at my own site?
How scalable is Salesforce?
The service has the capacity to scale to the largest of teams. The architecture behind the service was designed to handle millions of users. We scale as rapidly as our customers require.
Will I see a degradation in performance as Salesforce’s subscriber base grows?
No. We are very conscious of performance and have designed the service to be scalable in such a way that we can constantly stay ahead of customer demand. Our architecture allows us to easily add web and application servers to accommodate more users. The system architecture also allows us to add more database servers as needed to accommodate more users. In addition, the facility that houses our servers provides us with guaranteed bandwidth, which we can increase as needed.
Can I house a backup of my data at my own site?
In order for you to house your own data, it would require you to own an Oracle license, database hardware, application server hardware, and application server license, and also have an Oracle DBA on staff. In order to keep administration and overall total cost of ownership down, we handle all of this for you.
However, you can sign up to receive weekly backup files of your Salesforce data.
363
Security Security Overview
S
ECURITY
Security Overview
Salesforce is built with security as the foundation for the entire service. This foundation includes both protection for your data and applications, and the ability to implement your own security scheme to reflect the structure and needs of your organization.
The security features of Salesforce provide both strength and flexibility. However, protecting your data is a joint responsibility between you and salesforce.com. The security features in Salesforce enable you to empower your users to do their jobs efficiently, while also limiting exposure of data to the users that need to act upon it. Implement security controls that you think are appropriate for the sensitivity of your data. Your data is protected from unauthorized access from outside your company, and you should also safeguard it from inappropriate usage by your users.
See the following topics to get more information about the various security components in Salesforce:
•
•
•
•
•
•
•
•
CAPTCHA Security for Data Exports
•
•
About Identity Providers and Service Providers
•
•
See Also:
Security Implementation Guide
Trust and Salesforce.com
Trust starts with transparency. That’s why salesforce.com displays real-time information on system performance and security on the trust site at http://trust.salesforce.com
. This site provides live data on system performance, alerts for current and recent phishing and malware attempts, and tips on best security practices for your organization.
The Security tab on the trust site includes valuable information that can help you to safeguard your company's data. In particular, phishing and malware are Internet scams on the rise.
Phishing is a social engineering technique that attempts to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. Phishers often direct users to enter details at a fake website whose URL and look-and-feel are almost identical to the legitimate one. As the salesforce.com
364
Security Security Infrastructure community grows, it has become an increasingly appealing target for phishers. You will never get an email or a phone call from a salesforce.com employee asking you to reveal a password, so you should refuse to reveal it to anyone. You can report any suspicious activities by clicking the Report a Suspicious Email link under the Trust tab at http://trust.salesforce.com
.
Malware is software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general term used to cover a variety of forms of hostile, intrusive, or annoying software, and it includes computer viruses and spyware.
What Salesforce.com is Doing
Customer security is the foundation of customer success, so salesforce.com will continue to implement the best possible practices and technologies in this area. Recent and ongoing actions include:
• Actively monitoring and analyzing logs to enable proactive alerts to customers who have been affected.
• Collaborating with leading security vendors and experts on specific threats.
• Executing swift strategies to remove or disable fraudulent sites (often within an hour of detection).
• Reinforcing security education and tightening access policies within salesforce.com.
• Evaluating and developing new technologies both for our customers and for deployment within our infrastructure.
What Salesforce.com Recommends You Do
Salesforce.com is committed to setting the standards in software-as-a-service as an effective partner in customer security. So, in addition to internal efforts, salesforce.com strongly recommends that customers implement the following changes to enhance security:
• Modify your Salesforce implementation to activate IP range restrictions. This will allow users to access Salesforce only from your corporate network or VPN, thus providing a second factor of authentication. For more information, see
Session Security on page 367 and
Restricting Login IP Ranges for Your Organization on page 369.
• Educate your employees not to open suspect emails and to be vigilant in guarding against phishing attempts.
• Use security solutions from leading vendors such as Symantec to deploy spam filtering and malware protection.
• Designate a security contact within your organization so that salesforce.com can more effectively communicate with you.
Contact your salesforce.com representative with this information.
• Consider using two-factor authentication techniques, such as RSA tokens, to restrict access to your network.
Salesforce.com has a Security Incident Response Team to respond to any security issues. To report a security incident or vulnerability to salesforce.com, please contact [email protected]
. Describe the issue in detail, and the team will respond promptly.
Security Infrastructure
One of the core features of a multi-tenant platform is the use of a single pool of computing resources to service the needs of many different customers. Salesforce protects your organization's data from all other customer organizations by using a unique organization identifier, which is associated with each user's session. Once you log in to your organization, your subsequent requests are associated with your organization, using this identifier.
Salesforce utilizes some of the most advanced technology for Internet security available today. When you access the application using a Salesforce-supported browser, Secure Socket Layer (SSL) technology protects your information using both server authentication and data encryption, ensuring that your data is safe, secure, and available only to registered users in your organization.
In addition, Salesforce is hosted in a secure server environment that uses a firewall and other advanced technology to prevent interference or access from outside intruders.
365
Security Auditing
Auditing
Auditing features do not secure your organization by themselves, but these features provide information about usage of the system, which can be critical in diagnosing potential or real security issues. It is important that someone in your organization perform regular audits to detect potential abuse. The other security features provided by Salesforce are preventative. To verify that your system is actually secure, you should perform audits to monitor for unexpected changes or usage trends.
Auditing features include:
Record Modification Fields
All objects include fields to store the name of the user who created the record and who last modified the record. This provides some basic auditing information.
Login History
You can review a list of successful and failed login attempts to your organization for the past six months. See
Field History Tracking
You can also enable auditing for individual fields, which will automatically track any changes in the values of selected fields. Although auditing is available for all custom objects, only some standard objects allow field-level auditing. See
Tracking Field History on page 461.
Setup Audit Trail
Administrators can also view a Setup Audit Trail, which logs when modifications are made to your organization’s
configuration. See Monitoring Setup Changes
on page 458.
Session Security
After logging in, a user establishes a session with the platform. Use session security to limit exposure to your network when a user leaves their computer unattended while still logged on. It also limits the risk of internal attacks, such as when one employee tries to use another employee’s session.
You can control the session expiration time window for user logins. Session expiration allows you to select a timeout for user sessions. The default session timeout is two hours of inactivity. When the session timeout is reached, users are prompted with a dialog that allows them to log out or continue working. If they do not respond to this prompt, they are automatically logged out.
Note: When a user closes a browser window or tab they are not automatically logged off from their Salesforce session.
Please ensure that your users are aware of this, and that they end all sessions properly by clicking Your Name >
Logout.
By default, Salesforce uses SSL (Secure Sockets Layer) and requires secure connections (HTTPS) for all communication. The
Require secure connections (HTTPS) setting determines whether SSL (HTTPS) is required for access to Salesforce, apart from Force.com sites, which can still be accessed using HTTP. If you disable this setting and change the URL from
366
Security Session Security https://
to http://
, you can still access the application. However, you should require all sessions to use SSL for added
security. See Setting Session Security on page 367.
See Also:
Restricting Login IP Ranges for Your Organization
Setting Session Security
The Login IP Ranges setting is available in: Personal, Contact Manager, Group, Professional, and Database.com
Editions (Valid IP addresses can be set at the profile level for Enterprise, Unlimited, Developer, and Database.com
Editions)
The
Lock sessions to the IP address from which they originated
setting is available in: Enterprise,
Unlimited, Developer, and Database.com Editions
All other settings available in: Personal, Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and
Database.com Editions
To set session security:
User Permissions Needed
“Customize Application”
You can modify session security settings to specify connection type, timeout settings, and more.
1. Click Your Name > Setup > Security Controls > Session Settings.
2. Customize the session security settings.
Field
Timeout value
Description
Length of time after which the system logs out inactive users. Select a value between 15 minutes and 12 hours. Choose a shorter timeout period if your organization has sensitive information and you want to enforce stricter security.
Note: The last active session time value isn’t updated until halfway through the timeout period. That is, if you have a 30 minute timeout, the system won’t check for activity until 15 minutes have passed. For example, assume you have a 30 minute timeout value. If you update a record after 10 minutes, the last active session time value won’t be updated because there was no activity after 15 minutes. You’ll be logged out in 20 more minutes (30 minutes total) because the last active session time wasn’t updated. Suppose you update a record after 20 minutes.
That’s five minutes after the last active session time is checked, so your timeout resets and you have another 30 minutes before being logged out, for a total of 50 minutes.
367
Security Session Security
Field
Disable session timeout warning popup
Lock sessions to the IP address from which they originated
Description
Determines whether the system prompts inactive users with a timeout warning message. Users are prompted 30 seconds before timeout as specified by the
Timeout value
.
Determines whether user sessions are locked to the IP address from which the user logged in; helping to prevent unauthorized persons from hijacking a valid session.
Note: This may inhibit various applications and mobile devices.
Require secure connections (HTTPS) Determines whether HTTPS is required to log in to or access Salesforce, apart from Force.com sites, which can still be accessed using HTTP.
This option is enabled by default for security reasons. It should not be disabled. Once this preference is set to require HTTPS, you can’t manually change it. To change to HTTP, contact your salesforce.com
representative.
Note: The Resetting Passwords page can only be accessed using
HTTPS.
Force relogin after Login-As-User
Determines whether an administrator that is logged in as another user is returned to their previous session after logging out as the secondary user.
If the option is enabled, an administrator must log in again to continue using Salesforce after logging out as the user; otherwise, the administrator is returned to their original session after logging out as the user.
Require HttpOnly attribute Restricts session ID cookie access. A cookie with the HttpOnly attribute is not accessible via non-HTTP methods, such as calls from JavaScript.
Note: If you have a custom or packaged application that uses
JavaScript to access session ID cookies, selecting Require
HttpOnly attribute
breaks your application because it denies the application access to the cookie. The Developer
Console and AJAX Toolkit debugging window are also not available if the Require HttpOnly attribute is selected.
Enable caching and password autocomplete on login page
Enable SMS-based identity confirmation
Allows the user’s browser to store usernames. If enabled, after an initial log in, usernames are auto-filled into the User Name field on the login page. This preference is selected by default and caching and autocomplete are enabled.
Enables users to receive a one-time PIN delivered via SMS. Once enabled, administrators or users must verify their mobile phone number before taking advantage of this feature.
368
Security Session Security
Field
Login IP Ranges
Enable clickjack protection for non-setup Salesforce pages
Enable clickjack protection for non-setup customer Visualforce pages
Description
Specifies a range of IP addresses users must log in from (inclusive), or the login will fail. Users need to activate their computers to successfully log in from IP addresses outside this range.
To specify a range, click New and enter a lower and upper IP address to define the range.
This field is not available in Enterprise, Unlimited, and Developer
Editions. In those editions, you can specify valid IP addresses per profile.
Protects against clickjack attacks on non-setup Salesforce pages.
Clickjacking is also known as a user interface redress attack. Setup pages already include protection against clickjack attacks. (Setup pages are those pages accessed from the left side of the screen after clicking
Your
Name > Setup on the upper-right part of the user interface.)
Protects against clickjack attacks on your Visualforce pages. Clickjacking is also known as a user interface redress attack.
Warning: If you use custom Visualforce pages within a frame or iframe, you may see a blank page or the page may display without the frame. For example, Visualforce pages in a page layout do not function when clickjack protection is on.
3. Click Save.
See Also:
Restricting Login IP Ranges for Your Organization
Available in: All Editions
To view network access:
To change network access:
User Permissions Needed
“Login Challenge Enabled”
“Manage Users”
Note: Who Sees What: Organization Access (4:25 minutes)
Watch how you can restrict login through IP ranges and login hours.
369
Security Session Security
To help protect your organization’s data from unauthorized access, you can specify a list of IP addresses from which users can always log in without receiving a login challenge:
1. Click
Your Name
> Setup > Security Controls > Network Access.
2. Click New.
3. Enter a valid IP address in the
Start IP Address
field and a higher IP address in the
End IP Address
field.
The start and end addresses define the range of allowable IP addresses from which users can log in. If you want to allow logins from a single IP address, enter the same address in both fields. For example, to allow logins from only 125.12.3.0, enter 125.12.3.0 as both the start and end addresses.
The start and end IP addresses in an IPv4 range must include no more than 33,554,432 addresses (2
25
, a /7 CIDR block).
For example, the following ranges are valid:
• 0.0.0.0
to 1.255.255.255
•
132.0.0.0
to
132.255.255.255
•
132.0.0.0
to
133.255.255.255
However, ranges like
0.0.0.0
to
2.255.255.255
or
132.0.0.0
to
134.0.0.0
are too large.
The start and end IP addresses in an IPv6 range must include no more than 79,228,162,514,264,337,593,543,950,336 addresses (2
96
, a /32 CIDR block). For example, the following range is valid:
2001:8000:: to
2001:8000:ffff:ffff:ffff:ffff:ffff:ffff.
However, ranges like :: to ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
or
2001:8000::
to
2001:8001::
are too large.
4. Click Save.
Note: For organizations that were activated before December 2007, Salesforce automatically populated your organization’s trusted IP address list in December 2007, when this feature was introduced. The IP addresses from which trusted users had already accessed Salesforce during the past six months were added.
Note: Both IP addresses in a range must be either IPv4 or IPv6. In ranges, IPv4 addresses exist in the IPv4-mapped
IPv6 address space
::ffff:0:0
to
::ffff:ffff:ffff
, where
::ffff:0:0
is
0.0.0.0
and
::ffff:ffff:ffff is 255.255.255.255.
A range can’t include IP addresses inside of the IPv4-mapped IPv6 address space if it also includes IP addresses outside of the IPv4-mapped IPv6 address space. Ranges such as
255.255.255.255
to
::1:0:0:0 or :: to ::1:0:0:0 are not allowed. You can set up IPv6 addresses in all organizations, but IPv6 is only enabled for login in sandbox organizations from the Spring ’12 release and later.
See Also:
Security Implementation Guide
370
User Security User Security Overview
U
SER
S
ECURITY
User Security Overview
Salesforce provides each user in your organization with a unique username and password that must be entered each time a user logs in. Salesforce issues a session cookie only to record encrypted authentication information for the duration of a specific session. The session cookie does not include either the username or password of the user. Salesforce does not use cookies to store other confidential user and session information, but instead implements more advanced security methods based on dynamic data and encoded session IDs.
See Also:
CAPTCHA Security for Data Exports
User Authentication
Salesforce has its own system of user authentication, but some companies prefer to use an existing single sign-on capability to simplify and standardize their user authentication. You have two options to implement single sign-on—federated authentication using Security Assertion Markup Language (SAML) or delegated authentication.
• Federated authentication using Security Assertion Markup Language (SAML) allows you to send authentication and authorization data between affiliated but unrelated Web services. This enables you to sign-on to Salesforce from a client application. Federated authentication using SAML is enabled by default for your organization.
• Delegated authentication single sign-on enables you to integrate Salesforce with an authentication method that you choose.
This enables you to integrate authentication with your LDAP (Lightweight Directory Access Protocol) server, or perform single sign-on by authenticating using a token instead of a password. You manage delegated authentication at the permission level, allowing some users to use delegated authentication, while other users continue to use their Salesforce-managed password. Delegated authentication is set by permissions, not by organization. You must request that this feature be enabled by salesforce.com. Contact salesforce.com to enable delegated authentication single sign-on for your organization.
The primary reasons for using delegated authentication include:
◊ Using a stronger type of user authentication, such as integration with a secure identity provider
◊ Making your login page private and not part of the general Internet, but rather, part of your corporate network, behind your corporate firewall
◊ Differentiating your organization from all other companies that use Salesforce in order to reduce phishing attacks
See Also:
371
User Security Setting Login Restrictions
Network-Based Security
User authentication determines who can log in, while network-based security limits where they can log in from and when. Use network-based security to limit the window of opportunity for an attacker by restricting the origin of user logins. Network-based security can also make it more difficult for an attacker to use stolen credentials.
To enhance network-based security, Salesforce includes the ability to restrict the hours during which users can log in and the range of IP addresses from which they can log in. If IP address restrictions are defined for a user's profile and a login originates from an unknown IP address, Salesforce does not allow the login. This helps to protect your data from unauthorized access and “phishing” attacks.
To set the organization-wide list of trusted IP addresses from which users can always log in without a login challenge, see
addresses for specific profiles, see Setting Login Restrictions on page 372.
See Also:
CAPTCHA Security for Data Exports
By request, salesforce.com can also require users to pass a user verification test to export data from Salesforce. This simple, text-entry test helps prevent malicious programs from accessing your organization’s data, as well as reducing the risk of automated attacks. CAPTCHA is a type of network-based security. To pass the test, users must type two words displayed on an overlay into the overlay’s text box field, and click a Submit button. Salesforce uses CAPTCHA technology provided by reCaptcha to verify that a person, as opposed to an automated program, has correctly entered the text into the overlay.
CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.”
See Also:
Setting Login Restrictions
Available in: All Editions
To help protect your organization’s data against unauthorized access, you have several options for setting login restrictions.
Login Hours
For each profile, you can set the hours when users can log in. See:
•
Viewing and Editing Login Hours in the Enhanced Profile User Interface
•
Viewing and Editing Login Hours in the Original Profile User Interface
372
Security Setting Login Restrictions
Login IP Address Ranges
For each profile, you can set the IP addresses from which users can log in. See:
•
Restricting Login IP Ranges in the Enhanced Profile User Interface
•
Restricting Login IP Addresses in the Original Profile User Interface
Organization-Wide Trusted IP Address List
For all users, you can set a list of IP address ranges from which they can always log in without receiving a login challenge.
See
Restricting Login IP Ranges for Your Organization .
When users log in to Salesforce, either via the user interface, the API, or a desktop client such as Connect for Outlook,
Salesforce for Outlook, Connect Offline, Connect for Office, Connect for Lotus Notes, or the Data Loader, Salesforce confirms that the login is authorized as follows:
1. Salesforce checks whether the user’s profile has login hour restrictions. If login hour restrictions are specified for the user’s profile, any login outside the specified hours is denied.
2. Salesforce then checks whether the user’s profile has IP address restrictions. If IP address restrictions are defined for the user’s profile, any login from an undesignated IP address is denied, and any login from a specified IP address is allowed.
3. If profile-based IP address restrictions are not set, Salesforce checks whether the user is logging in from an IP address they have not used to access Salesforce before:
• If the user’s login is from a browser that includes a Salesforce cookie, the login is allowed. The browser will have the
Salesforce cookie if the user has previously used that browser to log in to Salesforce, and has not cleared the browser cookies.
• If the user’s login is from an IP address in your organization’s trusted IP address list, the login is allowed.
• If the user’s login is from neither a trusted IP address nor a browser with a Salesforce cookie, the login is blocked.
Whenever a login is blocked or returns an API login fault, Salesforce must verify the user’s identity:
• For access via the user interface, the user is prompted to click Email me a verification code to send a verification email to the address specified on the user’s Salesforce User Detail. The user copies the verification code from the email and pastes it into their browser to activate their computer for logging in to Salesforce. The verification code included in the email is valid for up to 24 hours from the time the user clicked Email me a verification code. After 24 hours, the verification code expires, and user must repeat the activation process to log in.
Note: A user isn’t asked for a verification code the first time they log in to Salesforce.
• For access via the API or a client, the user must add their security token to the end of their password in order to log in. A security token is an automatically-generated key from Salesforce. For example, if a user’s password is mypassword , and their security token is XXXXXXXXXX , then the user must enter mypasswordXXXXXXXXXX to log in.
Users can obtain their security token by changing their password or resetting their security token via the Salesforce user interface. When a user changes their password or resets their security token, Salesforce sends a new security token to the email address on the user’s Salesforce record. The security token is valid until a user resets their security token, changes their password, or has their password reset.
Tip: We recommend that you obtain your security token using the Salesforce user interface from a trusted network prior to attempting to access Salesforce from a new IP address.
373
My Domain My Domain Overview
Tips on Setting Login Restrictions
Consider the following when setting login restrictions:
• When a user’s password is changed, the user’s security token is automatically reset. The user may experience a blocked login until he or she adds the automatically-generated security token to the end of his or her password when logging in to
Salesforce via the API or a client.
• Partner portal and Customer Portal users are not required to activate computers to log in.
• For more information on API login faults, see the Core Data Types Used in API Calls topic in the SOAP API Developer's
Guide .
• If single sign-on is enabled for your organization, API and desktop client users can’t log into Salesforce unless their IP address is included on your organization’s list of trusted IP addresses or on their profile, if their profile has IP address restrictions set. Futhermore, the single sign-on authority usually handles login lockout policies for users with the “Is Single
Sign-On Enabled” permission. However, if the security token is enabled for your organization, then your organization’s login lockout settings determine the number of times a user can attempt to log in with an invalid security token before being locked out of Salesforce.
• The following events count toward the number of times a user can attempt to log in with an invalid password before being locked out of Salesforce, as defined in your organization’s login lockout settings:
◊ Each time a user is prompted to click Email me a verification code
◊ Each time a user incorrectly adds their security token to the end of their password to log into the API or a client
M
Y
D
OMAIN
My Domain Overview
Available in: Unlimited, Enterprise, Developer, and Database.com editions.
Using My Domain, you can define a custom Salesforce domain name for your organization that highlights your brand, or a different term that represents your business. Using a custom domain name provides important advantages, such as increased security and better support for single sign-on. My Domain is also available for sandbox environments. You can only define a custom domain name one time.
Note: My Domain is subject to these additional Terms of Use .
Your domain name uses the standard URL format, including:
• The protocol: https://
• The subdomain prefix: your brand or term
• The domain: my.salesforce.com
For example, the login URL for a company called Universal Containers would be: https://universalcontainers.my.salesforce.com/
. You can use up to 40 characters.
374
My Domain Setting Up a Domain Name
It's a snap to set up a custom domain name. After you decide on the name or term you want to use, My Domain checks to make sure your subdomain is available. Then it registers the domain name and publishes it to the internet. After a brief period, you'll receive an email to let you know your new domain name is ready for testing. Log in using the new URL and test the
URLs of other pages.
When deployed, you have options for how you want to handle page requests that don't use the new domain name. You can block them entirely or redirect them to the new URL—with or without a message.
Important: After you deploy your new domain name, you can't reverse it. After deployment, all users will be redirected to your new domain.
See Also:
Testing and Rolling Out Your New Domain Name
Guidelines for Implementing and Rolling Out Your Domain Name
Getting System Performance and Maintenance Information Using My Domain
Setting Up a Domain Name
Available in: Unlimited, Enterprise, Developer, and Database.com editions.
To set up a domain name:
User Permissions Needed
“Customize Application”
1. Click
Your Name
> Setup > Company Profile > My Domain.
2. Enter the name you want to use within the sample URL. For example, the login URL for a company called Universal
Containers would be: https://universalcontainers.my.salesforce.com/ . You can use up to 40 characters.
3. Click Check Availability. If your name is already taken, choose a different one.
4. Click Terms and Conditions to review your agreement, then select the checkbox.
5. You'll receive an email when your domain name is ready for testing. (It can take from 24 to 72 hours.) Click the URL in the email to login to Salesforce using your new domain name.
See Also:
375
My Domain My Domain URL Changes
My Domain URL Changes
Available in: Unlimited, Enterprise, Developer, and Database.com editions.
When you set up a domain name for your organization, all of your application URLs, including those of Visualforce pages, will change. This table shows you the differences.
URL Type
Login
Old URL https://login.salesforce.com
New URL https://<subdomain>.my.salesforce.com
Application page or tab https://na1.salesforce.com/<pageID> https://<subdomain>.my.salesforce.com
/<pageID>
Visualforce page with no namespace https://c.na1.visual.force.com/apex/<pagename> https://<subdomain>--c.na1.visual.
force.com/apex/<pagename>
Visualforce page
with namespace https://<yournamespace101>.na1.visual.
https://<subdomain>-force.com/apex/<pagename> <yournamespace>.na1.visual.force.com
/apex/<pagename>
Note: If you implement My Domain in a sandbox environment, the URL format is https://<subdomain>--<sandboxname>.<instance>.my.salesforce.com
. Since you can't have namespaces in a sandbox environment, the format of all Visualforce page URLs in a sandbox is https://<subdomain>--<sandboxname>.<instance>.my.salesforce.com/apex/<pagename> .
See Also:
Testing and Rolling Out Your New Domain Name
After you set up your domain name, you’ll need to test it.
Available in: Unlimited, Enterprise, Developer, and Database.com editions.
To set up a domain name:
User Permissions Needed
“Customize Application”
Test the new domain name by clicking tabs and links that you use within your application. You'll notice that all the tabs and pages show your new domain name. After you test your domain name, you're ready to roll it out to users.
1. When you finish testing your new domain name, click Your Name > Setup > Company Profile > My Domain and click
Deploy to Users to roll out the new domain name to your organization.
376
My Domain Guidelines for Implementing and Rolling Out Your Domain
Name
Important: After you deploy your new domain name, you can't reverse it. After deployment, all users will be redirected to your new domain.
2. Click Edit in the My Domain Settings related list. If you want to accept logins from your new domain only, select the
Login Policy checkbox. If you don't require users to log in from the new domain, they'll be blocked or redirected based on your redirect setting.
3. Select a redirect policy. If you want to redirect page requests that don't use the new domain name, select a redirect option.
Users can access pages with or without a message explaining the URL change.
4. Click Save.
See Also:
Guidelines for Implementing and Rolling Out Your Domain
Name
Available in: Unlimited, Enterprise, Developer, and Database.com editions.
• If your domain is registered but has not yet been deployed, URLs will show My Domain URLs when you log in from the
My Domain login page. However, links that originate from merge fields that are embedded in emails sent asynchronously, such as workflow emails, will still contain the old URLs. After your domain is deployed, those links will show the new My
Domain URLs.
• If you block application page requests that don't use the new Salesforce domain name URLs, let your users know they need to either update old bookmarks or create new ones for the login page and any tabs or links within the application.
Users will be required to use the new URLs if you block page requests.
• If you choose to redirect page requests to new URLs and provide a warning message, let your users know that they should update their bookmarks the first time they're redirected.
• If you have customized your Salesforce UI with features such as custom buttons or Visualforce pages, make sure you test thoroughly before you roll out your new domain name. Your customizations should not use instance-based URLs.
• After you roll out your new domain name, use My Domain's redirect tools to gradually phase it in. For example, choose the
Redirected with a warning...
option to make sure users update their bookmarks. When your organization is ready to use the new domain URLs exclusively, return to setup and choose the
Blocked
option so users can't use their old URLs.
• If you are using My Domain, you can identify which users are logging in with the new login URL, and when. Click Your
Name > Setup > Manage Users > Login History and look at the Username and Login URL columns.
See Also:
377
My Domain Getting System Performance and Maintenance Information
Using My Domain
Getting System Performance and Maintenance Information
Using My Domain
Salesforce customers get system performance and maintenance information from trust.salesforce.com
.
Available in: Unlimited, Enterprise, Developer, and Database.com editions.
To set up a domain name:
User Permissions Needed
“Customize Application”
Here's how to get that information using your new domain name.
1. Go to trust.salesforce.com
.
2. Click the System Status tab.
3. Enter your domain name to find your instance and check the status.
4. Scroll to the System Maintenance table and look for entries for your instance.
See Also:
My Domain FAQ
Available in: Unlimited, Enterprise, Developer, and Database.com Editions. Some topics don't apply to Database.com.
•
Which Salesforce Editions is My Domain available in?
•
Does My Domain work differently in different Salesforce Editions?
•
Is the subdomain for My Domain related to the subdomain for Sites?
•
Is there a limit on how long our subdomain can be?
•
After we set up My Domain, will we still be able to log in from https://login.salesforce.com
•
•
Can we still use our old Salesforce bookmarks?
•
Will our Visualforce page URLs change?
•
Is My Domain available for the API?
Which Salesforce Editions is My Domain available in?
Unlimited, Enterprise, and Developer.
378
Security My Domain FAQ
Does My Domain work differently in different Salesforce Editions?
The only difference is that Developer Edition URLs are appended with "-developer-edition".
Is My Domain available for the API?
Yes, you can use the Salesforce APIs with your My Domain.
Is the subdomain for My Domain related to the subdomain for Sites?
No. The subdomains you use for Sites and My Domain can be the same or different.
Is there a limit on how long our subdomain can be?
Yes. You can use up to 40 characters. The protocol ( https://
) and the domain ( my.salesforce.com
) are not included in the limit.
After we set up My Domain, will we still be able to log in from https://login.salesforce.com
?
Yes, unless your system administrator prevents it. If so, you'll need to log in using your new My Domain URL.
Will we still be able to log in from a URL that includes a Salesforce instance, like https://na1.salesforce.com
?
Yes, unless your system administrator prevents it. If so, you'll need to log in using your new My Domain URL.
Can we still use our old Salesforce bookmarks?
Yes, if your system administrator allows it. If so, you'll be redirected to the Salesforce page using its new My Domain URL.
If your system administrator prevents using old bookmarks, or you see a warning, you should update your bookmarks using the new domain name.
379
Security Prohibiting HTML Attachments and Documents
Will our Visualforce page URLs change?
Yes. URLs for your Visualforce pages will contain your new domain name.
Prohibiting HTML Attachments and Documents
Available in: All Editions except for Database.com
User Permissions Needed
To prohibit uploading of HTML attachments and documents: “Customize Application”
For security reasons, your organization may want to prohibit users from uploading HTML files. The
Disallow HTML documents and attachments security setting, if enabled, blocks users from uploading any file to the Documents tab or as an attachment to a record if it has one of the following file extensions: htm, html, htt, htx, mhtm, mhtml, shtm, shtml, acgi.
To prohibit uploading of HTML attachments and documents:
1. Click
Your Name
> Setup > Security Controls > HTML Documents and Attachments Settings.
2. Select the
Disallow HTML documents and attachments
checkbox.
3. Click Save.
Note: HTML attachments are not permitted on solutions, regardless of whether this security setting is enabled. In addition, this setting does not affect attachments on email templates; HTML attachments on email templates are always permitted.
After this setting is enabled, previously-uploaded HTML documents and attachments are unaffected. However, when users attempt to view an HTML attachment or document, their browser first prompts them to open the file in the browser, save it to their computer, or cancel the action.
Warning: Do not enable this setting if your organization uses the partner portal to give your partner users access to
Salesforce.
380
Security Setting Up the Data Residency Option (DRO)
Setting Up the Data Residency Option (DRO)
Available in: Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To install Data Residency Option software, documentation,
Policy Template, and Fix Releases:
“Data Residency Option Admin”
Using the Salesforce Database Residency Option (DRO) requires having DRO made available for your organization and then configuring your organization to download the DRO tools and documentation. Here’s how:
1. Contact your Salesforce representative to have DRO made available for your org.
Note: Once DRO is enabled, users must log in to the organization through the DRO proxy.
2. Log into your Salesforce organization as an administrator.
3. Do one of the following:
• Add the “Data Residency Option Admin” permission to the profile of your choice, or
• Create a new permission set that contains the “Data Residency Option Admin” permission.
4. Assign the permission set or profile you modified to the user of your choice. This user gets access to the DRO software downloads, documentation, Policy Templates, and Fix Releases.
5. Have the user with “Data Residency Option Admin” permission log into the organization, and click Your Name > Setup
> Security Controls > Data Residency Option.
6. Download the DRO software, documentation, and patches using the links on the DRO page.
381
Connection Security About Single Sign-On
C
ONNECTION
S
ECURITY
About Single Sign-On
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Single sign-on is a process that allows network users to access all authorized network resources without having to log in separately to each resource. Single sign-on allows you to validate usernames and passwords against your corporate user database or other client application rather than having separate user passwords managed by Salesforce.
Salesforce offers the following ways to use single sign-on:
•
Federated authentication using Security Assertion Markup Language (SAML)
: When federated authentication is enabled, Salesforce does not validate a user’s password. Instead, Salesforce verifies an assertion in the HTTP POST request, and allows single sign-on if the assertion is true. This is the default form of single sign-on. Federated authentication is available in all Editions.
•
Instead, Salesforce makes a Web services call to your organization to establish authentication credentials for the user. You must request that this feature be enabled by salesforce.com. Contact salesforce.com to enable delegated authentication single sign-on for your organization.
•
Instead, Salesforce uses the user’s login credentials from an external service provider to establish authentication credentials.
When you have an external identity provider, and configure single sign-on for your Salesforce organization, Salesforce is then acting as a service provider. You can also enable Salesforce as an
identity provider , and use single sign-on to connect to a different
service provider. Only the service provider needs to configure single sign-on.
The Single Sign-On Settings page displays which version of single sign-on is available for your organization. To learn more about the single sign-on settings, see
Configuring SAML Settings for Single Sign-On . For more information about SAML
and Salesforce security, see the Security Implementation Guide .
382
Security About Single Sign-On
Benefits of Single Sign-On
Implementing single sign-on can offer the following advantages to your organization:
• Reduced Administrative Costs: With single sign-on, users only need to memorize a single password to access both network resources or external applications and Salesforce. When accessing Salesforce from inside the corporate network, users are logged in seamlessly, without being prompted to enter a username or password. When accessing Salesforce from outside the corporate network, the users’ corporate network login works to log them in. With fewer passwords to manage, system administrators receive fewer requests to reset forgotten passwords.
• Leverage Existing Investment: Many companies use a central LDAP database to manage user identities. By delegating
Salesforce authentication to this system, when a user is removed from the LDAP system, they can no longer access Salesforce.
Consequently, users who leave the company automatically lose access to company data after their departure.
• Time Savings: On average, a user takes five to 20 seconds to log in to an online application; longer if they mistype their username or password and are prompted to reenter them. With single sign-on in place, the need to manually log in to
Salesforce is avoided. These saved seconds add up to increased productivity.
• Increased User Adoption: Due to the convenience of not having to log in, users are more likely to use Salesforce on a regular basis. For example, users can send email messages that contain links to information in Salesforce.com such as records and reports. When the recipients of the email message click the links, the corresponding Salesforce.com page opens automatically.
• Increased Security: Any password policies that you have established for your corporate network will also be in effect for
Salesforce. In addition, sending an authentication credential that is only valid for a single use can increase security for users who have access to sensitive data.
See Also:
Best Practices for Implementing Single Sign-On
Configuring Salesforce for Delegated Authentication
Viewing Single Sign-On Login Errors
Best Practices for Implementing Single Sign-On
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer and Database.com Editions
Customer Portals and partner portals are not available in Database.com
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Salesforce offers the following ways to use single sign-on:
383
Security About Single Sign-On
•
Federated authentication using Security Assertion Markup Language (SAML)
: When federated authentication is enabled, Salesforce does not validate a user’s password. Instead, Salesforce verifies an assertion in the HTTP POST request, and allows single sign-on if the assertion is true. This is the default form of single sign-on. Federated authentication is available in all Editions.
•
Instead, Salesforce makes a Web services call to your organization to establish authentication credentials for the user. You must request that this feature be enabled by salesforce.com. Contact salesforce.com to enable delegated authentication single sign-on for your organization.
•
Instead, Salesforce uses the user’s login credentials from an external service provider to establish authentication credentials.
In addition, you can also configure SAML for use with portals as well as for Sites.
Delegated Authentication Best Practices
Consider the following best practices when implementing delegated authentication single sign-on for your organization.
• Your organization’s implementation of the Web service must be accessible by salesforce.com servers. This means you must deploy the Web service on a server in your DMZ. Remember to use your server’s external DNS name when entering the
Delegated Gateway URL in the Delegated authentication section at Your Name > Setup > Security Controls > Single
Sign-On Settings in Salesforce.
• If salesforce.com and your system cannot connect, or the request takes longer than 10 seconds to process, the login attempt fails. An error is reported to the user indicating that his or her corporate authentication service is down.
• Namespaces, element names, and capitalization must be exact in SOAP requests. Wherever possible, generate your server stub from the WSDL to ensure accuracy.
• For security reasons, you should make your Web service available by SSL only. You must use an SSL certificate from a trusted provider, such as Verisign or Thawte. For a full list of trusted providers, contact salesforce.com.
• The IP address that originated the login request is sourceIp
. Use this information to restrict access based on the user’s location. Note that the Salesforce feature that validates login IP ranges continues to be in effect for single sign-on users.
For more information, see Setting Login Restrictions on page 372.
• You may need to map your organization’s internal usernames and Salesforce usernames. If your organization does not follow a standard mapping, you may be able to extend your user database schema (for example, Active Directory) to include the Salesforce username as an attribute of a user account. Your authentication service can then use this attribute to map back to a user account.
• We recommend that you do not enable single sign-on for system administrators. If your system administrators are single sign-on users and your single sign-on server has an outage, they have no way to log in to Salesforce. System administrators should always be able to log in to Salesforce so they can disable single sign-on in the event of a problem.
• We recommend that you use a Developer Edition account or a sandbox when developing a single sign-on solution before implementing it in your organization. To sign up for a free Developer Edition account, go to developer.force.com
.
• Make sure to test your implementation with Salesforce.com clients such as Salesforce for Outlook, Connect for Office, and Connect Offline. For more information, see Single Sign-On for Salesforce clients .
Federated Authentication using SAML Best Practices
Consider the following best practices when implementing federated single sign-on with SAML for your organization.
• Obtain the Recipient URL value from the configuration page and put it in the corresponding configuration parameter of your Identity Provider.
• Salesforce allows a maximum of three minutes for clock skew with your IDP server; make sure your server’s clock is up-to-date.
• If you are unable to log in with SAML assertion, always check the login history and note the error message.
384
Security About Single Sign-On
• You need to map your organization’s internal usernames and Salesforce usernames. You have two choices to do this: add a unique identifier to the
FederationIdentifier
field of each Salesforce user, or extend your user database schema
(for example, Active Directory) to include the Salesforce username as an attribute of a user account. Choose the corresponding option for the SAML User ID Type field and configure your authentication service to send the identifier in SAML assertions.
• Before allowing users to log in with SAML assertions, enable the SAML organization preference and provide all the necessary configurations.
• We recommend that you use Developer Edition account or a sandbox when testing a SAML single sign-on solution. To sign up for a free Developer Edition account, go to developer.force.com
.
• All sandbox copies are made with federated authentication with SAML disabled. Any configuration information is preserved, except the value for Recipient URL . The Recipient URL is updated to match your sandbox URL, for example http://cs1.salesforce.com
, after you re-enable SAML. To enable SAML in the sandbox copy, click Your Name
> Setup > Security Controls > Single Sign-On Settings; then click Edit, and select
SAML Enabled
.
• Your identity provider must allow you to set the service provider’s audience URL. The value must match the Entity ID value in the single sign-on configuration. The default value is https://saml.salesforce.com
.
Single Sign-On for Portals Best Practices
• Only SAML version 2.0 can be used with portals.
• Only Customer Portals and partner portals are supported.
• Service provider initiated login is not supported.
• Both the portal_id and organization_id attributes are required for single sign-on for portals. If only one is specified, the user receives an error.
• If both the portal_id
and organization_id
attributes are populated in the SAML assertion, the user is directed to that portal login. If neither is populated, the user is directed to the regular SAML Salesforce login.
• More than one portal can be used with a single organization.
Single Sign-On for Sites Best Practices
• Only SAML version 2.0 can be used with Sites.
• Only Customer Portals and partner portals are supported.
• Service provider initiated login is not supported.
• The portal_id , organization_id and siteUrl attributes are required for single sign-on for Sites. If only one is specified, the user receives an error.
• If all three of the portal_id
, organization_id
and siteUrl
attributes are populated in the SAML assertion, the user is directed to that Sites login. If the siteUrl
isn’t populated and the other two are, the user is directed to that portal login.
• More than one portal can be used with a single organization.
See Also:
Single Sign-On Implementation Guide
385
Security About Single Sign-On
Understanding Delegated Authentication Single Sign-On
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Salesforce uses the following process for authenticating users using delegated authentication single sign-on:
1. When a user tries to log in—either online or using the API—Salesforce validates the username and checks the user’s permissions and access settings.
2. If the user has the “Is Single Sign-On Enabled” user permission, then Salesforce does not validate the username and password. Instead, a Web services call is made to the user’s organization, asking it to validate the username and password.
Note: Salesforce doesn’t store, log, or view the password in any way. It is disposed of immediately once the process is complete.
3. The Web services call passes the username , password , and sourceIp to your Web service. ( sourceIp is the IP address that originated the login request. You must create and deploy an implementation of the Web service that can be accessed by salesforce.com servers.)
4. Your implementation of the Web service validates the passed information and returns either true or false .
5. If the response is true
, then the login process continues, a new session is generated, and the user proceeds to the application.
If false is returned, then the user is informed that his or her username and password combination is invalid.
Note:
• System administrators should have single sign-on disabled. If your system administrators were single sign-on users and your single sign-on server had an outage, the administrators would have no way to log in to Salesforce. System administrators should always be able to log in to Salesforce so that they can disable single sign-on in the event of a problem. All users, except those with the System Administrator profile, have delegated authentication enabled by default in Professional Edition.
• There may be a momentary delay before a new user can log in after using delegated authentication due to the time required for the new user account to become available in the organization.
See Also:
Administrator setup guide: Single Sign-On Implementation Guide
386
Security About Single Sign-On
Configuring Salesforce for Delegated Authentication
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
To enable delegated authentication single sign-on (SSO) for your organization:
1. Contact salesforce.com to enable delegated authentication single sign-on for your organization.
2. Build your single sign-on Web service:
a. In Salesforce, download the Web Services Description Language (WSDL) file,
AuthenticationService.wsdl
, by clicking Your Name > Setup > Develop > API > Download Delegated Authentication WSDL. The WSDL describes the delegated authentication single sign-on service and can be used to automatically generate a server-side stub to which you can add your specific implementation. For example, in the WSDL2Java tool from Apache Axis, you can use the
--server-side
switch. In the wsdl.exe tool from .NET, you can use the
/server
switch.
For a sample request and response, see Sample SOAP Message for Delegated Authentication on page 404.
b. Add a link to your corporate intranet or other internally-accessible site that takes the authenticated user’s credentials and passes them through an HTTP POST to the Salesforce login page.
Because Salesforce does not use the password
field other than to pass it back to you, you do not need to send a password in this field. Instead, you could pass another authentication token, such as a Kerberos Ticket so that your actual corporate passwords are not passed to or from Salesforce.
You can configure the Salesforce delegated authentication authority to allow only tokens or to accept either tokens or passwords. If the authority only accepts tokens, a Salesforce user cannot log in to Salesforce directly, because they cannot create a valid token. However, many companies choose to allow both tokens and passwords. In this environment, a user could still log in to Salesforce through the login page.
When the salesforce.com server passes these credentials back to you in the
Authenticate
message, verify them, and the user will gain access to the application.
3. In Salesforce, specify your organization’s single sign-on gateway URL by clicking Your Name > Setup > Security Controls
> Single Sign-On Settings > Edit. Enter the URL in the Delegated Gateway URL text box.
For security reasons, Salesforce restricts the outbound ports you may specify to one of the following:
• 80: This port only accepts HTTP connections.
• 443: This port only accepts HTTPS connections.
• 1024–66535 (inclusive): These ports accept HTTP or HTTPS connections.
4. Optionally, check the Force Delegated Authentication Callout box.
387
Security About Single Sign-On
Note: When this box is unchecked, a call is not made to the SSO endpoint if the login attempt first fails because of login restrictions within the Salesforce organization. If you must record every login attempt, then check this box to force a callout to the SSO endpoint regardless of login restriction failures.
5. Enable the “Is Single Sign-On Enabled” permission.
Important: If single sign-on is enabled for your organization, API and desktop client users can’t log into Salesforce unless their IP address is included on your organization’s list of trusted IP addresses or on their profile, if their profile has IP address restrictions set. Futhermore, the single sign-on authority usually handles login lockout policies for users with the “Is Single Sign-On Enabled” permission. However, if the security token is enabled for your organization, then your organization’s login lockout settings determine the number of times a user can attempt to log in with an invalid security token before being locked out of Salesforce. For more information, see
See Also:
Understanding Delegated Authentication Single Sign-On
Viewing Single Sign-On Login Errors
To view Single Sign-On login errors:
User Permissions Needed
“Modify All Data”
If your organization is enabled for Single Sign-On using delegated authentication and has built a Single Sign-On solution, you can view the most recent Single Sign-On login errors for your organization.
1. Click Your Name > Setup > Manage Users > Delegated Authentication Error History.
2. For the twenty-one most recent login errors, you can view the user's username, login time, and the error.
Note: Contact salesforce.com to learn more about enabling Single Sign-On for your organization.
See Also:
388
Connection Security About SAML
About SAML
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Security Assertion Markup Language (SAML) is an XML-based standard that allows you to communicate authentication decisions between one service and another. It underlies many Web single sign-on solutions. Salesforce supports SAML for single sign-on into Salesforce from a corporate portal or identity provider.
Much of the work to set up single sign-on using SAML occurs with your identity provider:
1. Establish a SAML identity provider and
gather information about how they will connect to Salesforce. This is the provider
that will send single sign-on requests to Salesforce.
2. Provide information to your identity provider, such as the URLs for the start and logout pages .
3. Configure Salesforce using the instructions in
Configuring SAML Settings for Single Sign-On . This is the only step that
takes place in Salesforce.
Your identity provider should send SAML assertions to Salesforce using the SAML Web Single Sign-on Browser POST profile. Salesforce sends SAML responses to the Identity Provider Login URL specified in Your Name > Setup >
Security Controls > Single Sign-On Settings. Salesforce receives the assertion, verifies it against your Salesforce configuration, and allows single sign-on if the assertion is true.
If you have problems with the SAML assertion after you configure Salesforce for SAML, use the SAML Assertion Validator
If your users are having problems using SAML to login, you can
review the SAML login history to determine why they were
not able to log in and share that information with your identity provider.
If your identity provider supports metadata, and if you've configured SAML using version 2.0, you can click Download
Metadata to download an XML configuration file to send them, which they can then upload to automatically configure their settings for connecting to your Salesforce organization.
See Also:
Viewing Single Sign-On Settings
SAML Assertion Validation Errors
389
Security About SAML
Working With Your Identity Provider
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
1. You must gather the following information from your identity provider before configuring Salesforce for SAML.
• The version of SAML the identity provider uses (1.1 or 2.0)
• The entity ID of the identity provider (also known as the issuer)
• An authentication certificate.
Tip: Be sure to store the certificate where you can access it from your browser. This will be uploaded to
Salesforce in a later step.
• The following SAML assertion parameters, as appropriate:
◊ The SAML user ID type
◊ The SAML user ID location
◊ Attribute Name
◊ Attribute URI
◊ Name ID format
Note: Attribute Name, Attribute URI, and Name ID format are only necessary if the
is in an Attribute element, and not the name identifier element of a Subject statement.
You may also want to share more information
about these values with your identity provider.
Tip: Enable Salesforce for SAML and take a screenshot of the page for your identity provider. Click Your Name
> Setup > Security Controls > Single Sign-On Settings, click Edit, then select
SAML Enabled
.
2. Work with your identity provider to setup the start, login, and logout pages .
390
Security About SAML
successful single sign-on.
See Also:
Configuring SAML Settings for Single Sign-On
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
From this page, you can configure your organization to use single sign-on. You can also set up just-in-time provisioning. Work
Sign-On . For more information about just-in-time provisioning, see
About Just-In-Time Provisioning .
Configuring Single Sign-On
To configure SAML settings for single sign-on from your corporate identity provider to Salesforce:
1.
Gather information from your identity provider.
2.
Provide information to your identity provider.
3. In Salesforce, navigate to Your Name > Setup > Security Controls > Single Sign-On Settings, and click Edit.
4. Select
SAML Enabled
. You must enable SAML to view the SAML single sign-on settings.
5. Specify the SAML version used by your identity provider.
6. Enter the Issuer . This is often referred to as the entity ID for the identity provider.
7. For the
Identity Provider Certificate
, use the Browse button to locate and upload the authentication certificate issued by your identity provider.
8. For SAML 2.0, if your identity provider has specific login or logout pages, specify them in Identity Provider Login URL and Identity Provider Logout URL, respectively.
Note: These fields appear in Developer Edition and sandbox organizations by default and in production organizations only if My Domain is enabled. The fields do not appear in trial organizations or sandboxes linked to trial organizations.
391
Security About SAML
9. For the
Custom Error URL
, specify the URL of the page users should be directed to if there's an error during SAML login. It must be a publicly accessible page, such as a public site Visualforce page. The URL can be absolute or relative.
10. If you are enabling just-in-time provisioning for security, check User Provisioning Enabled .
Note:
• Just-in-time provisioning requires a Federation ID in the user type. In SAML User ID Type , select Assertion contains the Federation ID from the User object.
• If your identity provider previously used the Salesforce username, communicate to them that they must use the Federation ID.
11. For the SAML User ID Type , SAML User ID Location , and
other values as appropriate , specify the value provided
by your identity provider.
( https://saml.salesforce.com
) or the custom domain for the Entity ID. You must share this information with your identity provider.
Tip: Generally, use the custom domain as the entity ID. If you already have single sign-on configured before deploying a domain, the base domain is the entity ID. If you are providing Salesforce to Salesforce services, you must specify the custom domain.
13. Click Save.
If your identity provider supports metadata, and if you've configured SAML using version 2.0, you can click Download
Metadata to download an XML configuration file to send them, which they can then upload to automatically configure their settings for connecting to your Salesforce organization.
After you have configured and saved your SAML settings, test them by trying to access the identity provider's application.
Your identity provider directs the user's browser to POST a form containing SAML assertions to the Salesforce login page.
Each assertion is verified, and if successful, single sign-on is allowed.
If you have difficulty signing on using single sign-on after you have configured and saved your SAML settings, use the
Assertion Validator . You may have to obtain a SAML assertion from your identity provider first.
If your users are having problems using SAML to login, you can
review the SAML login history to determine why they were
not able to log in and share that information with your identity provider.
If you are using SAML version 2.0, after you've finished configuring SAML, the OAuth 2.0 Token Endpoint field is populated.
Use this with the Web single sign-on authentication flow for OAuth 2.0.
See Also:
Best Practices for Implementing Single Sign-On
Validating SAML Settings for Single Sign-On
Administrator setup guide: Single Sign-On Implementation Guide
392
Security About SAML
Viewing Single Sign-On Settings
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
After you have configured your Salesforce organization to use SAML, you can view the single sign-on settings. Click Your
Name
> Setup > Security Controls > Single Sign-on Settings.
This page lists the details of your SAML configuration. Most of these fields are the same as the fields on the page where you
. The following fields contain information automatically generated by completing the configuration. The available fields depend on your configuration.
Field
OAuth 2.0 Token
Endpoint
Description
Salesforce Login URL For SAML 2.0 only. If you select “Assertion contains User's salesforce.com username” for
SAML User ID Type
and “User ID is in the NameIdentifier element of the Subject statement” for SAML User ID Location , this URL is the URL associated with login for the Web single sign-on OAuth assertion flow.
Salesforce Logout URL
For SAML 2.0. Displays the Salesforce logout URL that the user is directed to after he or she logs off. This URL is only used if no value is specified for
Identity Provider Logout
URL
.
For SAML 2.0 only: The ACS URL used with enabling Salesforce as an identity provider in the Web single sign-on OAuth assertion flow.
From this page you can do any of the following:
• Click Edit to change the existing SAML configuration.
• Click SAML Assertion Validator to validate the SAML settings for your organization using a SAML assertion provided by your identity provider.
393
Security About SAML
• If your identity provider supports metadata, and if you've configured SAML using version 2.0, you can click Download
Metadata to download an XML configuration file to send them, which they can then upload to automatically configure their settings for connecting to your Salesforce organization.
See Also:
Identity Provider Values
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Before you can configure Salesforce for SAML, you must receive information from your identity provider. This information must be used on the
The following information might be useful for your identity provider.
Field
SAML Version
Issuer
Entity ID
Description
The version of SAML your identity provider uses. Salesforce currently supports version 1.1
and 2.0. The SAML specifications for the various versions are linked below:
• SAML 1.1
• SAML 2.0
The Entity ID—a URL that uniquely identifies your SAML identity provider. SAML assertions sent to Salesforce must match this value exactly in the
<saml:Issuer>
attribute of SAML assertions.
The issuer in SAML requests generated by Salesforce, and is also the expected audience of
any inbound SAML Responses. If you don’t have domains
deployed, this value is always https://saml.salesforce.com
. If you have domains deployed, Salesforce recommends that you use your custom domain name. You can find the value on the Single Sign-On Settings page. Click Your Name > Setup > Security Controls > Single Sign-On Settings.
394
Security About SAML
Field
Identity Provider
Certificate
Identity Provider
Login URL
Description
The authentication certificate issued by your identity provider.
For SAML 2.0 only: The URL where Salesforce sends a SAML request to start the login sequence.
If you have
domains deployed and a value specified for this field, login requests are usually
sent to the address specified by this field. However, if you need to bypass this value (for example, your identity provider is down) add the login
parameter to the query string for the login page. For example: http://mydomain.my.salesforce.com?login
Note: This field appears in Developer Edition production and sandbox organizations by default and in production organizations only if My Domain is enabled. This field does not appear in trial organizations or sandboxes linked to trial organizations.
Identity Provider
Logout URL
For SAML 2.0 only: The URL to direct the user to when they click the Logout link in
Salesforce. The default is http://www.salesforce.com
.
Note: This field appears in Developer Edition production and sandbox organizations by default and in production organizations only if My Domain is enabled. This field does not appear in trial organizations or sandboxes linked to trial organizations.
Salesforce Login URL
OAuth 2.0 Token
Endpoint
Custom Error URL
SAML User ID Type
The URL associated with login for the Web single sign-on flow.
For SAML 2.0 only: The ACS URL used with enabling Salesforce as an identity provider in the Web single sign-on OAuth assertion flow.
The URL of the page users should be directed to if there’s an error during SAML login. It must be a publicly accessible page, such as a public site Visualforce page. The URL can be absolute or relative.
The element in a SAML assertion that contains the string that identifies a Salesforce user.
Values are:
Assertion contains User’s Salesforce username
Use this option if your identity provider passes the Salesforce username in SAML assertions.
Assertion contains the Federation ID from the User object
Use this option if your identity provider passes an external user identifier, for example an employee ID, in the SAML assertion to identify the user.
SAML User ID Location
The location in the assertion where a user should be identified. Values are:
User ID is in the NameIdentifier element of the Subject statement
The Salesforce
Username
or
FederationIdentifier
is located in the
<Subject> statement of the assertion.
User ID is in an Attribute element
The Salesforce
Username
or
FederationIdentifier
is specified in an
<AttributeValue>
, located in the
<Attribute>
of the assertion.
395
Security About SAML
Field
Attribute Name
Attribute URI
Name ID Format
Service Provider
Initiated Request
Binding
Description
If “
User ID is in an Attribute element
” is selected, this contains the value of the
AttributeName that is specified in <Attribute> that contains the User ID.
If SAML 1.1 is the specified SAML version and “
User ID is in an Attribute element
” is selected, this contains the value of the
AttributeNamespace
that is specified in
<Attribute>
.
If SAML 2.0 is the specified SAML version and “
User ID is in an Attribute element ” is selected, this contains the value for the nameid-format . Possible values include unspecified
, emailAddress
or persistent
. All legal values can be found in the “Name
Identifier Format Identifiers” section of the Assertions and Protocols SAML 2.0 specification .
If you’re using My Domain, chose the binding mechanism your identity provider requests for your SAML messages. Values are:
HTTP POST
HTTP POST binding sends SAML messages using base64-encoded HTML forms.
HTTP Redirect
HTTP Redirect binding sends base64-encoded and URL-encoded SAML messages within URL parameters.
No matter what request binding is selected, the SAML Response will always use HTTP
POST binding.
Start, Login and Logout URL Values
In addition to the information used during the single sign-on, your identity provider can also set the start, login, and logout pages. You can also specify these pages yourself when you
.
The following information might be useful to your identity provider if they are setting these pages.
• The SAML specification supports an HTML form that is used to pass the SAML assertion via HTTPS POST.
• For SAML 1.1, the SAML identity provider can embed name-value pairs in the TARGET field to pass this additional information to Salesforce prepended with a specially formatted URL that contains URL-encoded parameters.
• The URL for SAML 1.1 to include in the
TARGET
field is as follows: https://saml.salesforce.com/?
• For SAML 2.0, instead of using the
TARGET
field, the identity providers uses the
<AttributeStatement>
in the SAML assertion to specify the additional information.
• Salesforce supports the following parameters:
Note: For SAML 1.1 these parameters must be URL-encoded. This allows the URLs, passed as values that include their own parameters, to be handled correctly. For SAML 2.0, these parameters are part of the
<AttributeStatement>
.
◊ ssoStartPage
is the page to which the user should be redirected when trying to log in with SAML. The user is directed to this page when requesting a protected resource in Salesforce, without an active session. The ssoStartPage should be the SAML identity provider’s login page.
◊ startURL
is the URL where you want the user to be directed when sign-on completes successfully. This URL can be absolute, such as https://na1.salesforce.com/001/o or it can be relative, such as /001/o . This parameter is only used in SAML 1.1. In SAML 2.0, the start URL is the page the user attempted to access before they were authenticated.
396
Security About SAML
◊ logoutURL
is the URL where you want the user to be directed when they click the Logout link in Salesforce. The default is http://www.salesforce.com
.
The following sample TARGET field is for SAML 1.1, and includes properly-encoded parameters. It passes a customized start page, as well as start and logout URLs embedded as parameter values in the query string.
https://saml.salesforce.com/?ssoStartPage=https%3A%2F
%2Fwww.customer.org%2Flogin%2F&startURL=%2F001%2Fo&logoutURL=http%3A%2F%2Fwww.salesforce.com
The following is an example of an <AttributeStatement> for SAML 2.0 that contains both ssoStartPage and logoutURL
:
<saml:AttributeStatement>
<saml:Attribute Name="ssoStartPage"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType"> http://www.customer.org
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="logoutURL"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"> https://www.salesforce.com
</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
See Also:
397
Security About SAML
Customizing SAML Start, Error, Login, and Logout Pages
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
The start, error, login, and logout pages can be customized for single sign-on users using SAML 1.1 or 2.0. As part of your configuration, you need to decide the following:
• The logout page: the URL to direct the user to when they click the Logout link in Salesforce. The default is http://www.salesforce.com
.
• If your identity provider uses SAML 1.1, the start page: the URL to direct the user to when sign-on successfully completes.
This URL can be absolute, such as https://na1.salesforce.com/001/o
or it can be relative, such as
/001/o
. This
URL should be an endpoint that accepts SAML authentication requests.
In SAML 2.0, the start page is the page the user attempted to access before they were authenticated. The SAML 2.0 start page must support Sp-init single sign-on.
If you are using SAML 2.0, you can also use the
RelayState
parameter to control where users get redirected after a successful login.
• The single sign-on start page where Salesforce sends a SAML request to start the login sequence.
We recommend that if you specify a single sign-on start page that you also specify a logout page. When you specify a logout page, when a user clicks logout or if a user’s session expires, the user is redirected to that page. If you don’t specify a logout page, the user is redirected to the general Salesforce login page.
For SAML 2.0, these values can be set either during the single sign-on configuration, or by your identity provider in the login
URL or SAML assertion. The order of precedence is:
1. Session cookie—if you’ve already logged into Salesforce and a cookie still exists, the login and logout pages specified by the session cookie are used.
2. Values passed in from the identity provider.
3. Values from the single sign-on configuration page.
If you decide not to add these values to the single sign-on configuration, share them with your identity provider. They will
either in the login URL or the assertion.
398
Security About SAML
You can also decide if you want users to be directed to a custom error page if there’s an error during SAML login: It must be a publicly accessible page, such as a public site Visualforce page. The URL can be absolute or relative. Use this value when
See Also:
Example SAML Assertions
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Share the example SAML assertions with your identity provider so they can determine the format of the information Salesforce requires for successful single-sign on.
In addition to the general single sign-on examples for both SAML 1.1 and SAML 2.0, use the following samples for the specific feature:
•
•
•
SOAP message for delegated authentication
•
assertion for just-in-time provisioning
SAML User ID type is the Salesforce username, and SAML User ID location is the <NameIdentifier> element in the <Subject> element
SAML 1.1:
<Subject>
<NameIdentifier>[email protected]</NameIdentifier>
</Subject>
SAML 2.0:
<saml:Subject>
<saml:NameID
399
Security About SAML
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">[email protected]</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2008-06-26T02:44:24.173Z"
Recipient="http://localhost:9000"/>
</saml:SubjectConfirmation>
</saml:Subject>
SAML User ID type is the Salesforce username, and SAML User ID location is the
<Attribute>
element
SAML 1.1:
<AttributeStatement>
<Subject>
<NameIdentifier>this value doesn't matter</NameIdentifier>
<SubjectConfirmation>
<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod>
</SubjectConfirmation>
</Subject>
<Attribute AttributeName="MySfdcName" AttributeNamespace="MySfdcURI">
<AttributeValue>[email protected]</AttributeValue>
</Attribute>
</AttributeStatement>
SAML 2.0:
<saml:AttributeStatement>
<saml:Attribute FriendlyName="fooAttrib" Name="SFDC_USERNAME"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"> [email protected]
</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
SAML User ID type is the Salesforce User object's
FederationIdentifier
field, and SAML User ID location is the <NameIdentifier> element in the <Subject> element
SAML 1.1:
<AttributeStatement>
<saml:Subject>
<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.0:assertion"
NameQualifier="www.saml_assertions.com">
MyName
</saml:NameIdentifier>
</saml:Subject>
</AttributeStatement>
SAML 2.0:
<saml:Subject>
<saml:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">MyName</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2008-06-26T02:48:25.730Z"
Recipient="http://localhost:9000/"/>
400
Security About SAML
</saml:SubjectConfirmation>
</saml:Subject>
Note: The name identifier can be any arbitrary string, including email addresses or numeric ID strings.
SAML User ID type is theSalesforce User object's FederationIdentifier field, and SAML User ID location is the
<Attribute>
element
SAML 1.1:
<AttributeStatement>
<Subject>
<NameIdentifier>who cares</NameIdentifier>
<SubjectConfirmation>
<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod>
</SubjectConfirmation>
</Subject>
<Attribute AttributeName="MyName" AttributeNamespace="MyURI">
<AttributeValue>user101</AttributeValue>
</Attribute>
</AttributeStatement>
SAML 2.0:
<saml:AttributeStatement>
<saml:Attribute FriendlyName="fooAttrib" Name="SFDC_ATTR"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string"> user101
</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
SAML User ID type is the Salesforce username, and SAML User ID location is the
<NameIdentifier>
element in the <Subject> element
The following is a complete SAML response, for SAML 2.0:
<samlp:Response ID="_257f9d9e9fa14962c0803903a6ccad931245264310738"
IssueInstant="2009-06-17T18:45:10.738Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://www.salesforce.com</saml:Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
<saml:Assertion ID="_3c39bc0fe7b13769cab2f6f45eba801b1245264310738"
IssueInstant="2009-06-17T18:45:10.738Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://www.salesforce.com</saml:Issuer>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"> [email protected]</saml:NameID>
401
Security About SAML
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2009-06-17T18:50:10.738Z"
Recipient="https://login.www.salesforce.com"/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2009-06-17T18:45:10.738Z"
NotOnOrAfter="2009-06-17T18:50:10.738Z">
<saml:AudienceRestriction>
<saml:Audience>https://saml.salesforce.com</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2009-06-17T18:45:10.738Z">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
<saml:AttributeStatement>
<saml:Attribute Name="portal_id">
<saml:AttributeValue xsi:type="xs:anyType">060D00000000SHZ
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="organization_id">
<saml:AttributeValue xsi:type="xs:anyType">00DD0000000F7L5
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="ssostartpage"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType"> http://www.salesforce.com/security/saml/saml20-gen.jsp
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="logouturl"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue xsi:type="xs:string"> http://www.salesforce.com/security/del_auth/SsoLogoutPage.html
</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>
Sample SAML Assertions for Portals
The following shows the portal_id
and organization_id
attributes in a SAML assertion statement:
<saml:AttributeStatement>
<saml:Attribute Name="portal_id">
<saml:AttributeValue xsi:type="xs:anyType">060D00000000SHZ</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="organization_id">
402
Security About SAML
<saml:AttributeValue xsi:type="xs:anyType">00DD0000000F7P5</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
The following is a complete SAML assertion statement that can be used for single sign-on for portals. The organization is using federated sign-on, which is included in an attribute, not in the subject.
<samlp:Response ID="_f97faa927f54ab2c1fef230eee27cba21245264205456"
IssueInstant="2009-06-17T18:43:25.456Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://www.salesforce.com</saml:Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
−
<saml:Assertion ID="_f690da2480a8df7fcc1cbee5dc67dbbb1245264205456"
IssueInstant="2009-06-17T18:43:25.456Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://www.salesforce.com</saml:Issuer>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">null
</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2009-06-17T18:48:25.456Z"
Recipient="https://www.salesforce.com/?saml=02HKiPoin4f49GRMsOdFmhTgi
_0nR7BBAflopdnD3gtixujECWpxr9klAw"/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2009-06-17T18:43:25.456Z"
NotOnOrAfter="2009-06-17T18:48:25.456Z">
<saml:AudienceRestriction>
<saml:Audience>https://saml.salesforce.com</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2009-06-17T18:43:25.456Z">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
<saml:AttributeStatement>
<saml:Attribute FriendlyName="Friendly Name" Name="federationId"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:string">saml_portal_user_federation_id
</saml:AttributeValue>
<saml:AttributeValue xsi:type="xs:string">SomeOtherValue
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="portal_id">
<saml:AttributeValue xsi:type="xs:anyType">060D00000000SHZ
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="organization_id">
<saml:AttributeValue xsi:type="xs:anyType">00DD0000000F7Z5
403
Security About SAML
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="ssostartpage"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType"> http://www.salesforce.com/qa/security/saml/saml20-gen.jsp
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="logouturl"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue xsi:type="xs:string"> http://www.salesforce.com/qa/security/del_auth/SsoLogoutPage.html
</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>
Sample SAML Assertion for Sites
The following shows the portal_id , organization_id , and siteurl attributes in a SAML assertion statement:
<saml:AttributeStatement>
<saml:Attribute Name="portal_id">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">060900000004cDk
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="organization_id">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">00D900000008bX0
</saml:AttributeValue></saml:Attribute>
<saml:Attribute Name="siteurl">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">https://ap1.force.com/mySuffix</saml:AttributeValue>
</saml:Attribute>
Sample SOAP Message for Delegated Authentication
As part of the delegated authentication single sign-on process, a salesforce.com server makes a SOAP 1.1 request to authenticate the user who is passing in the credentials. Here is an example of this type of request. Your single sign-on Web service needs to accept this request, process it, and return a true
or false
response.
Sample Request
<?xml version="1.0" encoding="UTF-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<Authenticate xmlns="urn:authentication.soap.sforce.com">
<username>[email protected]</username>
<password>myPassword99</password>
<sourceIp>1.2.3.4</sourceIp>
</Authenticate>
</soapenv:Body>
</soapenv:Envelope>
404
Security
Sample Response Message
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<AuthenticateResult xmlns="urn:authentication.soap.sforce.com">
<Authenticated>false</Authenticated>
</AuthenticateResult>
</soapenv:Body>
</soapenv:Envelope>
Sample SAML Assertion for Just-In-Time Provisioning
The following is a sample SAML assertion for just in time provisioning.
<saml:Attribute Name="User.Username"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">[email protected]
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.Phone"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">415-123-1234
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.FirstName"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">Testuser
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.LanguageLocaleKey"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">en_US
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.CompanyName"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">Salesforce.com
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.Alias"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">tlee2
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.CommunityNickname"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">tlee2
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.UserRoleId"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">000000000000000
</saml:AttributeValue>
</saml:Attribute>
About SAML
405
Security
<saml:Attribute Name="User.Title"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">Mr.
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.LocaleSidKey"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">en_CA
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.Email"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">[email protected]
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name=" User.FederationIdentifier"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">tlee2
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.TimeZoneSidKey"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">America/Los_Angeles
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.LastName"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">Lee
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.ProfileId"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">00ex0000001pBNL
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.IsActive"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">1
</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="User.EmailEncodingKey"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">UTF-8
</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
See Also:
About SAML
406
Security About SAML
Reviewing the SAML Login History
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
When a user logs in to Salesforce from another application using single sign-on, SAML assertions are sent to the Salesforce login page. The assertions are checked against assertions in the authentication certificate specified in
Your Name
> Setup >
Security Controls > Single Sign-On Settings. If a user fails to log in, a message is written to the login history log that indicates
To view the login history, click Your Name > Setup > Users > Login History. After viewing the login history, you may want to share the information with your identity provider.
The following are the possible failures:
Assertion Expired
An assertion’s
is more than five minutes old.
Note: Salesforce does make an allowance of three minutes for clock skew. This means, in practice, that an assertion can be as much as eight minutes after the timestamp time, or three minutes before it. This amount of time may be less if the assertion’s validity period is less than five minutes.
Assertion Invalid
An assertion is not valid. For example, the
<Subject>
element of an assertion might be missing.
Audience Invalid
The value specified in
<Audience>
must be https://saml.salesforce.com
.
Configuration Error/Perm Disabled
Something is wrong with the SAML configuration in Salesforce. For example, the uploaded certificate might be corrupted, or the organization preference might have been turned off. Check your configuration in
Your Name
> Setup > Security
Controls > Single Sign-On Settings, get a sample SAML assertion from your identity provider, and click
Issuer Mismatched
The issuer or entity ID specified in an assertion does not match the issuer specified in your Salesforce configuration.
407
Security About SAML
Recipient Mismatched
The recipient specified in an assertion does not match the recipient specified in your Salesforce configuration.
Replay Detected
The same assertion ID was used more than once. Assertion IDs must be unique within an organization.
Signature Invalid
The signature in an assertion cannot be validated by the certificate in your Salesforce configuration.
Subject Confirmation Error
The
<Subject>
specified in the assertion does not match the SAML configuration in Salesforce.
See Also:
Validating SAML Settings for Single Sign-On
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
If your users have difficulty logging into Salesforce after you
configure Salesforce for single sign-on
, use the SAML Assertion
Validator and the login history
to validate the SAML assertions sent by your identity provider.
1. Obtain a SAML assertion from your identity provider. The assertion can be either in plain XML format or base64 encoded.
If a user tries to log in to Salesforce and fails, the invalid SAML assertion is used to automatically populate the SAML
Assertion Validator if possible.
2. Click Your Name > Setup > Security Controls > Single Sign-On Settings, then click SAML Assertion Validator.
3. Enter the SAML assertion into the text box, and click Validate.
408
Security About SAML
4. Share the results of the
with your identity provider.
See Also:
Best Practices for Implementing Single Sign-On
Administrator setup guide: Single Sign-On Implementation Guide
SAML Assertion Validation Errors
Federated Authentication is available in: All Editions
Delegated Authentication is available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Authentication Providers are available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Modify All Data”
Salesforce imposes the following validity requirements on assertions:
Authentication Statement
The identity provider must include an <AuthenticationStatement> in the assertion.
Conditions Statement
If the assertion contains a <Conditions> statement, it must contain a valid timestamp.
Timestamps
The validity period specified in an assertion is honored. In addition, an assertion's timestamp must be less than five minutes old, plus or minus three minutes, regardless of the assertion's validity period setting. This allows for differences between machines. The NotBefore and NotOnOrAfter constraints must also be defined and valid.
Attribute
If your Salesforce configuration is set to User ID is in an Attribute element , the assertion from the identity provider must contain an
<AttributeStatement>
.
If you are using SAML 1.1, both <AttributeName> and <AttributeNamespace> are required as part of the
<AttributeStatement>
.
If you are using SAML 2.0, only <AttributeName> is required.
409
Security About SAML
Format
The
Format
attribute of an
<Issuer>
statement must be set to
"urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
or not set at all.
For example:
<saml:Issuer
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://www.salesforce.com</saml:Issuer>
The following example is also valid:
<saml:Issuer >https://www.salesforce.com</saml:Issuer>
Issuer
The issuer specified in an assertion must match the issuer specified in Salesforce.
Subject
The subject of the assertion must be resolved to be either the Salesforce username or the Federation ID of the user.
Audience
The <Audience> value is required and must match the Entity ID from the single sign-on configuration. The default value is https://saml.salesforce.com
.
Recipient
The recipient specified in an assertion must match either the Salesforce login URL specified in the Salesforce configuration or the OAuth 2.0 token endpoint. This is a required portion of the assertion and is always verified.
Signature
A valid signature must be included in the assertion. The signature must be created using the private key associated with the certificate that was provided in the SAML configuration.
Recipient
Verifies that the recipient and organization ID received in the assertion matches the expected recipient and organization
ID, as specified in the single sign-on configuration. This is an optional portion of the assertion and is only verified if it’s present. For example:
Recipient that we found in the assertion: http://aalbert-salesforce.com:8081/
?saml=02HKiPoin4zeKLPYxfj3twkPsNSJF3fxsH0Jnq4vVeQr3xNkIWmZC_IVk3
Recipient that we expected based on the Single Sign-On Settings page: http://asmith.salesforce.com:8081/
?saml=EK03Almz90Cik_ig0L97.0BRme6mT4o6nzi0t_JROL6HLbdR1WVP5aQO5w
Organization Id that we expected: 00Dx0000000BQlI
Organization Id that we found based on your assertion: 00D000000000062
Site URL Attribute
Verifies if a valid Sites URL is provided. Values are:
• Not Provided
• Checked
• Site URL is invalid
410
Connection Security About Just-in-Time Provisioning for SAML
• HTTPS is required for Site URL
• The specified Site is inactive or has exceeded its page limit
See Also:
About Just-in-Time Provisioning for SAML
Available in: All Editions
With Just-in-Time provisioning, you can use a SAML assertion to create regular and portal users on the fly the first time they try to log in. This eliminates the need to create user accounts in advance. For example, if you recently added an employee to your organization, you don't need to manually create the user in Salesforce. When they log in with single sign-on, their account is automatically created for them, eliminating the time and effort with on-boarding the account. Just-in-Time provisioning works with your SAML identity provider to pass the correct user information to Salesforce in a SAML 2.0 assertion. You can both create and modify accounts this way. Because Just-in-Time provisioning uses SAML to communicate, your organization must have SAML-based single sign-on enabled.
Benefits of Just-in-Time Provisioning
Implementing Just-in-Time provisioning can offer the following advantages to your organization.
• Reduced Administrative Costs: Provisioning over SAML allows customers to create accounts on-demand, as part of the single sign-on process. This greatly simplifies the integration work required in scenarios where users need to be dynamically provisioned, by combining the provisioning and single sign-on processes into a single message.
• Increased User Adoption: Users only need to memorize a single password to access both their main site and Salesforce.
Users are more likely to use your Salesforce application on a regular basis.
• Increased Security: Any password policies that you have established for your corporate network are also in effect for
Salesforce. In addition, sending an authentication credential that is only valid for a single use can increase security for users who have access to sensitive data.
See Also:
Just-in-Time Provisioning Requirements
Just-in-Time Provisioning Errors
Just-in-Time Provisioning Requirements
Just-in-Time provisioning requires the creation of a SAML assertion. Consider the following when creating your SAML assertion.
411
Security About Just-in-Time Provisioning for SAML
• Provision Version
is supported as an optional attribute. If it isn't specified, the default is 1.0. For example:
<saml:Attribute Name="ProvisionVersion" NameFormat=
"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">1.0</saml:AttributeValue>
</saml:Attribute>
• ProfileIDs change per organization, even for standard profiles. To make it easier to find the profile name, Salesforce allows you to do a profile name lookup by passing the ProfileName into the ProfileId field.
Field Requirements for the SAML Assertion
To correctly identify which object to create in Salesforce, you must use the
User.
prefix for all fields passed in the SAML assertion. In this example, the User.
prefix has been added to the Username field name.
<saml:Attribute
Name="User.Username"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">[email protected]</saml:AttributeValue>
</saml:Attribute>
The following standard fields are supported.
Required Fields
AboutMe
Alias
CallCenter
City
CommunityNickname
CompanyName
Country
DefaultCurrencyIsoCode
DelegatedApproverId
Department
Division
EmailEncodingKey
EmployeeNumber
Extension
Fax
FederationIdentifier
(insert only)
FirstName
Y
Comments
If not present, a default is derived from FirstName and LastName.
If not present, a default is derived from the UserName.
Derived from organization settings.
If not present, a default is derived from the organization settings.
If present, it must match the SAML subject, or the SAML subject is taken instead. Can't be updated with SAML.
412
Security About Just-in-Time Provisioning for SAML
Fields
ForecastEnabled
IsActive
LastName
LanguageLocaleKey
LocaleSidKey
Manager
MobilePhone
Phone
ProfileId
ReceivesAdminInfoEmails
ReceivesInfoEmails
State
Street
TimeZoneSidKey
Title
Username
(insert only)
UserRoleId
Zip
Required
Y
Y
Y
If not present, a default is derived from the organization settings.
Can't update using SAML.
Defaults to “no role” if blank.
Comments
If not present, a default is derived from the organization settings.
Other field requirements:
• Only text type custom fields are supported.
• Only the insert
and update
functions are supported for custom fields.
• When using the API for user creation, you can pass the new username into the User.Username
field. You can also specify the
User.FederationIdentifier
if it is present. However, the
Username
and
FederationIdentifier
fields can't be updated with API.
See Also:
About Just-in-Time Provisioning for SAML
Just-in-Time Provisioning for Portals
With Just-in-Time (JIT) provisioning for portals, you can use a SAML assertion to create customer and partner portal users on the fly the first time they try to log in. This eliminates the need to create user accounts in advance. Because JIT uses SAML to communicate, your organization must have SAML-based single sign-on enabled.
413
Security About Just-in-Time Provisioning for SAML
Creating Portal Users
The
Portal ID
and
Organization ID
must be specified as part of the SAML assertion. You can find both of these on the company information page for the organization or portal. Because you can also provision regular users, the Portal ID is used to distinguish between a regular and portal JIT provisioning request. If no Portal ID is specified, then the request is treated as a JIT request for regular platform user. Here are the requirements for a creating a portal user.
• You must specify a Federation ID . If the ID belongs to an existing user account, the user account is updated. In case of an inactive user account, the user account is updated, but left inactive unless
User.IsActive
in the JIT assertion is set to true. If there is no user account with that
Federation ID
, the system creates a new user.
• You must pass a valid
Account ID
and
Contact ID
.
• If the portal isn’t self-registration enabled and a default new user profile and role aren’t specified, the User.ProfileId
field must contain a valid profile name or ID associated with the portal. In addition, the
User.PortalRole
field must contain a valid portal role name or ID.
Note: The User.Role
must be null.
Creating and Modifying Accounts
Create or modify an account by specifying a valid
Account ID
or both the
Account.AccountNumber
and
Account.Name
.
• Matching is based on
Account.AccountNumber
. If multiple accounts are found, an error is displayed. Otherwise, the account is updated.
• If no matching account is found, one is created.
• You must specify the
Account.Owner
in the SAML assertion and ensure that the field level security for the
Account.AccountNumber
field is set to visible for this owner’s profile.
Creating and Modifying Contacts
Create or modify a contact by specifying the a valid Contact ID in User.Contact
or both the Contact.Email
and
Contact.LastName
.
• Matching is based on Contact.Email
. If multiple contacts are found, an error is displayed. Otherwise, the contact is updated.
• If no matching contact is found, one is created.
Supported Fields for the Portal SAML Assertion
To correctly identify which object to create in Salesforce, you must use a prefix. In the SAML assertion, use the
Account.
prefix for all fields in the Account schema and Contact.
prefix for all fields in the Contact schema. In this example, the
Contact.
prefix has been added to the
field name.
<saml:Attribute
Name="Contact.Email"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">[email protected]</saml:AttributeValue>
</saml:Attribute>
In addition to the standard fields supported for regular SAML JIT users, these fields are supported for accounts.
Billing
Fields Required Comments
Street|City|State|PostalCode|Country
414
Security About Just-in-Time Provisioning for SAML
Fields
AnnualRevenue
Description
Fax
FederationIdentifier
(insert only)
IsCustomerPortal
IsPartner
NumberOfEmployees
Ownership
Phone
Portal Role
Rating
Street
TickerSymbol
UserRoleId
Website
Zip
Required
Y
Y
Comments
If present, it must match the SAML subject or the SAML subject is taken instead. Can’t be updated using SAML.
Defaults to “no role” if blank.
In addition to the standard fields supported for regular SAML JIT users, these fields are supported for contacts.
Required Comments Fields
Birthdate
CanAllowPortalSelfReg
Department
Description
DoNotCall
Fax
FederationIdentifier
(insert only)
HasOptedOutofEmail
HasOptedOutofFax
HomePhone
LeadSource
Mailing
Y
Name|Phone
If present, it must match the SAML subject or the SAML subject is taken instead. Can’t be updated using SAML.
Street|City|State|PostalCode|Country
415
Security
Fields
MobilePhone
Owner
Other
OtherPhone
Phone
Salutation
Title
Required
About Just-in-Time Provisioning for SAML
Comments
Street|City|State|PostalCode|Country
See Also:
About Just-in-Time Provisioning for SAML
Just-in-Time Provisioning Requirements
Just-in-Time Provisioning Errors
This table shows the error codes for Just-in-Time provisioning for SAML. Errors are returned in the URL parameter, for example: http://login.salesforce.com/identity/jit/saml-error.jsp?
ErrorCode=5&ErrorDescription=Unable+to+create+user&ErrorDetails=
INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST+TimeZoneSidKey
Note:
Salesforce redirects the user to a custom error URL if one is specified in your SAML configuration.
6
8
9
11
2
3
4
5
Code
1
Error Messages
Description
Missing Federation Identifier
Mis-matched Federation Identifier
Invalid organization ID
Unable to acquire lock
Unable to create user
Unable to establish admin context
Unrecognized custom field
Unrecognized standard field
License limit exceeded
Error Details
MISSING_FEDERATION_ID
MISMATCH_FEDERATION_ID
INVALID_ORG_ID
USER_CREATION_FAILED_ON_UROG
USER_CREATION_API_ERROR
ADMIN_CONTEXT_NOT_ESTABLISHED
UNRECOGNIZED_CUSTOM_FIELD
UNRECOGNIZED_STANDARD_FIELD
LICENSE_LIMIT_EXCEEDED
416
Security About Just-in-Time Provisioning for SAML
28
30
31
32
24
25
26
27
18
19
20
22
23
33
34
35
36
37
Code
12
13
14
15
16
17
Description
Federation ID and username do not match
Unsupported provision API version
Username change isn't allowed
Error Details
MISMATCH_FEDERATION_ID_AND_USERNAME_ATTRS
UNSUPPORTED_VERSION
USER_NAME_CHANGE_NOT_ALLOWED
Custom field type isn't supported UNSUPPORTED_CUSTOM_FIELD_TYPE
Unable to map an unique profile ID for the given profile name
PROFILE_NAME_LOOKUP_ERROR
ROLE_NAME_LOOKUP_ERROR Unable to map an unique role ID for the given role name
Invalid account
Missing account name
Missing account number
INVALID_ACCOUNT_ID
MISSING_ACCOUNT_NAME
MISSING_ACCOUNT_NUMBER
Unable to create account
Invalid contact
Missing contact email
Missing contact last name
Unable to create contact
Multiple matching contacts found
Multiple matching accounts found
Invalid account owner
Invalid portal profile
Account change is not allowed
Unable to update account
Unable to update contact
Invalid standard account field value
Contact change not allowed
Invalid portal role
ACCOUNT_CREATION_API_ERROR
INVALID_CONTACT
MISSING_CONTACT_EMAIL
MISSING_CONTACT_LAST_NAME
CONTACT_CREATION_API_ERROR
MULTIPLE_CONTACTS_FOUND
MULTIPLE_ACCOUNTS_FOUND
INVALID_ACCOUNT_OWNER
INVALID_PORTAL_PROFILE
ACCOUNT_CHANGE_NOT_ALLOWED
ACCOUNT_UPDATE_FAILED
CONTACT_UPDATE_FAILED
INVALID_STANDARD_ACCOUNT_FIELD_VALUE
CONTACT_CHANGE_NOT_ALLOWED
INVALID_PORTAL_ROLE
See Also:
About Just-in-Time Provisioning for SAML
417
Connection Security About External Authentication Providers
About External Authentication Providers
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
You can enable users to log into your Salesforce organization using their login credentials from an external service provider such as Facebook © or Janrain © . You must do the following to successfully set up an authentication provider for single sign-on.
• Correctly configure the service provider website.
• Create a registration handler using Apex.
• Define the authentication provider in your organization.
After your authentication provider is set up, the basic flow is the following.
1. The user tries to login to Salesforce using a third party identity.
2. The login request is redirected to the third party authentication provider.
3. The user performs the third party login and approves access.
4. The authentication provider redirects the user to Salesforce with credentials.
5. The user is signed into Salesforce.
Note: If a user has an existing Salesforce session, after authentication with the third party they are automatically redirected to the page where they can approve the link to their Salesforce account.
Defining Your Authentication Provider
We support the following providers:
•
•
•
Creating an Apex Registration Handler
A registration handler class is required to use Authentication Providers for the single sign-on flow. The Apex registration handler class must implement the Auth.RegistrationHandler
interface, which defines two methods. Salesforce invokes the appropriate method on callback, depending on whether the user has used this provider before or not. When you create the authentication provider, you can automatically create an Apex template class for testing purposes. For more information, see
Auth.RegistrationHandler
in the Force.com Apex Code Developer's Guide .
418
Security About External Authentication Providers
Configuring a Facebook Authentication Provider
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
To use Facebook as an authentication provider:
1.
Set up a Facebook application, making Salesforce the application domain.
2.
Define a Facebook authentication provider in your Salesforce organization.
3.
Update your Facebook application to use the
Callback URL
generated by Salesforce as the Facebook
Website Site
URL
.
4.
the connection.
Setting up a Facebook Application
Before you can configure Facebook for your Salesforce organization, you must set up an application in Facebook:
1. Go to the Facebook website and create a new application.
2. Modify the application settings and set the Application Domain to Salesforce.
3. Note the Application ID and the Application Secret.
Defining a Facebook Provider in your Salesforce Organization
You need the Facebook Application ID and Application Secret to set up a Facebook provider in your Salesforce organization.
1. Select
Your Name
> Setup > Security Controls > Auth. Providers.
2. Click New.
3. Select Facebook for the
Provider Type
.
4. Enter a Name for the provider.
5. Enter the
URL Suffix
. This is used in the client configuration URLs. For example, if the URL suffix of your provider is “MyFacebookProvider”, your single sign-on URL is similar to: https://login.salesforce.com/auth/sso/00Dx00000000001/MyFacebookProvider
.
6. Use the Application ID from Facebook for the
Consumer Key
field.
7. Use the Application Secret from Facebook for the Consumer Secret field.
8. Optionally enter a custom error URL for the provider to use to report any errors.
9. Select an already existing Apex class as the
Registration Handler
class or click
Automatically create a registration handler template to create an Apex class template for the registration handler. You must edit this class and modify the default content before using it.
419
Security About External Authentication Providers
Note: You must specify a registration handler class for Salesforce to generate the Single Sign-On
Initialization URL
.
10. Select the user that runs the Apex handler class for Execute Registration As. The user must have “Manage Users” permission.
A user is required if you selected a registration handler class or are automatically creating one.
11. To use a portal with your provider, select the portal from the Portal drop-down list.
12. Click Save.
Be sure to note the generated Auth. Provider Id value. You must use it with the Auth.AuthToken
Apex class.
Several client configuration URLs are generated after defining the authentication provider:
• Test-Only Initialization URL : Administrators use this URL to ensure the third-party provider is set up correctly.
The administrator opens this URL in a browser, signs in to the third party, and is redirected back to Salesforce with a map of attributes.
• Single Sign-On Initialization URL
: Use this URL to perform single sign-on into Salesforce from a third party
(using third-party credentials). The end user opens this URL in a browser, and signs in to the third party. This then either creates a new user for them, or updates an existing user, and then signs them into Salesforce as that user.
• Existing User Linking URL : Use this URL to link existing Salesforce users to a third-party account. The end user opens this URL in a browser, signs in to the third party, signs in to Salesforce, and approves the link.
• Callback URL
: Use the callback URL for the endpoint that the authentication provider calls back to for configuration.
The authentication provider has to redirect to the Callback URL with information for each of the above client configuration
URLs.
The client configuration URLs support additional request parameters that enable you to direct users to log into specific sites, obtain customized permissions from the third party, or go to a specific location after authenticating.
Updating Your Facebook Application
After defining the Facebook authentication provider in your Salesforce organization, go back to Facebook and update your application to use the
Callback URL
as the Facebook
Website Site URL
.
Testing the Single Sign-On Connection
In a browser, open the
Test-Only Initialization URL
on the Auth. Provider detail page. It should redirect you to
Facebook and ask you to sign in. Upon doing so, you are asked to authorize your application. After you authorize, you are redirected back to Salesforce.
See Also:
Using Request Parameters with Client Configuration URLs
About External Authentication Providers
420
Security About External Authentication Providers
Configuring a Janrain Authentication Provider
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
Setting up a Janrain authentication provider is slightly different from setting up other providers. You don’t use the Single
Sign-On Initialization URL that you obtain after registering your provider with Salesforce to start the flow. Instead you use
Janrain’s login widget that’s deployed on your site.
To set up your Janrain provider:
1.
your application with Janrain and get an apiKey
.
2.
Define the Janrain authentication provider in your Salesforce organization.
3.
Get the login widget code from Janrain.
4.
Set up a site that calls the login widget code in your Salesforce organization.
Registering Your Application
You must sign up for a Janrain account from the Janrain website . Once you have your Janrain account, you need the apiKey
.
1. Click Deployment > Sign-in for Web > Handle Tokens.
2. Copy the apiKey . You need this when creating the Janrain provider in your Salesforce organization.
3. Add salesforce.com
to the Janrain domain whitelist in your Janrain account at Deployment > Application Settings
> Domain Whitelist.
Defining the Janrain Provider in your Salesforce Organization
You need the Janrain apiKey
to create a Janrain provider in your Salesforce organization.
1. Select Your Name > Setup > Security Controls > Auth. Providers.
2. Click New.
3. Select Janrain for the
Provider Type
.
4. Enter a Name for the provider.
5. Enter the
URL Suffix
. This is used in the
Callback URL
. For example, if the URL suffix of your provider is
“MyJanrainProvider”, your Callback URL is similar to https://login.salesforce.com/services/authcallback/00D300000007CvvEAE/MyJanrainProvider
.
6. Use the Janrain apiKey value for the Consumer Secret .
7. Optionally enter a custom error URL for the provider to use to report any errors.
8. Select an already existing Apex class as the Registration Handler class or click Automatically create a registration handler template to create the Apex class template for the registration handler. You must edit this class to modify the default content before using it.
421
Security About External Authentication Providers
Note: You must specify a registration handler class for Salesforce to use single sign-on.
9. Select the user that runs the Apex handler class for Execute Registration As. The user must have “Manage Users” permission.
A user is required if you selected a registration handler class or are automatically creating one.
10. To use a portal with your provider, select the portal from the Portal drop-down list.
11. Click Save.
Note the value of the generated Callback URL . You need it to complete the Janrain setup.
Several client configuration parameters are available after configuring Janrain as the authentication provider. Use these for the flowtype
value in the
Callback URL
with your Janrain login widget:
• test
: Use this parameter to make sure the third-party provider is set up correctly. The administrator configures a Janrain widget to use flowtype=test
, signs in to the third party, and is redirected back to Salesforce with a map of attributes.
• link
: Use this parameter to link existing Salesforce users to a third-party account . The end user goes to a page with a
Janrain widget configured to use flowtype=link
, signs in to the third party, signs in to Salesforce, and approves the link.
• sso : Use this parameter to perform single sign-on into Salesforce from a third party (using third-party credentials). The end user goes to a page with a Janrain widget configured to use flowtype=sso
, and signs in to the third party. This then either creates a new user for them, or updates an existing user, and then signs them into Salesforce as that user.
The client configuration URLs support additional request parameters that enable you to direct users to log into specific sites, obtain customized permissions from the third party, or go to a specific location after authenticating.
Getting the Login Widget Code from Janrain
You need to get the login widget code from Janrain for your Salesforce organization.
1. From your Janrain account, click Application > Sign-in for Web > Get the Code.
2. Enter the
Callback URL
value from your Janrain provider information in your Salesforce organization along with the query parameter flowtype=sso as the token URL. For example, https://login.salesforce.com/services/authcallback/00DD0000000JWFwMAB/JanrainApp?flowtype=sso .
To use My Domain, replace login.salesforce.com
with your My Domain name.
Creating a Site to Call the Login Widget
1. Enable Sites.
2. Create a page and copy the login widget code to the page.
3. Create a new site and specify the page you just created as the home page for the site.
See Also:
About External Authentication Providers
422
Security About External Authentication Providers
Configuring a Salesforce Authentication Provider
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
You can use a remote access application as an authentication provider. You must complete these steps:
1.
Define a remote access application
.
2.
Define a Salesforce authentication provider in your organization .
3.
Defining a Remote Access Application
Before you can configure a Salesforce provider for your Salesforce organization, you must define a remote access application that uses single sign-on. Define remote access applications in
Your Name
> Setup > Develop > Remote Access.
After you finish defining a remote access application, save the values from the
Consumer Key
and
Consumer Secret
fields.
Defining the Salesforce Authentication Provider in your Organization
You need the values from the
Consumer Key
and
Consumer Secret
fields of the remote access application definition to set up the authentication provider in your organization.
1. Click Your Name > Setup > Security Controls > Auth. Providers.
2. Click New.
3. Select Salesforce for the
Provider Type
.
4. Enter a
Name
for the provider.
5. Enter the URL Suffix . This is used in the client configuration URLs. For example, if the URL suffix of your provider is “MySFDCProvider”, your single sign-on URL is similar to https://login.salesforce.com/auth/sso/00Dx00000000001/MySFDCProvider .
6. Paste the value of
Consumer Key
from the remote access application definition into the
Consumer Key
field.
7. Paste the value of
Consumer Secret
from the remote access application definition into the
Consumer Secret
field.
8. Optionally enter a custom error URL for the provider to use to report any errors.
9. Select an already existing Apex class as the Registration Handler class or click Automatically create a registration handler template
to create the Apex class template for the registration handler. You must edit this template class to modify the default content before using it.
Note: You must specify a registration handler class for Salesforce to generate the
Single Sign-On
Initialization URL
.
423
Security About External Authentication Providers
10. Select the user that runs the Apex handler class for
Execute Registration As
. The user must have “Manage Users” permission. A user is required if you selected a registration handler class or are automatically creating one.
11. To use a portal with your provider, select the portal from the Portal drop-down list.
12. Click
Save
.
Note the value of the Client Configuration URLs. You need the
Callback URL
to complete the last step, and you use the Test-Only Initialization URL to check your configuration. Also be sure to note the Auth. Provider Id value because you must use it with the
Auth.AuthToken
Apex class.
13. Return to the remote access application definition you created above and paste the value of
Callback URL
from the authentication provider into the
Callback URL
field.
Several client configuration URLs are generated after defining the authentication provider:
• Test-Only Initialization URL : Administrators use this URL to ensure the third-party provider is set up correctly.
The administrator opens this URL in a browser, signs in to the third party, and is redirected back to Salesforce with a map of attributes.
• Single Sign-On Initialization URL
: Use this URL to perform single sign-on into Salesforce from a third party
(using third-party credentials). The end user opens this URL in a browser, and signs in to the third party. This then either creates a new user for them, or updates an existing user, and then signs them into Salesforce as that user.
•
Existing User Linking URL
: Use this URL to link existing Salesforce users to a third-party account. The end user opens this URL in a browser, signs in to the third party, signs in to Salesforce, and approves the link.
• Callback URL : Use the callback URL for the endpoint that the authentication provider calls back to for configuration.
The authentication provider has to redirect to the Callback URL with information for each of the above client configuration
URLs.
The client configuration URLs support additional request parameters that enable you to direct users to log into specific sites, obtain customized permissions from the third party, or go to a specific location after authenticating.
Testing the Single Sign-On Connection
In a browser, open the
Test-Only Initialization URL
on the Auth. Provider detail page. Both the authorizing organization and target organization must be in the same environment, such as production or a sandbox.
See Also:
About External Authentication Providers
424
Connection Security Using Request Parameters with Client Configuration URLs
Using Request Parameters with Client Configuration URLs
You can add functionality to your authentication provider by using additional request parameters.
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
Authentication providers support additional request parameters you can use to direct users to log into specific sites, obtain customized permissions from the third party, or go to a specific location after authenticating.
Add the request parameters to the following client configuration URLs. These were generated after you defined your authentication provider:
• Test-Only Initialization URL
• Single Sign-On Initialization URL
• Existing User Linking URL
Append any of these parameters to your URL as needed. For Janrain providers, append them to the appropriate callback URL.
•
– Customizes the permissions requested from the third party
•
Site – Enables the provider to be used with a site
•
Start – Sends the user to a specified location after authentication
425
Security Using Request Parameters with Client Configuration URLs
Using the Scope Parameter
Customizes the permissions requested from the third party like Facebook or Janrain so that the returned access token has additional permissions.
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
You can customize requests to a third party to receive access tokens with additional permissions. Then you use Auth.AuthToken
methods to retrieve the access token that was granted so you can use those permissions with the third party. The default scopes vary depending on the third party, but usually do not allow access to much more than basic user information.
The space-delimited string of requested scopes is sent as-is to the third party, and overrides the default permissions requested by authentication providers.
Janrain does not use this parameter; additional permissions must be configured within Janrain.
The following is an example of a scope
parameter requesting the Salesforce scopes api
and web
, added to the
Single
Sign-On Initialization URL
, where:
• orgID
is your Auth. Provider ID
•
URLsuffix
is the value you specified when you defined the authentication provider https://login.salesforce.com/services/auth/sso/orgID/URLsuffix?scope=id%20api%20web
Valid scopes vary depending on the third party; refer to your individual third-party documentation. For example, Salesforce scopes are:
Value api chatter_api full id refresh_token visualforce
Description
Allows access to the current, logged-in user’s account over the APIs, such as REST API or
Bulk API. This also includes chatter_api
, allowing access to Chatter API resources.
Allows access to only the Chatter API resources.
Allows access to all data accessible by the logged-in user. full
does not return a refresh token. You must explicitly request the refresh_token scope to get a refresh token.
Allows access only to the identity URL service.
Allows a refresh token to be returned if you are eligible to receive one.
Allows access to Visualforce pages.
426
Security
Value web
Using Request Parameters with Client Configuration URLs
Description
Allows the ability to use the access_token
on the Web. This also includes visualforce
, allowing access to Visualforce pages.
See Also:
Using Request Parameters with Client Configuration URLs
Using the Site Parameter
Use your authentication provider to log into a site or link to a sites user.
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
To use your provider with a site, you need to do the following:
• Enable the provider to be used with a site
• Ensure the site is configured to use the same portal
• Add the site-specific login URL information to the appropriate client configuration URL, such as the
Single Sign-On
Initialization URL , using the site parameter
You create the site login Visualforce page, or specify the default page, when you create the site. An example site login URL is: https%3A%2F%2Fmysite.force.com%2FSiteLogin
.
The following is an example of a site-login URL added to the
Single Sign-On Initialization URL
, using the site parameter, where:
• orgID
is your Auth. Provider ID
•
URLsuffix
is the value you specified when you defined the authentication provider https://login.salesforce.com/services/auth/sso/orgID/URLsuffix?site=https%3A%2F%2Fmysite.force.com%2FSiteLogin
If you don’t specify a site
parameter, the user proceeds either to a standard portal (if set up for a portal) or the standard application (if not).
See Also:
Using Request Parameters with Client Configuration URLs
427
Connection Security About Salesforce Certificates and Keys
Using the StartURL Parameter
Send your user to a specific location after authenticating or linking.
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To view the settings:
To edit the settings:
User Permissions Needed
“View Setup and Configuration”
“Customize Application”
AND
“Manage Auth. Providers”
To direct your users to a specific location after authenticating, you need to specify a URL with the startURL
request parameter.
This URL must be a relative URL; passing an absolute URL results in an error. If you don’t add startURL , the user is sent to either /home/home.jsp
(for a portal or standard application) or to the default sites page (for a site) after authentication completes.
For example, with a
Single Sign-On Initialization URL
, the user is sent to this location after being logged in. For an Existing User Linking URL , the “Continue to Salesforce” link on the confirmation page leads to this page.
The following is an example of a startURL parameter added to the Single Sign-On Initialization URL , where:
• orgID
is your Auth. Provider ID
• URLsuffix
is the value you specified when you defined the authentication provider https://login.salesforce.com/services/auth/sso/orgID/URLsuffix?startURL=%2F005x00000000001%3Fnoredirect%3D1
See Also:
Using Request Parameters with Client Configuration URLs
About Salesforce Certificates and Keys
Available in: All Editions
To create, edit, and manage certificates:
User Permissions Needed
“Customize Application”
To work with Salesforce certificates and keys, click Your Name > Setup > Security Controls > Certificate and Key
Management. From this page you can:
• Manage your certificates
428
Security About Salesforce Certificates and Keys
• Manage your master encryption key
Certificates
Salesforce certificates and key pairs are used for signatures that verify a request is coming from your organization. They are used for authenticated SSL communications with an external web site, or when using your organization as an Identity Provider.
You only need to generate a Salesforce certificate and key pair if you're working with an external website that wants verification that a request is coming from a Salesforce organization.
Salesforce offers two types of certificates:
Self-signed
A self-signed certificate is signed by Salesforce. Not all external websites accept self-signed certificates.
CA-signed
A CA-signed certificate is signed by an external certificate authority (CA). Most external websites accept CA-signed certificates. You must first generate the certificate signing request to send to a CA, and then import the signed version of the certificate before you can use it.
Master Encryption Keys
Fields that are encrypted using encrypted custom fields, such as social security number or credit card number, use a master encryption key to encrypt the data. This key is automatically assigned when you enable encrypted fields for your organization.
You can manage the master key based on your organization’s security needs and regulatory requirements.
See Also:
Creating Certificates and Key Pairs
Uploading Certificate Authority (CA)-Signed Certificates
Managing Master Encryption Keys
Editing Salesforce Certificates and Key Pairs
Creating Certificates and Key Pairs
Available in: All Editions
To create, edit, and manage certificates:
User Permissions Needed
“Customize Application”
Salesforce offers two types of certificates:
Self-signed
A self-signed certificate is signed by Salesforce. Not all external websites accept self-signed certificates.
429
Security About Salesforce Certificates and Keys
CA-signed
A CA-signed certificate is signed by an external certificate authority (CA). Most external websites accept CA-signed certificates. You must first generate the certificate signing request to send to a CA, and then import the signed version of the certificate before you can use it.
To create a Salesforce certificate:
1. Go to Your Name > Setup > Security Controls > Certificate and Key Management.
2. Select either Create Self-Signed Certificate or Create CA-Signed Certificate, based on what kind of certificate your external website accepts. You can’t change the type of a certificate after you’ve created it.
3. Enter a descriptive label for the Salesforce certificate. This name is used primarily by administrators when viewing certificates.
4. Enter the Unique Name . This name is automatically populated based on the certificate label you enter. This name can contain only underscores and alphanumeric characters, and must be unique in your organization. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores. Use the Unique
Name
when referring to the certificate using the Force.com Web services API or Apex.
5. Select a
Key Size
for your generated certificate and keys. We recommend that you use the default key size of
2048
for security reasons. Selecting
2048
generates a certificate using 2048-bit keys and is valid for two years. Selecting
1024 generates a certificate using 1024-bit keys and is valid for one year.
Note: Once you save a Salesforce certificate, you can’t change the key size.
6. If you’re creating a CA-signed certificate, you must also enter the following information. These fields are joined together to generate a unique certificate.
Field
Common Name
Email Address
Company
Department
City
State
Country Code
Description
The fully qualified domain name of the company requesting the signed certificate. This is generally of the form: http://www.mycompany.com
.
The email address associated with this certificate.
Either the legal name of your company, or your legal name.
The branch of your company using the certificate, such as marketing or accounting.
The city where the company resides.
The state where the company resides.
A two-letter code indicating the country where the company resides. For the United States, the value is
US
.
7. Click Save.
After you successfully save a Salesforce certificate, the certificate and corresponding keys are automatically generated.
You can have a maximum of 50 certificates.
After you create a CA-signed certificate, you must upload the signed certificate
before you can use it.
430
Security About Salesforce Certificates and Keys
Note: After you create a CA-signed certificate and certificate request, the certificate is not active and you can’t use it until it’s been signed by a certificate authority and uploaded into your organization.
See Also:
About Salesforce Certificates and Keys
Uploading Certificate Authority (CA)-Signed Certificates
Available in: All Editions
To create, edit, and manage certificates:
User Permissions Needed
“Customize Application”
1. Click Your Name > Setup > Security Controls > Certificate and Key Management, click the name of the certificate, then click Download Certificate Signing Request.
2. Send the certificate request to the certificate authority of your choice.
3. After the certificate authority sends back the signed certificate, click Your Name > Setup > Security Controls > Certificate
and Key Management, click the name of the certificate, then click Upload Signed Certificate.
4. Click Browse to locate the CA-signed certificate. The CA-signed certificate must match the certificate created in Salesforce.
If you try to upload a different CA-signed certificate, the upload fails.
5. Click Save to finish the upload process. Click Cancel at any time to not upload the certificate.
After you successfully upload the signed certificate, the status of the certificate is changed to
Active
and you can use CA-signed certificate.
Note: You can’t delete a CA-signed certificate after you’ve uploaded the signed certificate.
See Also:
About Salesforce Certificates and Keys
431
Security About Salesforce Certificates and Keys
Managing Master Encryption Keys
Available in: All Editions
To create, edit, and manage certificates:
User Permissions Needed
“Customize Application”
Fields that are encrypted using encrypted custom fields, such as social security number or credit card number, use a master encryption key to encrypt the data. This key is automatically assigned when you enable encrypted fields for your organization.
You can manage the master key based on your organization’s security needs and regulatory requirements. With master encryption keys, you can do the following:
• Archive the existing key and create a new key
• Export an existing key after it's been archived
• Delete an existing key
• Import an existing key after it's been deleted
Archiving and Creating New Keys
To archive your current key and create a new key:
1. Click
Your Name
> Setup > Security Controls > Certificate and Key Management.
2. Click Archive Current Key and Create New Key.
3. A warning message displays letting you know you are changing keys. Click OK.
4. A new key is generated, assigned the next sequential number, and activated.
All new data is encrypted using the new key. Existing data continues to use the archived key until the data is modified and saved. Then data is encrypted using the new key.
After you archive a key, you can export or delete it.
Exporting Keys
You can export your keys to a back-up location for safe keeping. It’s a good idea to export a copy of any key before deleting it.
Exporting creates a text file with the encrypted key. You can import the key back into your organization at a later time.
Click Export next to the key you want to export.
Deleting Keys
Don't delete a key unless you're absolutely certain no data is currently encrypted using the key. After you delete a key, any data encrypted with that key can no longer be accessed. If you export the key before you delete it, you can import the key back into your organization.
To delete a key, click Delete next to the key you want to delete.
The date the key is deleted displays.
432
Security About Salesforce Certificates and Keys
Importing Keys
If you have data associated with a deleted key, you can import an exported key back into your organization. Any data that was not accessible becomes accessible again.
Click
Import
next to the key you want to import.
See Also:
About Salesforce Certificates and Keys
Editing Salesforce Certificates and Key Pairs
Available in: All Editions
To create, edit, and manage certificates:
User Permissions Needed
“Customize Application”
After you create a Salesforce certificate, you can only change the Label and the Unique Name . You can’t change the type, key size, and so on. The certificate and the keys aren’t regenerated when you edit a Salesforce certificate.
Warning: Apex and the Force.com Web services API use the
Unique Name
to access the certificate. Changing the
Unique Name could cause your code to break.
To edit a Salesforce certificate:
1. Go to Your Name > Setup > Security Controls > Certificate and Key Management.
2. Click Edit next to the name of a Salesforce certificate.
3. Make your changes, then click Save.
To delete a certificate, click Del. If a certificate is being used as part of the configuration of your identity provider, you cannot delete it.
Note: You can’t delete a CA-signed certificate after you’ve uploaded the signed certificate.
See Also:
About Salesforce Certificates and Keys
433
Connection Security About Identity Providers and Service Providers
Viewing Salesforce Certificates and Key Pairs
Available in: All Editions
To create, edit, and manage certificates:
User Permissions Needed
“Customize Application”
To view the details of a Salesforce certificate, click Your Name > Setup > Security Controls > Certificate and Key Management, then click the name of a certificate.
From the certificate detail page, you can do any of the following:
• Click Edit to
edit the label or unique name of the certificate.
• Click Delete to delete the certificate.
Note: You can’t delete a CA-signed certificate after you’ve uploaded the signed certificate.
• Click Download Certificate to download the full Base-64 encoded certificate. This is only available for active certificates.
For CA-signed certificates, you must first upload the signed certificate
before you can download or use it.
• Click Download Certificate Signing Request for CA-signed certificates that have not yet had the signed certificate uploaded.
• Click Upload Signed Certificate to upload the CA-signed certificate.
See Also:
About Salesforce Certificates and Keys
About Identity Providers and Service Providers
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
An identity provider is a trusted provider that enables you to use single sign-on to access other websites. A service provider is a website that hosts applications. You can enable Salesforce as an identity provider, then define one or more service providers, so your users can access other applications directly from Salesforce using single sign-on. This can be a great help to your users: instead of having to remember many passwords, they will only have to remember one. Plus, the applications can be added as tabs to your Salesforce organization, which means users won’t have to switch between programs.
434
Security About Identity Providers and Service Providers
Before you can enable Salesforce as an identity provider, you must set up a domain .
. If you haven’t generated a Salesforce certificate and key pair, one is automatically created for you when you enable Salesforce as an identity provider.
You also have the option of picking an already generated certificate, or creating one yourself.
Salesforce uses the SAML 2.0 standard for single sign-on and generates SAML assertions when configured as an identity provider.
Use the
if your users have errors when trying to log into your service provider’s apps.
Using Identity Providers and Service Providers
Salesforce supports the following:
• Identity-provider-initiated login—when Salesforce logs into a service provider at the initiation of the end-user
• Service-provider-initiated login—when the service provider requests Salesforce to authenticate a user, at the initiation of the end-user
The following is the general flow when Salesforce as an identity provider logs into a service provider.
1. User tries to access a service provider already defined in Salesforce.
2. Salesforce sends a
to the service provider.
435
Security About Identity Providers and Service Providers
3. Service provider identifies the user and authenticates the certificate.
4. If the user is identified, they are logged into the service provider.
The following is the general flow when a service provider initiates login and uses Salesforce to identify the user.
1. The service provider sends a valid SAML request. The endpoint is automatically generated when the service provider is defined—the SP-Initiated POST Endpoint .
2. Salesforce identifies the user included in the SAML request.
<samlp:AuthnRequest ID="bndkmeemcaamihajeloilkagfdliilbhjjnmlmfo" Version="2.0"
IssueInstant="2010-05-24T22:57:19Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
ProviderName="google.com" IsPassive="false"
AssertionConsumerServiceURL="https://www.google.com/a/resp.info/acs">
<saml:Issuer>google.com</saml:Issuer>
<samlp:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
</samlp:AuthnRequest>
If a certificate was included as part of the definition, Salesforce authenticates the certificate.
436
Security About Identity Providers and Service Providers
Note: If a certificate is included in the service provider definition, and the SAML request does not contain a certificate, the request fails, and the user is not logged in using Salesforce. If the definition does not include a certificate, and the request includes a signature, the request succeeds if the user is identified correctly.
3. If the user isn’t already logged into Salesforce, they are prompted to do so.
4. Salesforce sends a
to the service provider.
5. The service provider authenticates the SAML response sent by Salesforce. If the user has been authenticated, they are logged into the service provider. The user is also logged into Salesforce.
Important: Salesforce doesn’t provide any mechanism for automatically logging the user out of Salesforce when they log out of the service provider.
The following is an example of the SAML response from Salesforce. You might want to share this information with your service provider.
<samlp:Response Destination="https://login-blitz03.soma.salesforce.com/
?saml=MgoTx78aEPa2r1BHKCHmlfUKhH2mkDrXOjmYcjHG_qNDbsRM_6ZAo.wvGk"
ID="_0f551f9288c8b76f21c3d4d15c9cd1df1290476801091"
InResponseTo="_2INwHuINDJTvjo8ohcM.Fpw_uLukYi0WArVx2IJD569kZYL
osBwuiaSbzzxOPQjDtfw52tJB10VfgPW2p5g7Nlv5k1QDzR0EJYGgn0d0z8
CIiUOY31YBdk7gwEkTygiK_lb46IO1fzBFoaRTzwvf1JN4qnkGttw3J6L4b opRI8hSQmCumM_Cvn3DHZVN.KtrzzOAflcMFSCY.bj1wvruSGQCooTRSSQ"
IssueInstant="2010-11-23T01:46:41.091Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
>identityorg.blitz03.blitz.salesforce.com</saml:Issuer>
−
<ds:Signature>
−
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
−
<ds:Reference URI="#_0f551f9288c8b76f21c3d4d15c9cd1df1290476801091">
−
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
−
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="ds saml samlp xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>4NVTbQ2WavD+ZBiyQ7ufc8EhtZw=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
−
<ds:SignatureValue> eqrkFxNlJRCT4VQ7tt7wKZGK7oLCCCa4gV/HNcL03RoKbSXIcwU2CAqW0qTSj25FqhRe2fOwAYa5 xFWat7Fw2bbncU+/nnuVNZut8HEEQoHiQA/Jrh7XB4CNlOpM1QRvgB5Dtdkj/0lI4h3X3TFix57B sgZJGbb5PWEqSH3ZAl+NPvW9nNtYQIFyCTe9+cw2BhCxFgSWfP3/kIYHSM2gbIy27CrRrFS1lAqP hKSLaH+ntH1E09gp78RSyJ2WKFGJU22sE9RJSZwdVw3VGG06Z6RpSjPJtaREELhhIBWTHNoF+VvJ
2Hbexjew6CO08lXRDe8dbrrPIRK/qzHZYf1H0g==
</ds:SignatureValue>
−
<ds:KeyInfo>
−
<ds:X509Data>
−
<ds:X509Certificate>
MIIEbjCCA1agAwIBAgIOASh04QulAAAAAClXs7MwDQYJKoZIhvcNAQEFBQAwfTEVMBMGA1UEAwwM
437
Security About Identity Providers and Service Providers
SWRlbnRpdHkgT3JnMRgwFgYDVQQLDA8wMEREMDAwMDAwMEZIOGwxFzAVBgNVBAoMDlNhbGVzZm9y
Y2UuY29tMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQswCQYDVQQIDAJDQTEMMAoGA1UEBhMDVVNB
MB4XDTEwMDUwNzIyMjcwNVoXDTEyMDUwNjIyMjcwNVowfTEVMBMGA1UEAwwMSWRlbnRpdHkgT3Jn
MRgwFgYDVQQLDA8wMEREMDAwMDAwMEZIOGwxFzAVBgNVBAoMDlNhbGVzZm9yY2UuY29tMRYwFAYD
VQQHDA1TYW4gRnJhbmNpc2NvMQswCQYDVQQIDAJDQTEMMAoGA1UEBhMDVVNBMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyM4/sjoaizbnWTDjt9mGht2fDGxnLCWGMJ+D+9NWXD5wM15N
SFEcflpI9W4makcCGvoac+CVbPTmOUzOsCQzu7iGkLeMMpngf2XqllnJgl4ejuH8socNrDtltaMk hC08KAmli3Wm/okllqSjVOl8H52jtbvm6HkvLVj2NDLRY6kUejVZMGjGwV5E0FJliwgIip4sCchl dkahbNjbikiiv1MAs8xHbtBt3wnKZWJq3JtS0va1sazUVmEwGDlVW43QPF0S7eV3IJFFhyCPV8yF
N3k0wCkCVBWoknwkMA8CbD+p6qNBVmvh3F3IaW2oym/1eSvtMLNtrPJeZzssqDYqgQIDAQABo4Hr
MIHoMB0GA1UdDgQWBBTYSVEZ9r8Q8T2rbZxPFfPYPZKWITCBtQYDVR0jBIGtMIGqgBTYSVEZ9r8Q
8T2rbZxPFfPYPZKWIaGBgaR/MH0xFTATBgNVBAMMDElkZW50aXR5IE9yZzEYMBYGA1UECwwPMDBE
RDAwMDAwMDBGSDhsMRcwFQYDVQQKDA5TYWxlc2ZvcmNlLmNvbTEWMBQGA1UEBwwNU2FuIEZyYW5j aXNjbzELMAkGA1UECAwCQ0ExDDAKBgNVBAYTA1VTQYIOASh04QupAAAAAClXs7MwDwYDVR0TAQH/
BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEANaO5Tqcc56E6Jv8itwjtbPvR+WHEMnZgQ9cCPF5Q
VACd5v7I/srx4ZJt/ZO4RZkmX1FXla0M7JGOu63eELHYG1DxT1SpGmpOL7xfBn7QUoh8Rmpp3BZC
WCPIcVQHLs1LushsrpbWu+85tgzlVN4sFVBl8F9rohhbM1dMOUAksoQgM3avcZ2vkugKhX40vIuf
Gw4wXZe4TBCfQay+eDONYhYnmlxVV+dJyHheENOYfVqlau8RMNhRNmhXlGxXNQyU3kpMaTxOux8F
DyOjc5YPoe6PYQ0C/mC77ipnjJAjwm+Gw+heK/9NQ7fIonDObbfu2rOmudtcKG74IDwkZL8HjA==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
−
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
−
<saml:Assertion ID="_e700bf9b25a5aebdb9495fe40332ef081290476801092"
IssueInstant="2010-11-23T01:46:41.092Z" Version="2.0">
<saml:Issuer
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">identityorg.blitz03.blitz.salesforce.com</saml:Issuer>
−
<saml:Subject>
<saml:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">[email protected]</saml:NameID>
−
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2010-11-23T01:51:41.093Z"
Recipient="https://login-blitz03.soma.salesforce.com/?saml=MgoTx78aEPa2r1BHKCHmlfUKhH2mkDrXOjmYcjHG_qNDbsRM_6ZAo.wvGk"/>
</saml:SubjectConfirmation>
</saml:Subject>
−
<saml:Conditions NotBefore="2010-11-23T01:46:41.093Z" NotOnOrAfter="2010-11-23T01:51:41.093Z">
−
<saml:AudienceRestriction>
<saml:Audience>https://childorgb.blitz03.blitz.salesforce.com</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
−
<saml:AuthnStatement AuthnInstant="2010-11-23T01:46:41.092Z">
−
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
−
<saml:AttributeStatement>
−
<saml:Attribute Name="userId"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">005D0000001Ayzh</saml:AttributeValue>
</saml:Attribute>
−
<saml:Attribute Name="username"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">[email protected]</saml:AttributeValue>
438
Security About Identity Providers and Service Providers
</saml:Attribute>
−
<saml:Attribute Name="email"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">[email protected]</saml:AttributeValue>
</saml:Attribute>
−
<saml:Attribute Name="is_portal_user"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xsi:type="xs:anyType">false</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>
See Also:
Enabling Salesforce as an Identity Provider
Viewing Your Identity Provider Details
Prerequisites for Defining Service Providers
Mapping Salesforce Users to App Users
Viewing Your Service Provider Details
Enabling Identity Providers and Defining Service Providers for Portals and Sites
Examples Using Identity Providers and Service Providers
Enabling Salesforce as an Identity Provider
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
To enable Salesforce as an identity provider:
1.
2. Click
Your Name
> Setup > Security Controls > Identity Provider and click Enable Identity Provider.
3. If you haven't created a self-signed certificate, one is automatically generated for you and assigned as the certificate for your identity provider. If you've already created self-signed certificates, select the certificate to use when securely communicating with other services. You can only use self-signed certificates for your identity provider. You can't use
CA-signed certificates. If you'd like to create one, select Create a new certificate.... After you create the certificate, click
Your Name > Setup > Security Controls > Identity Provider, click Enable Identity Provider, and select the certificate you just created.
4. Click Save.
439
Security About Identity Providers and Service Providers
After you enable Salesforce as an identity provider, you can
.
See Also:
About Identity Providers and Service Providers
Viewing Your Identity Provider Details
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
After you enable an identity provider for your organization, you can view the details by clicking Your Name > Setup > Security
Controls > Identity Provider. You might need to share this information, such as
Issuer
, with your service provider.
From this page you can click:
• Edit to change the certificate associated with your identity provider.
Warning: Changing the certificate can disable access to external applications. You might need to update all external applications to validate the new certificate information.
• Disable to disable your identity provider.
Warning: If you disable your identity provider, users can no longer access any external applications.
• Download Certificate to download the certificate associated with your identity provider. Your service provider can use this information for connecting to Salesforce.
• Download Metadata to download the metadata associated with your identity provider. Your service provider can use this information for connecting to Salesforce.
• In the service providers section, click New to define a new service provider. Next to the name of an already-defined service provider, click Edit to change its definition, click Profiles to add or remove user profiles that have access to this service provider, or click Del to delete it.
See Also:
About Identity Providers and Service Providers
440
Security About Identity Providers and Service Providers
Prerequisites for Defining Service Providers
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
Before defining a service provider:
1.
Enable Salesforce as an identity provider
.
2. Give your service provider information about your configuration of Salesforce as an identity provider. This information is available as metadata that you can download and give to your service provider for easy configuration. However, not all service providers support metadata. If your service provider supports certificates instead, you might be required to download the certificate. Click Your Name > Setup > Security Controls > Identity Provider, then click Download Certificate or
Download Metadata.
3. Get the following information from your service provider:
• Assertion consumer service (ACS) URL
• Entity ID
• Subject type—specifies if the subject for the SAML response from Salesforce (as an identity provider) is a Salesforce user name or a federation ID
• Security certificate—only required when the service provider is initiating login to Salesforce and signing their SAML requests
See Also:
About Identity Providers and Service Providers
Defining Service Providers
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
To define a service provider:
1. Complete the prerequisites .
2. Click
Your Name
> Setup > Security Controls > Identity Provider, then click New in the Service Providers section.
441
Security About Identity Providers and Service Providers
3. Specify a name for the service provider's application. This name is used in the profile settings.
4. Enter the assertion consumer service (ACS) URL. This value comes from the service provider.
5. Enter the entity ID. This value comes from the service provider.
If you are accessing multiple apps from your service provider, you only need to define the service provider once, and then use the
RelayState
parameter to append the URL values to direct the user to the correct app after signing in.
Important: Each entity ID must be unique in your organization.
6. Select the subject type. This value comes from the service provider.
Note: If the subject type is
Federation ID
, you must also
map the Salesforce user to the app user
.
7. Click Service Provider Certificate if the service provider gave you a security certificate. Browse your system for the certificate. This is only necessary if you plan to initiate logging into Salesforce from the service provider and the service provider signs their SAML requests.
Important: If you upload a certificate, all SAML requests must be signed. If no certificate is uploaded, all SAML requests are accepted.
8. Click Save.
9. Select which profiles have access to this service provider.
Note: Permission sets can also be used to grant access to service providers.
If you click the checkbox at the top of the list, all profiles are selected.
10. Click Save.
See Also:
About Identity Providers and Service Providers
Mapping Salesforce Users to App Users
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
If the
Subject Type
for the service provider definition is
Federation ID
, you must map the Salesforce user to the username used to sign into the service provider.
442
Security About Identity Providers and Service Providers
To map a Salesforce user to the app user:
1. Click Your Name > Setup > Manage Users > Users, then click Edit for every user who needs to be mapped.
2. In Federation ID , under Single Sign On Information, enter the username to be used to log into the service provider.
3. Click Save.
Tip: Use SOAP API if you have a large number of user profiles or permission sets to update. See the SOAP API
Developer's Guide .
See Also:
About Identity Providers and Service Providers
Viewing Your Service Provider Details
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
After you define a service provider for your organization, you can view the details by clicking
Your Name
> Setup > Security
Controls > Identity Provider, then the name of the service provider. You might need to share this information, such as
SP-Initiated POST Endpoint
or
SP-Initiated Redirect Endpoint
, with your service providers.
From this page you can click:
• Edit to change the values of the service provider definition.
• Delete to delete a service provider definition.
Warning: If you delete a service provider definition, your users will no longer have access to that service provider.
• Profile Access to change which profiles have access to this service provider.
See Also:
About Identity Providers and Service Providers
443
Security About Identity Providers and Service Providers
Enabling Identity Providers and Defining Service Providers for Portals and Sites
Available in: Developer, Enterprise, and Unlimited Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
When enabling identity providers and defining service providers for Force.com Sites, Customer Portals and partner portals, note the following:
•
When defining a service provider
, if the
Subject Type
is
Username
, the Salesforce organization ID is prepended to the user name in the SAML assertion. For example, if the user is [email protected]
, the subject for the SAML assertion contains
00DE0000000FFLT@[email protected]
. If the
Subject Type
is
Federation ID
, the exact federation ID is used.
• The attribute is_portal_user
included in the SAML assertion generated by Salesforce contains values. You might want to share the following example with your service provider.
<saml:Attribute Name="is_portal_user"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">true
</saml:AttributeValue>
</saml:Attribute>
See Also:
About Identity Providers and Service Providers
Using the Identity Provider Event Log
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
The identity provider event log records both problems and successes with inbound SAML authentication requests from another app provider, and outbound SAML responses when Salesforce is acting as an identity provider. To view the identity provider
444
Security About Identity Providers and Service Providers event log, click Your Name > Setup > Manage Users > Identity Provider Event Log. You can show successes, failures, or both in the log. The log records the 50 most recent events, but you can retrieve more by creating a report.
Examples Using Identity Providers and Service Providers
Available in: Developer, Enterprise, Unlimited, and Database.com Editions
Tabs are not available in Database.com
User Permissions Needed
Define and modify identity providers and service providers: “Customize Application”
This section contains two examples of setting up Salesforce as an identity provider, then setting up two different service providers:
•
—shows service-provider initiated login.
•
—shows identity-provider initiated login.
Setting up Single Sign-on to Google Apps Example
This example shows how to set up single sign-on from Salesforce to Google Apps. In this example, Google is the service provider, and Google Apps is the app provided by the service provider.
For this example to work:
• You must already have a Premier Edition Google Apps account
• Your Salesforce organization must be set up for single sign-on using SAML 2.0
The general steps are as follows, with more specifics on each step below.
1.
Generate a domain name and enable an identity provider
in your Salesforce organization.
2.
Define the service provider in Salesforce.
3.
Enable the Salesforce user and profile.
4.
5.
Generating a Domain Name and Enabling an Identity Provider
To prepare your Salesforce organization for this example, generate a domain name and enable Salesforce as an identity provider:
1. Log into Salesforce.
2. Generate a domain name for your organization:
a. Click Your Name > Setup > Company Profile > My Domain, enter a new subdomain name, and click Check
Availability.
b. If the name is available, click the Terms and Conditions check box, then click Register Domain.
445
Security About Identity Providers and Service Providers
Important: You must deploy your domain name before you can enable Salesforce as an identity provider.
3. Enable Salesforce as an identity provider:
a. Click Your Name > Setup > Security Controls > Identity Provider.
b. Click Enable.
c. Click Download Certificate. Remember where you save the certificate, as you will upload it later.
Defining a Service Provider
To define the service provider:
1. Log into Salesforce.
2. Click
Your Name
> Setup > Security Controls > Identity Provider.
3. Click New in the Service Provider section and enter the following information:
Field
Name
ACS URL
Entity ID
Subject Type
Value
Google Apps
The URL for your Google App account, such as https://www.google.com/a/respond.info
google.com
Federation ID
4. Click Save.
5. Select the profiles allowed to access this service provider. You must select the current user's profile for this example to work.
6. Click Save.
7. Copy down the value in the
SP-Initiated Redirect Endpoint
field. You will use this value later.
Mapping the Salesforce user to the Google Apps user
To map the Salesforce user to the Google Apps user:
1. Click
Your Name
> Setup > My Personal Information > Personal Information, then click Edit.
2. For Federation ID , enter the username you use to sign into Google Apps, for example, [email protected].
3. Click Save.
Setting up Google Apps
To set up your Google Apps account:
1. Log into your Google Apps account.
2. Click the Advanced tools tab, then the Set up single sign-on (SSO) link.
3. Check the Enable Single Sign-on checkbox.
4. For
Sign-in page URL
, enter the URL copied from the
SP-Initiated Redirect Endpoint
field, from
.
446
Security About Identity Providers and Service Providers
5. For
Sign-out page URL
, specify the URL where you want your users to go after they log out of Google Apps, such as, http://www.mydomain.salesforce.com
.
6. For
Change password URL
, use the following URL: https://mydomain.salesforce.com/_ui/system/security/ChangePassword
, where mydomain
is the name you specified for your custom domain when you generated your domain.
7. For
Verification certificate
, upload the certificate you downloaded from enabling an identity provider .
8. Click Save Changes.
Testing your Implementation
To verify that your Salesforce organization can use single sign-on to Google Apps:
1. Log out of Google Apps and Salesforce.
2. Try to access a Google app page, such as http://docs.google.com/a/respond.info/
or http://mail.google.com/a/respond.info/
.
3. You are redirected to a Salesforce sign-on page. After you login, you are at the specified Google app page.
An alternate test is to add the Google App to a web tab in your Salesforce organization.
1. Log into Salesforce.
2. Click
Your Name
> Setup > Create > Tabs, then click New in the
Web Tabs
section.
3. Choose a tab layout and click Next.
4. Enter a label to display on the tab.
5. Use the default name. This is the same as the label.
6. Click the
Tab Style
lookup icon to display the Tab Style Selector. Select an icon. Keep all other defaults.
7. Click Next.
8. In the Button or Link URL text box, enter a Google App page, such as docs.google.com/a/respond.info/
or mail.google.com/a/respond.info/ , then click Next.
Note: This has to be an absolute URL, that is, it must contain either http://
or https://
.
9. Click Next and Save.
10. Click on the new tab at the top of your page. You are automatically logged into the specified Google app page.
Setting up Single Sign-on From Salesforce to Salesforce
This example shows how to set up a Salesforce app to initiate single sign-on from one Salesforce organization to another.
The initiating Salesforce organization, that is, the organization that you want to initially log into, acts as the identity provider.
The Salesforce organization that you want to access using an app acts as the service provider.For example, suppose you have two Salesforce organizations: a sales organization and an ideas organization. You can set up single sign-on between the two organizations so your users only have to log into and remember the password for one.
For this example to work, your initiating Salesforce organization must be set up for single sign-on using SAML 2.0. The general steps are as follows, with more specifics on each step below.
1.
2.
Set up the Salesforce organization that is acting as a service provider.
3.
Define the service provider app
in the Salesforce organization that is acting as an identity provider.
4.
447
Security About Identity Providers and Service Providers
Generating a Domain Name and Enabling an Identity Provider
All of the work in the following steps is done on the Salesforce organization that is acting as the identity provider.
To prepare your Salesforce organization for this example, generate a domain name and enable Salesforce as an identity provider:
1. Log into Salesforce.
2. Generate a domain name for your organization:
a. Click
Your Name
> Setup > Company Profile > My Domain, enter a new subdomain name, and click Check
Availability.
b. If the name is available, click the Terms and Conditions check box, then click Register Domain.
Important: You must deploy your domain name before you can enable Salesforce as an identity provider.
3. Enable Salesforce as an identity provider:
a. Click
Your Name
> Setup > Security Controls > Identity Provider.
b. Click Enable.
c. Click Download Certificate. Remember where you save the certificate, as you will upload it later.
Setting up a Salesforce organization as Service Provider
To configure a second Salesforce organization as the service provider:
1. Log into the Salesforce organization that acts as the service provider.
2. Enable and configure SAML:
a. Click
Your Name
> Setup > Security Controls > Single Sign-On Settings, then click Edit.
b. Select the
SAML Enabled
check box.
c. Use the following settings:
Field
SAML Version
Issuer
Identity Provider Certificate
SAML User ID Type
SAML User ID Location
Value
2.0
The identity provider issuer URL, created when the identity provider is set up. For example, https://mycustomdomain.salesforce.com
.
Browse for the certificate you downloaded in
enabling an identity provider.
Select Assertion contains the Federation ID from the User object
Select
User ID is in the NameIdentifier element of the Subject statement
d. Click Save.
e. Copy and save the values from the fields
Salesforce Login URL
and
Entity ID
. You need these values later, when defining the Salesforce service provider.
3. Link your user in the service provider organization to the user in the identity provider organization:
448
Security About Identity Providers and Service Providers
a. Click
Your Name
> Setup > My Personal Information > Personal Information, and click Edit.
b. For
Federation ID
, enter the username used to sign into theSalesforce identity provider organization, for example,
c. Click Save.
Defining the Service Provider in the Identity Provider Organization
To define the service provider:
1. Log into the Salesforce organization that acts as the identity provider.
2. Click Your Name > Setup > Security Controls > Identity Provider, then in the Service Provider section, click New.
3. Specify the following information:
Field
Name
ACS URL
Entity Id
Subject Type
Value
Salesforce Service Provider
Use the Salesforce Login URL from setting up the service provider
Use the Entity ID from setting up the service provider
Select Username
4. Click Save.
5. Select the profiles allowed to access this service provider. You must select the current user's profile for this example to work.
6. Click Save.
7. Copy down the value of the
IdP-Initiated Login URL
field. You will use this value later, in testing.
Testing your Implementation
To verify that your Salesforce organizations can use single sign-on to connect, create a web tab:
1. Log into the Salesforce organization that is acting like a service provider.
2. Click Your Name > Setup > Create > Tabs, then click New in the Web Tabs section.
3. Choose a tab layout and click Next.
4. Enter a label to display on the tab.
5. Use the default name. This is the same as the label.
6. Click the
Tab Style
lookup icon to display the Tab Style Selector. Select an icon.
7. Click Next.
8. In the Button or Link URL text box, enter the value of the
IdP-Initiated Login URL
field from
, then click Next.
Note: This has to be an absolute URL, that is, it must contain either http:// or https:// .
9. Click Next, then Save.
449
Connection Security Configuring Remote Settings
10. Click on the new tab at the top of your page. If you have logged out of the Salesforce organization that acts as the identity provider, you are prompted to log in. Once you are logged in, you should see the Salesforce organization that acts as the identity provider in the tab.
See Also:
About Identity Providers and Service Providers
Configuring Remote Settings
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
Visualforce and S-controls are not available in Database.com
To configure remote settings:
User Permissions Needed
“Modify All Data”
Before any Visualforce page, Apex callout, or JavaScript code using XmlHttpRequest in an s-control or custom button can call an external site, that site must be registered in the Remote Site Settings page, or the call will fail.
To access the page, click
Your Name
> Setup > Security Controls > Remote Site Settings. This page displays a list of any remote sites already registered and provides additional information about each site, including remote site name and URL.
For security reasons, Salesforce restricts the outbound ports you may specify to one of the following:
• 80: This port only accepts HTTP connections.
• 443: This port only accepts HTTPS connections.
• 1024–66535 (inclusive): These ports accept HTTP or HTTPS connections.
To register a new site:
1. Click New Remote Site.
2. Enter a descriptive term for the Remote Site Name .
3. Enter the URL for the remote site.
4. To allow access to the remote site regardless of whether the user’s connection is over HTTP or HTTPS, select the
Disable
Protocol Security checkbox. When selected, Salesforce can pass data from an HTTPS session to an HTTP session, and vice versa. Only select this checkbox if you understand the security implications.
5. Optionally, enter a description of the site.
6. Click Save to finish, or click Save & New to save your work and begin registering an additional site.
450
Monitor Your Organization About the System Overview Page
M
ONITOR
Y
OUR
O
RGANIZATION
About the System Overview Page
Available in: All Editions except Personal Edition
To access the system overview page:
User Permissions Needed
“Customize Application”
Note: The system overview page shows only the items enabled for your organization. For example, your system overview page shows workflow rules only if workflow is enabled for your organization.
The system overview page shows usage data and limits for your organization, and displays messages when you reach 95% of your limit (75% of portal roles). Click the numbers under each metric to get more details about your usage. If it’s available, use Checkout to increase usage limits for your organization. For example, if your organization reaches the limit for custom objects, the system overview page notifies you with a message link. Click the link to clean up any unused objects, or visit
Checkout to increase your limit for objects.
To access the system overview page, click
Your Name
> Setup > System Overview.
The system overview page displays usage for:
•
•
•
•
•
•
Note: The object limit percentages displayed for items used are truncated, not rounded. For example, if your organization uses 95.55% of the limit for a particular item, the percentage displayed is 95%.
System Overview: Schema
Available in: All Editions except Personal Edition
The Schema box in the system overview page shows usage information for:
451
Monitor Your Organization About the System Overview Page
• Custom objects
Note: If you’re approaching your limit for custom objects and need to delete some, you need to hard delete or erase them. Soft-deleted custom objects and their data count against your limits.
• Data storage
System Overview: API Usage
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The API Usage box in the system overview page shows usage information for API requests in the last 24 hours.
Limits are enforced against the aggregate of all API calls made by the organization in a 24 hour period; limits are not on a per-user basis. When an organization exceeds a limit, all users in the organization may be temporarily blocked from making additional calls. Calls will be blocked until usage for the preceding 24 hours drops below the limit.
System Overview: Business Logic
Available in: Enterprise, Unlimited, Developer, and Database.com Editions
The Business Logic box in the system overview page shows usage information for:
• Rules
• Apex triggers
• Apex classes
• Code used: Total number of characters in your Apex triggers and Apex classes (excluding comments, test methods, and
@isTest annotated classes).
System Overview: User Interface
Available in: All Editions except Personal Database.com
The User Interface box in the system overview page shows usage information for:
• Custom apps
• Site.com sites: We only count published Site.com sites.
• Active Force.com sites
452
Monitor Your Organization
• Flows: We only count active flows.
• Custom tabs
• Visualforce pages
Monitoring Resources
System Overview: Most Used Licenses
Available in: All Editions except Personal Edition
The Most Used Licenses box in the system overview page counts only active licenses, and by default shows the top three used licenses for your organization. Any license that reaches 95% usage also appears. Click Show All to view all the licenses for your organization.
System Overview: Portal Roles
Available in: Enterprise, Unlimited, and Developer Editions
The Portal Roles box in the system overview page shows the usage data and limit for total partner portal and Customer Portal roles. The system overview page displays a message when your organization reaches 75% of its allotted portal roles.
Monitoring Resources
Available in: All Editions
To view storage usage:
User Permissions Needed
“Manage Users”
Storage is divided into two categories: data storage and file storage. File storage includes files in attachments, the Documents tab, the Files tab, the File field, Salesforce CRM Content, Chatter (including user photos), and Site.com assets. Data storage includes the following:
• Accounts
• Article types (format: “[
Article Type Name
]”)
• Article type translations (format: “[
Article Type Name
] Version”)
• Campaigns
• Campaign Members
• Cases
• Case Teams
453
Monitor Your Organization Monitoring Resources
• Contacts
• Contracts
• Custom objects
• Email messages
• Events
• Forecast items
• Google docs
• Ideas
• Leads
• Notes
• Opportunities
• Quotes
• Quote Template Rich Text Data
• Solutions
• Tags: Tag applications
• Tags: Unique tags
• Tasks
Data storage and file storage are calculated asynchronously, so if you import or add a large number of records or files, your organization’s storage usage will not be updated immediately.
Storage Capacity
Each edition includes a minimum amount of data storage and file storage. Professional, Enterprise, and Unlimited Editions receive a per-user storage amount multiplied by the number of users in the organization if the result is greater than the minimum storage amount. Using data storage as an example, an Enterprise Edition organization with 600 users would receive 12,000
MB (12 GB) of data storage, because 20 MB per user multiplied by 600 users is 12,000 MB. A smaller organization, for example a Professional Edition organization with 20 users, would receive 1 GB of data storage because 20 MB per user multiplied by 20 users is only 400 MB, which is less than the 1 GB minimum allotted to all Professional Edition organizations.
The values in the Storage Allocation Per User License column below apply to Salesforce and Salesforce Platform user licenses.
CRM Content User license provides an additional 512 MB of file storage, whether Salesforce CRM Content is enabled or not, bringing the total file storage allocation per user to 612 MB. To find out whether your organization has Salesforce CRM Content enabled, contact your administrator.
Salesforce Edition
Personal
Contact Manager
Group
Professional
Data Storage Minimum per
Organization
File Storage Minimum per
Organization
20 MB (approximately 10,000 records)
20 MB
1 GB 11 GB
Storage Allocation Per User
License
N/A
1 GB
1 GB
11 GB
11 GB
20 MB of data storage and
612 MB of file storage
20 MB of data storage and
612 MB of file storage
20 MB of data storage and
612 MB of file storage
454
Monitor Your Organization Monitoring Resources
Salesforce Edition
Enterprise
Unlimited
Developer
Data Storage Minimum per
Organization
1 GB, plus 5 MB for each
Gold Partner license
1 GB, plus 5 MB for each
Gold Partner license
5 MB
File Storage Minimum per
Organization
11 GB
11 GB
20 MB
Storage Allocation Per User
License
20 MB of data storage and
612 MB of file storage
120 MB of data storage and
612 MB of file storage
N/A
If your organization uses custom user licenses, contact salesforce.com to determine if these licenses provide additional storage.
For a description of user licenses, see User License Types on page 106.
Viewing Storage Usage
To view your organization’s current storage usage click
Your Name
> Setup > Data Management > Storage Usage. You can view the available space for data storage and file storage, the amount of storage in use per record type, the top users according to storage utilization, and the largest files in order of size. To view what types of data a particular user is storing, click that user’s name.
In all Editions except Personal Edition, administrators can view storage usage on a user-by-user basis:
1. Click Your Name > Setup > Manage Users > Users.
2. Click the name of any user.
3. Click View next to the
Used Data Space
or
Used File Space
fields to view that user’s storage usage by record type.
Individual users can view their own storage usage in their personal information.
Increasing Storage
When your organization has reached its storage limit, you will not be able to create any new data or upload new files. To reduce your storage usage, try to delete any outdated leads or contacts and remove any unnecessary attachments. In Salesforce
CRM Content, delete files to reduce your storage limit.
To increase your storage limit, you can purchase additional storage space, or in Professional, Enterprise, and Unlimited
Editions, you can also add user licenses.
Storage Considerations
Take the following into consideration when planning your storage needs:
• Person accounts count against both account and contact storage because the API considers each person account to consist of one account as well as one contact.
• Archived activities count against storage.
• Nothing that is deleted counts against storage.
• Active or archived products, price books, price book entries, and assets do not count against storage.
455
Monitor Your Organization Monitoring Login History
Monitoring Login History
Available in: All Editions
To monitor logins:
User Permissions Needed
“Manage Users”
On this page, Administrators can monitor the successful and failed login attempts for their organization and enabled portals.
The columns on this page provide information about each login attempt. The login history page displays the most recent
20,000 entries in the login history database. If you need to see more records, you can download the information to a CSV or
GZIP file.
Contact Manager, Group, Professional, Enterprise, Unlimited, and Developer Editions
To download the information into a CSV or GZIP file:
1. Click
Your Name
> Setup > Manage Users > Login History.
2. Click one of the following radio buttons:
• Excel csv file: This downloads a CSV file of all user logins to your Salesforce organization for the past six months.
This report includes logins through the API.
• gzipped Excel csv file: This downloads a CSV file of all user logins to your Salesforce organization for the past six months. This report includes logins through the API. The file is compressed and this is the preferred option for quickest download time.
3. Select the file contents. You can choose All Logins, IE6 Logins Only, or Web Site Logins Only.
4. Click Download Now.
Note: Older versions of Microsoft Excel cannot open files with more than 65,536 rows. If you cannot open a large file in Excel, see the Microsoft Help and Support article about handling large files .
You can create new list views sorted by Login Time and Login URL. For example, you could create a view of all logins between a particular time range. Like the default view, a custom view filters the most recent 20,000 rows in the login history database.
To create a new view, click Create New View from the page. Fill in the following:
1. Enter View Name
Enter the name to appear in the View drop-down list.
2. Specify Filter Criteria.
You can filter by Login Time and Login URL.
3. Select Fields to Display
The default fields are automatically selected. You can choose up to 15 different fields to display in your view. You can display only the fields that are available in your page layout. When you select a long text area field, up to 255 characters are displayed in the list view.
To see the last ten successful and failed logins for a specific user, navigate to
Your Name
> Setup > Manage Users > Users, click on the
Full Name
for the user, and scroll to the Login History section.
456
Monitor Your Organization Monitoring Training History
Personal Edition
To view your personal login history:
1. Click Your Name > Setup > My Personal Information > Personal Information.
2. Scroll down to the Login History related list to view your last ten logins.
3. To download a CSV file of your login history for the past six months, click the Download... link.
Note: For security purposes, Salesforce may require users to pass a CAPTCHA user verification test to export data from their organization. This simple text-entry test prevents malicious programs from accessing your organization's data. To pass the test, users must correctly type the two words displayed on the overlay into the overlay's text box field. Note that the words entered into the text box field must be separated by a space.
Single Sign-On with SAML
If your organization has set up single sign-on using identity provider certificates (written in SAML), you may see login history messages specific to single sign-on.
My Domain
If you are using My Domain, you can identify which users are logging in with the new login URL, and when. Click Your
Name > Setup > Manage Users > Login History and look at the Username and Login URL columns.
Monitoring Training History
Available in: Group, Professional, Enterprise, Unlimited, and Database.com Editions
To view training history:
User Permissions Needed
“Manage Users”
As an administrator, it is important to know that your team is learning how to use Salesforce effectively. The Training Class
History shows you all of the Salesforce training classes your users have taken.
Administrators can view the Training Class History by choosing Your Name > Setup > Manage Users > Training History.
After taking a live training class, users must submit the online training feedback form to have their training attendance recorded in the training history.
Note: If you don’t see this link under Manage Users, your organization has been migrated to a new system. You need to be a Help & Training Admin to access the training reports via My Cases in Help & Training. Contact salesforce.com if you do not have this access.
457
Monitor Your Organization Monitoring Setup Changes
Monitoring Setup Changes
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
In Database.com, the setup audit trail history only audits setup changes for features that are included in Database.com.
To view audit trail history:
User Permissions Needed
“View Setup and Configuration”
The setup audit trail history helps you track the recent setup changes that you and other administrators have made to your organization. This can be especially useful in organizations with multiple administrators.
To view the setup audit trail history, click Your Name > Setup > Security Controls > View Setup Audit Trail. To download your organization’s full setup history for the past 180 days, click the Download link.
The setup audit trail history shows you the 20 most recent setup changes made to your organization. It lists the date of the change, who made it, and what the change was. Additionally, if a delegate (such as an administrator or customer support representative) makes a setup change on behalf of an end-user, the Delegate User column shows the delegate’s username. For example, if a user grants login access to an administrator and the administrator makes a setup change, the administrator’s username is listed.
The setup audit trail history tracks the following types of changes:
Setup
Administration
Changes Tracked
• Company information, default settings such as language or locale, and company message changes
• Multiple currency setup changes
• User, portal user, role, permission set, and profile changes
• Email address changes for any user
• Deleting email attachments sent as links
• Creating, editing, or deleting email footers
• Record type changes, including creating or renaming record types and assigning record types to profiles
• Changes to divisions, including creating and editing divisions, transferring divisions, and changing users’ default division
• Adding or deleting certificates
• Domain name changes
• Enabling or disabling Salesforce as an identity provider
Customization • Changes to user interface settings, such as collapsible sections, Quick Create, hover details, or the related list hover links
• Page layout and search layout changes
• Changes made using inline editing
• Custom field and field-level security changes, including changes to formulas, picklist values, and custom field attributes like the format of auto-number fields or masking of encrypted fields
458
Monitor Your Organization Monitoring Setup Changes
Setup Changes Tracked
• Changes to lead settings, lead assignment rules, and lead queues
• Changes to activity settings
• Changes to support settings, business hours, case assignment and escalation rules, and case queues
• Any changes made by salesforce.com Customer Support at your request
• Changes to tab names, including tabs that you reset to the original tab name
• Changes to custom apps (including Service Cloud console apps), custom objects, and custom tabs
• Changes to contract settings
• Changes to forecast settings
• Enabling or disabling Email-to-Case or On-Demand Email-to-Case
• Changes to custom buttons, links, and s-controls, including standard button overrides
• Enabling or disabling drag-and-drop scheduling
• Enabling, disabling, or customizing similar opportunities
• Enabling or disabling quotes
• Changes to data category groups, data categories, and category-group assignments to objects
• Changes to article types
• Changes to category groups and categories
• Changes to Salesforce Knowledge settings
• Changes to ideas settings
• Changes to answers settings
• Changes to field tracking in feeds
• Changes to campaign influence settings
• Activating or deactivating critical updates
• Enabling or disabling Chatter email notifications
• Enabling or disabling Chatter new user creation settings for invitations and email domains
Security and
Sharing
• Public groups, sharing rule changes, and organization-wide sharing, including the Grant Access
Using Hierarchies option
• Password policy changes
• Session settings changes, such as changing the session timeout setting
• Changes to delegated administration groups and the items delegated administrators can manage.
Setup changes made by delegated administrators are tracked as well.
• How many records a user emptied from their Recycle Bin and from the organization’s Recycle Bin
• Changes to SAML (Security Assertion Markup Language) configuration settings
• Changes to Salesforce certificates
• Enabling or disabling identity providers
• Changes to service providers
Data Management • Mass delete use, including when a mass delete exceeds the user’s Recycle Bin limit of 5000 deleted records. The oldest, excess records will be permanently removed from the Recycle Bin within two hours of the mass delete transaction time.
• Data export requests
• Use of the campaign member import wizard
459
Monitor Your Organization Monitoring Setup Changes
Setup
Development
Various Setup
Using the application
Changes Tracked
• Mass transfer use
• Changes to analytic snapshots, including defining, deleting, or changing the source report or target object on an analytic snapshot
• Import wizard use
• Changes to Apex classes and triggers
• Changes to Visualforce pages, custom components, or static resources
• Changes to custom settings
• Changes to remote access definitions
• Changes to Force.com Sites settings
• Creation of an API usage metering notification
• Changes to territories
• Changes to Workflow & Approvals settings
• Changes to approval processes
• Creation and deletion of workflow actions
• Changes to Visual Workflow files
• Packages from Force.com AppExchange that you installed or uninstalled
• Changes to account team and opportunity team selling settings
• Activation of Google Apps services
• Changes to mobile configuration settings, including data sets, mobile views, and excluded fields
• A user with the “Manage Partners” permission logging into the partner portal as a partner user
• A user with the “Edit Self-Service Users” permission logging into the Salesforce Customer Portal as a Customer Portal user
• Enabling or disabling a partner portal account
• Disabling a Salesforce Customer Portal account
• Enabling or disabling a Salesforce Customer Portal and creating multiple Customer Portals
• Creating and changing entitlement processes and entitlement templates
• Enabling or disabling self-registration for a Salesforce Customer Portal
• Enabling or disabling Customer Portal or partner portal users
460
Monitor Your Organization Tracking Field History
Tracking Field History
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Standard Objects are not available in Database.com
You can select certain fields to track, and display the field history in the History related list of an object. You can track the field history of custom objects, as well as the history of the following standard objects:
• Accounts
• Cases
• Contacts
• Entitlements
• Service contracts
• Contract line items
• Contracts
• Leads
• Opportunities
• Solutions
Modifying any of these fields adds a new entry to the History related list. All entries include the date, time, nature of the change, and who made the change. Note that not all field types are available for history tracking. Certain changes, such as case escalations, are always tracked.
Note:
Salesforce automatically deletes old field history data for certain organizations.
If your organization was created after 12:00 A.M. on June 2, 2011, you will always have 18 months worth of field history data available. If your organization was created before this, automatic field history deletion does not apply.
If your organization was created on or after June 2, 2011, and you would like to request retaining field history data for more than 18 months, simply contact salesforce.com support to log a case, and Salesforce.com will adjust the period of your field history retention.
Considerations
• Changes to fields with more than 255 characters are tracked as edited, and their old and new values are not recorded.
• Tracked field values are not automatically translated; they display in the language in which they were made. For example, if a field is changed from Green to Verde , Verde is displayed no matter what a user’s language is, unless the field value has been translated into other languages via the Translation Workbench. This also applies to record types and picklist values.
• Changes to custom field labels that have been translated via the Translation Workbench are shown in the locale of the user viewing the History related list. For example, if a custom field label is Red and translated into Spanish as Rojo , then a user with a Spanish locale will see the custom field label as
Rojo
. Otherwise, the user will see the custom field label as
Red
.
461
Monitor Your Organization Tracking Field History
• Changes to date fields, number fields, and standard fields are shown in the locale of the user viewing the History related list. For example, a date change to August, 8, 2005 shows as 8/5/2005 for a user with the English (United States) locale, and as 5/8/2005 for a user with the English (United Kingdom) locale.
See Also:
Tracking Field History for Standard Objects
Tracking Field History for Custom Objects
Methods for Archiving Field History
Disabling Field History Tracking
Tracking Field History for Standard Objects
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Standard Objects are not available in Database.com
To set up which fields are tracked:
User Permissions Needed
“Customize Application”
If you use both business accounts and person accounts, review the following before enabling account field history tracking:
• Field history tracking for accounts affects both business accounts and person accounts.
• Enabling field history tracking on person accounts does not enable field history tracking on personal contacts.
To set up field history tracking:
1. Click
Your Name
> Setup > Customize.
2. Select the object you want to configure.
3. Click Fields > Set History Tracking.
Note: When you enable tracking for an object, be sure to customize your page layouts to include the object’s history related list.
4. For accounts, contacts, leads, and opportunities, select the Enable Account History , Enable Contact History ,
Enable Lead History
, or
Enable Opportunity History
checkbox.
5. Choose the fields you want tracked.
You can select a combination of up to 20 standard and custom fields per object. This limit includes fields on business accounts and person accounts.
Certain changes, such as case escalations, are always tracked.
You can’t track the following fields:
• Formula, roll-up summary, or auto-number fields
•
Created By
and
Last Modified By
•
Expected Revenue
field on opportunities
462
Monitor Your Organization Tracking Field History
•
Master Solution Title
or the
Master Solution Details
fields on solutions; these fields display only for translated solutions in organizations with multilingual solutions enabled.
6. Click Save.
Salesforce tracks history from this date and time forward. Changes made prior to this date and time are not included.
See Also:
Tracking Field History for Custom Objects
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Standard Objects are not available in Database.com
To set up which fields are tracked:
User Permissions Needed
“Customize Application”
To track field history for custom objects:
1. Click
Your Name
> Setup > Create > Objects.
2. Click Edit next to the name of the custom object.
3. Select the Track Field History checkbox.
Note: When you enable tracking for an object, be sure to customize your page layouts to include the object’s history related list.
4. Click Save.
5. Click
Set History Tracking
in the Custom Fields & Relationships section.
This section allows you to set a custom object’s history for both standard and custom fields.
6. Choose the fields you want tracked.
You can select up to 20 standard and custom fields per object.
You can’t track:
• Formula, roll-up summary, or auto-number fields
• Created By and Last Modified By
7. Click Save.
463
Monitor Your Organization Tracking Field History
Salesforce tracks history from this date and time forward. Changes made prior to this date and time are not included.
See Also:
Methods for Archiving Field History
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Standard Objects are not available in Database.com
Salesforce stores field history for 18 months. To archive field history, you can use one of the following options:
•
of
FieldHistory
data.
• Export an object-specific field history report to a CSV file.
• Run a query using the SOAP API and save your results.
See Also:
Disabling Field History Tracking
Available in: Contact Manager, Group, Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Standard Objects are not available in Database.com
To set up which fields are tracked:
User Permissions Needed
“Customize Application”
Note: You cannot disable field history tracking for an object if a field on the object is referenced in Apex.
1. Select the object whose field history tracking you want to disable.
a. For standard objects, click
Your Name
> Setup > Customize.
b. For custom objects, click Your Name > Setup > Create > Objects.
2. Deselect the
Track Field History
checkbox.
If you deselect the checkbox, the History related list is automatically removed from the associated object’s page layouts.
464
Monitor Your Organization Monitoring Debug Logs
If you disable field history tracking on a standard object, you can still report on its history data up to the date and time that you disabled tracking. If you disable field history tracking on a custom object, then you cannot report on its field history.
See Also:
Monitoring Debug Logs
Available in Enterprise, Developer, Unlimited, and Database.com Editions
The Salesforce user interface and Email Services are not available in Database.com.
To view, retain, and delete debug logs:
User Permissions Needed
“Manage Users”
You can retain and manage the debug logs for specific users.
To view saved debug logs, click Your Name > Setup > Monitoring > Debug Logs.
From this page, click New to specify a user that you want to retain debug logs for.
After you have specified a user or users to retain debug logs for, you can:
• Click Delete to stop retaining debug logs for a specific user.
• Click Reset to reset the number of debug logs for a particular user.
• Click Filters to specify what gets logged for that user, as well as the amount of information.
After you have started retaining debug logs, you can:
• Click View to view a specific log's details.
• Click Download to download the debug log as an XML file.
See Also:
465
Monitor Your Organization Monitoring Debug Logs
Retaining Debug Logs
Available in: Unlimited, Developer, Enterprise, and Database.com Editions
To view, retain, and delete debug logs:
User Permissions Needed
“Manage Users”
You can retain and manage the debug logs for specific users.
The following are the limits for debug logs:
• Once a user is added, that user can record up to 20 debug logs. After a user reaches this limit, debug logs stop being recorded for that user. Click Reset on the Monitoring Debug logs page to reset the number of logs for that user back to 20. Any existing logs are not overwritten.
• Each debug log can only be 2 MB. Debug logs that are larger than 2 MB in size are truncated.
• Each organization can retain up to 50 MB of debug logs. Once your organization has reached 50 MB of debug logs, the oldest debug logs start being overwritten.
To specify that a user should have his or her debug logs retained:
1. Click Your Name > Setup > Monitoring > Debug Logs, then click New.
2. Click the checkbox next to the user or users for whom you want to retain debug logs. Only users with a checkbox next to their names don't currently have their debug logs retained.
3. Click Save.
See Also:
466
Monitor Your Organization Monitoring Scheduled Jobs
Viewing Debug Logs
Available in: Unlimited, Developer, Enterprise, and Database.com Editions
To use the Developer Console:
To use the execute anonymous text entry box:
To save changes to Apex classes and triggers:
User Permissions Needed
“View All Data”
“Author Apex”
“Author Apex”
To save changes to Visualforce pages and components: “Customize Application”
To view the details of a debug log, click
Your Name
> Setup > Monitoring > Debug Logs, and then click View next to the debug log you want to examine. Click Download to download the log as an XML file.
The debug log contains information about the transaction, such as if it was successful, the size of the log (in bytes), how long the transaction took in milliseconds, and so on. The log itself contains additional information about the transaction, depending on the filters set for the user.
See Also:
Monitoring Scheduled Jobs
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
Analytic Snapshots and Dashboards are not available in Database.com
To monitor scheduled jobs:
User Permissions Needed
“View Setup and Configuration”
The All Scheduled Jobs page lists all analytic snapshots, scheduled Apex jobs, and dashboards scheduled to refresh.
To view this page, click Your Name > Setup > Monitoring > Scheduled Jobs. Depending on your permissions, you can perform some or all of the following actions:
• Click Del to permanently delete all instances of a scheduled job.
• View the details of a scheduled job, such as:
◊ The name of the scheduled job
◊ The name of the user who submitted the scheduled job
467
Monitor Your Organization Monitoring Background Jobs
◊ The date and time at which the scheduled job was originally submitted
◊ The date and time at which the scheduled job started
◊ The next date and time at which the scheduled job will run
◊ The type of scheduled job
Monitoring Background Jobs
Available in: Professional, Enterprise, Unlimited, Developer, and Database.com Editions
To monitor background jobs:
User Permissions Needed
“View Setup and Configuration”
You can monitor background jobs if your organization has parallel sharing recalculation enabled. Parallel sharing recalculation helps larger organizations to speed up sharing recalculation of each object. Contact salesforce.com to determine if this feature is appropriate for your organization.
To view any background jobs in your organization, select
Your Name
> Setup > Monitoring > Background Jobs. The All
Background Jobs page shows the details of background jobs, including a percentage estimate of the recalculation progress.
Note: You can only monitor background jobs on this page. Contact salesforce.com to abort a background job.
468
Configure Salesforce Mobile Apps Let Users View Dashboards on the iPad
C
ONFIGURE
S
ALESFORCE
M
OBILE
A
PPS
M
OBILE
D
ASHBOARDS FOR I
P
AD
Let Users View Dashboards on the iPad
The Mobile Dashboards for iPad app is automatically enabled for your organization so your users can access the app without any configuration on your part.
Available in: Enterprise, Unlimited, and Developer editions
User Permissions Needed
To view Mobile Dashboards for iPad settings:
To modify Mobile Dashboards for iPad settings:
“View Setup and Configuration”
“Customize Application”
You can disable the app if you don’t want users accessing Salesforce data from mobile devices and you can easily re-enable it if you change your mind later.
To configure access to Mobile Dashboards for iPad:
1. Click
Your Name
> Setup > Mobile Administration > Mobile Dashboards > Settings.
2. Select or deselect Enable the Mobile Dashboards iPad app for all users .
3. Click Save.
Users can download and install the Mobile Dashboards for iPad app from the Apple App Store or AppExchange Mobile .
Aside from editions noted, the app is available to organizations enabled with REST API.
469
Salesforce Touch Setting Up Salesforce Touch
S
ALESFORCE
T
OUCH
Setting Up Salesforce Touch
Available in: Group, Professional, Enterprise, Unlimited, Contact Manager, and Developer Editions
User Permissions Needed
To view Salesforce Touch settings:
To modify Salesforce Touch settings:
“View Setup and Configuration”
“Customize Application”
“Modify All Data”
Salesforce Touch is a variation of Salesforce that’s designed for touchscreen mobile devices. There are two versions of Salesforce
Touch: a downloadable app that’s available from the Apple App Store or AppExchange Mobile, and a mobile browser app.
To enable and configure Salesforce Touch for your organization:
1. Click Your Name > Setup > Mobile Administration > Salesforce Touch > Settings.
2. In the
Downloadable App Settings
section, enable the Salesforce Touch downloadable app for all users in your organization by selecting the mobile devices that can access the app. (In the Spring ’13 release, Apple ® iPad ® is the only available option.) Disable access to this app by deselecting all of the devices in this section.
The downloadable app is enabled by default. If you disable this app, users can still install the app but they can’t use it to log in to their Salesforce accounts.
3. In the Mobile Browser App Settings section, enable the Salesforce Touch mobile browser app for all users in your organization by selecting the mobile devices that can access the app. (In the Spring ’13 release, iPad is the only available option.) Disable access to this app by deselecting all of the devices in this section.
The mobile browser app is disabled by default. If you enable this option, users who log in to Salesforce from the Safari ® on iPad web browser are automatically redirected to Salesforce Touch.
Note: If users prefer to access the full Salesforce site from Safari instead, they can turn off the mobile browser app redirection for themselves, either from the app or from the full site by deselecting the Touch User checkbox at Your Name > Setup > My Personal Information > Personal Information.
4. Select Enable Visualforce in Salesforce Touch to allow the use of Visualforce pages in Salesforce Touch.
In the Spring ’13 release, Visualforce tabs are the only supported component.
5. Click Save.
If you enable both the downloadable and mobile browser apps, users can access either version of Salesforce Touch interchangeably.
470
Salesforce Mobile Salesforce Mobile Overview for Administrators
S
ALESFORCE
M
OBILE
Salesforce Mobile Overview for Administrators
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
Salesforce Mobile helps your teams succeed by allowing users to access their latest Salesforce data, whenever and wherever they need it, directly from Android ™ , BlackBerry ® and iPhone ® devices. The Salesforce Mobile app exchanges data with
Salesforce over mobile or wireless networks, and stores a local copy of the user’s data in its own database on the mobile device.
Users can edit local copies of their Salesforce records when a data connection isn’t available, and transmit those changes to
Salesforce when a connection is available again. The app also promotes near real-time logging of critical information by prompting users to enter updates directly in Salesforce or Force.com AppExchange apps after important customer calls, emails, or appointments.
A Salesforce Mobile license is required for each user to use the full version of Salesforce Mobile. For organizations using
Unlimited and Developer Editions, salesforce.com provides one mobile license for each Salesforce license. Organizations using
Professional or Enterprise Editions must purchase mobile licenses separately.
Any Salesforce user who doesn't have a mobile license can download a free, restricted version of Salesforce Mobile. The free version:
• Supports fewer standard objects
• Doesn't support custom objects
• Doesn't allow administrators to customize or create mobile configurations
• Isn’t available for use by partner portal users
Note: The Android, BlackBerry, and iPhone apps are available in English, Japanese, French, German, and Spanish.
Contact salesforce.com to turn on Salesforce Mobile for your organization.
See Also:
Salesforce Mobile Implementation Guide
Salesforce Mobile User Guide for BlackBerry
Salesforce Mobile User Guide for iPhone
471
Salesforce Mobile About the Salesforce Mobile Default Configuration
About the Salesforce Mobile Default Configuration
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
Mobile configurations for the Salesforce Mobile app are sets of parameters that determine what data Salesforce transmits to users' mobile devices and which users receive the data on their mobile devices. A default mobile configuration is provided for
Professional, Enterprise, Unlimited, and Developer Edition organizations. Administrators can’t view or edit the default mobile configuration.
Users are automatically assigned to the default mobile configuration when they activate their Salesforce account from a supported mobile device using the Salesforce Mobile app.
The default mobile configuration:
• Allows users with an assigned mobile license to install and activate Salesforce Mobile, even if you haven’t yet assigned them to a mobile configuration.
• Allows users without an assigned mobile license to install and activate the free version of Salesforce Mobile.
You can disable Salesforce Mobile
to prevent users from activating the Salesforce Mobile app.
The default configuration can mobilize the following objects:
• Accounts
• Assets
• Cases
• Contacts
• Dashboards
• Events
• Leads
• Opportunities
• Reports
• Solutions
• Tasks
Note:
• Not all objects available in the Salesforce Mobile app are mobilized with the default configuration.
• Assets aren’t available as a tab in the Salesforce Mobile app but display as a related list for accounts, cases, and contacts.
The default configuration automatically synchronizes records the user recently accessed in Salesforce on the Salesforce Mobile app. Users can search for records that aren’t automatically synchronized; once the user downloads a record, the record becomes a permanent part of the data set. In addition to recently accessed records, the default configuration synchronizes activities closed in the past five days and open activities due in the next 30 days.
472
Salesforce Mobile Salesforce Mobile Implementation Tips and Best Practices
Salesforce Mobile Implementation Tips and Best Practices
Set up the Salesforce Mobile app using these tips and best practices.
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
User Permissions Needed
“View Setup and Configuration”
To create, change, or delete Salesforce Mobile configurations: “Manage Mobile Configurations”
Building Lean Data Sets
• Keep the data sets in your mobile configurations as small as possible. Not only do lean data sets greatly improve the
Salesforce Mobile app's performance, but they also make the app easier to use. Pushing massive amounts of data to the device might seem like a good idea, but the important records tend to get lost among the ones that aren't relevant to users' day-to-day activities. Small data sets are powerful because the Salesforce Mobile app synchronizes with Salesforce every
20 minutes, so the data is constantly refreshed with new and updated records. Even if your mobile configurations don't account for every possible record your users might need, they can search for records that aren't automatically synchronized to their devices.
To build small data sets:
◊ Nest the objects in the data set tree. For example, add contacts as a child data set of the account object so that the data set includes contacts related to the mobilized accounts instead of all the user's contacts.
◊ Avoid setting the record ownership filter to All Records unless your organization uses a private sharing model. It's unlikely that users need to see all of an object's records on their devices. Instead of mobilizing all opportunity records, for example, mobilize just the opportunities owned by the user or the user's opportunity team.
◊ Use filters that synchronize the most relevant records. For example, even if you limit the opportunities on the device to records owned by the user, you could further prune the data set by mobilizing only opportunities closing this month.
◊ Set a record limit to prevent the data set from getting too large. Generally, a single data set should generate no more than 2,500 records.
•
ownership filters in your data sets to None (Search Only). The user's data set is populated with records recently accessed in Salesforce, and those records in turn synchronize additional data based on the data set hierarchy. For example, let's say you create a data set with the account object at the root level and add the contact, task, and event objects as child data sets.
When the Salesforce Mobile app synchronizes an account from the Salesforce recent items list, it also synchronizes the contacts, tasks, and events related to that account.
• If you're not sure which fields to use as filters for your data sets or mobile views, consider using the Last Activity Date field. For example, set up a filter that synchronizes contacts with an activity logged this week or this month. The Last
Activity Date field is a better indicator of a record's relevance than the Last Modified Date field—often the main detail of a record remains unchanged even though users frequently log related tasks and events.
473
Configure Salesforce Mobile Apps Salesforce Mobile Implementation Tips and Best Practices
Mobilizing Records Users Need
• Before mobilizing a custom object, make sure the object's functionality is compatible with the Salesforce Mobile app.
Salesforce Mobile doesn’t support S-controls, mashups, merge fields, image fields, or custom links.
• To obtain a relevant set of activities, mobilize the task and event objects at the root level of the data set hierarchy and nest them under parent objects, like contacts, accounts, and opportunities. Adding tasks and events at multiple levels ensures that users will see their personal activities and activities related to the records on their devices. Avoid mobilizing too much activity history or too many tasks and events not owned by the user. Generally, there are more task and event records in an organization than any other type of record, so it's easy to bloat data sets with too many activities.
• If your sales representatives frequently take orders in the field and need a comprehensive inventory list, add the product object at the root level of the data set hierarchy. Nesting the opportunity product object below the opportunity object won't mobilize all products.
• If your users need to assign tasks to other users or change the record owner, mobilize the user object so that the names of other users will be available on the device. Avoid mobilizing all user records—instead, set up filters based on the role or profile.
• Be sure that users assigned to a mobile configuration have field-level access to all the fields used in the configuration's filter criteria. If a user doesn't have access to a field in a data set's filter criteria, the Salesforce Mobile app won't synchronize the records for that data set or its child data sets.
• You can sometimes use cross-object formula fields to work around limitations of the Salesforce Mobile app. For example,
Salesforce Mobile doesn't support campaigns, so you can't add the campaign object as a data set and add the opportunity object as its child data set to get the related records. However, you can create a text formula field on the opportunity object equal to the name of the parent campaign. The field needs to be visible, but it doesn't need to be included on your page layouts. Then add the opportunity object to the data set and use the new formula field to filter opportunities related to a specific campaign.
• Although a mobile configuration might include an object at multiple levels in the data set hierarchy, users won't see duplicate tabs in the Salesforce Mobile app. Only one Task tab appears on the device even if you mobilize the task object at the root level and as a child data set of three objects.
Customizing Mobile Configurations
• Clean up your mobile page layouts by excluding fields from the objects in the mobile configuration. Less data is sent to the device, and mobile users don't have to scroll through unnecessary fields.
• If you mobilize the Dashboards tab, be sure to select any other tabs that should appear in the Salesforce Mobile app.
Customizing the tabs for a mobile configuration overrides the default tab set—if you only mobilize the Dashboard tab, it will be the only tab sent to the device.
• Due to the small size of mobile device screens, you can only select two display columns for mobile views. If you need three columns of data, create a text formula field on the object that concatenates the three fields, then use the formula field in the mobile view criteria.
• When creating mobile views, you can filter based on the current user with the $User.ID global variable, but you can't enter a user's name as a value in the filter criteria. To build a view based on users, create a text formula field on the appropriate object, then use the formula field in the mobile view criteria. For example, to create a view that displays opportunities owned by an opportunity team, create a text formula field on the opportunity object that contains the opportunity owner's user ID or role, then create a view that filters on values in that field.
Testing and Deploying the Mobile Product
• It's important to test mobile configurations to make sure they're synchronizing an acceptable amount of data. Test configurations against active users who own a very large number of records. Typically, most data sets generate between
500 KB and 4 MB of data. If the data sets are over 4 MB, refine the filter criteria to limit the amount of data sent to the device.
• You can use the Salesforce Mobile app in the sandbox before deploying to your organization.
474
Salesforce Mobile Setting Up Salesforce Mobile
• Use of the Salesforce Mobile app requires a data plan. The wireless data volume for the Salesforce Mobile app varies greatly between customers and even users in the same organization. It's impossible to predict your organization's data usage, but we can offer some guidelines:
◊ The initial data download consists of records that match the criteria specified in the user's mobile configuration and the metadata needed to support these records when disconnected. On average, the data sizes range from 500 KB–4
MB.
◊ After the initial download of data, incremental update requests are initiated by the client app every 20 minutes. Each of these requests and the corresponding server response are approximately 200 bytes.
◊ If any new data is downloaded to the client app as a result of the update request, only the new or changed values are sent. For example, the Salesforce Mobile app only downloads the new phone number in a contact record, not the entire contact record. The amount of data transmitted differs for every organization and every user.
Generally, the volume of data transmitted by the Salesforce Mobile app is low compared to moderate email usage.
• If you're deploying to BlackBerry users, evaluate your corporate network infrastructure before implementing the mobile solution.
Best Practices
• Use the zero-administration deployment option to experiment with the Salesforce Mobile app before you set up mobile configurations. You'll create better blueprints for your mobile configurations if you've tried using the Salesforce Mobile app.
• Talk to users about their favorite reports, views, and dashboards to get ideas for what filter criteria to use in mobile configurations.
• After setting up mobile configurations, deploy the Salesforce Mobile app on a limited basis with a select group of users.
Adjust the mobile setup based on their feedback, then deploy to all of your users.
Setting Up Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile settings:
To change Salesforce Mobile settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
To deploy the Salesforce Mobile app to your organization:
1.
Review the mobile implementation tips and best practices
2.
3.
Create one or more mobile configurations
4.
Define the data sets for your mobile configurations
5.
Test the mobile configurations
6.
Customize mobile page layouts and adjust mobile user permissions (optional)
475
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
7.
Customize mobile tabs (optional)
8.
(optional)
9.
10.
Set up mobile reports (optional)
11.
(optional)
12.
Configure access for partner users
(optional)
13.
Create links to Web and Visualforce Mobile pages (optional)
14.
Notify users that Salesforce Mobile is available for download
Mobile Administration Console.
See Also:
Managing Salesforce Mobile Configurations
Managing Salesforce Mobile Devices
Enabling Salesforce Mobile Users
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile settings:
To change Salesforce Mobile settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
To enable users to access to the full version of Salesforce Mobile:
1. Allocate mobile licenses to users by selecting the
Mobile User
checkbox on the user record. The
Mobile User
checkbox is enabled by default for all Unlimited and Developer Edition users.
2. Edit each custom profile to which Salesforce Mobile users are assigned to include the “API Enabled” permission. Salesforce
Mobile users need access to the API so their mobile devices can communicate with Salesforce. The “API Enabled” permission is enabled by default on standard profiles.
Note: The Android, BlackBerry, and iPhone apps are available in English, Japanese, French, German, and Spanish.
Contact salesforce.com to turn on Salesforce Mobile for your organization.
To prevent users from activating the full version of Salesforce Mobile on their mobile devices before you’re ready to deploy the app, disable the
Mobile User
checkbox for all your users.
476
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Note: If you deselect this checkbox for a user who is already assigned to a mobile configuration, Salesforce removes that user from the mobile configuration and assigns the user to the default mobile configuration.
The free version of Salesforce Mobile is enabled by default. If you want to block users without Salesforce Mobile licenses from accessing their Salesforce data on mobile devices, disable the free version of Salesforce Mobile.
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Settings.
2. Click Edit.
3. Deselect Enable Mobile Lite .
Note: If you deselect this option while users are running the Salesforce Mobile app, the Salesforce data on their devices is erased the next time the devices synchronize with Salesforce.
4. Click Save.
See Also:
Salesforce Mobile Implementation Guide
Salesforce Mobile User Guide for BlackBerry
Salesforce Mobile User Guide for iPhone
Creating Salesforce Mobile Configurations
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
User Permissions Needed
“View Setup and Configuration”
To create, change, or delete Salesforce Mobile configurations: “Manage Mobile Configurations”
Mobile configurations are sets of parameters that determine the data Salesforce transmits to users' mobile devices, and which users receive that data on their mobile devices. Organizations can create multiple mobile configurations to simultaneously suit the needs of different types of mobile users. For example, one mobile configuration might send leads and opportunities to the sales division, while another mobile configuration sends cases to customer support representatives.
Before creating your mobile configurations, plan which profiles and users you want to assign to each configuration. Each mobile configuration only affects the mobile devices of users assigned to the configuration.
To create a mobile configuration:
1.
2.
477
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
3.
4.
Complete Your Mobile Configuration
Note:
You can’t view or edit the default configuration.
Any Salesforce user who doesn't have a mobile license can download a free, restricted version of Salesforce Mobile.
These users are assigned to the default mobile configuration when they activate their Salesforce account from a mobile device.
Enter Basic Information
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Configurations to access the mobile configurations list page.
2. Click New Mobile Configuration.
3. Enter a name for the mobile configuration.
4. Select the
Active
checkbox if you want to activate the mobile configuration immediately after creating it. The mobile configuration does not work until you select this checkbox.
If you deactivate an active mobile configuration, Salesforce saves all requests from devices of the users assigned to the mobile configuration for up to one week. If you reactivate the mobile configuration, Salesforce executes those requests in the order received.
5. Optionally, enter a description for the mobile configuration.
6. Optionally, select the Mobilize Recent Items checkbox to mark recently used records in Salesforce for device synchronization.
Selecting this option ensures that mobile users assigned to the configuration will not have to search for and download items they recently accessed on Salesforce, even if those records do not meet the configuration's filter criteria. Only records belonging to mobilized objects can be marked for device synchronization; for example, if you do not mobilize the account object in a configuration, users assigned to that configuration cannot automatically receive recent accounts on their devices.
7. If you select the Mobilize Recent Items checkbox, select a value from the Maximum Number of Recent Items drop-down list. Set a low number if your users have minimal free space on their mobile devices.
8. Optionally, select the
Mobilize Followed Records
checkbox to automatically synchronize records users are following in Chatter to their mobile device. The device only synchronizes followed records for objects included in the mobile configuration's data set.
The Mobilize Followed Records checkbox is only available if Chatter is enabled for your organization.
Assign Users and Profiles
You can assign individual users and profiles to each mobile configuration. If you assign a profile to a mobile configuration, the mobile configuration applies to all Salesforce Mobile users with that profile unless a specific user is assigned to another mobile configuration.
Tip: For ease of administration, we recommend that you assign mobile configurations to profiles; however, you may have situations in which you need to assign a configuration directly to individual users.
To assign users and profiles to a mobile configuration:
1. In the Search drop-down list, select the type of member to add: users or profiles. This drop-down list is not available if you have not enabled the Mobile User checkbox on any user records, or if all users are already assigned to a mobile configuration; in that case, you can only assign profiles to this mobile configuration.
478
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
2. If you do not immediately see the member you want to add, enter keywords in the search box and click Find.
3. Select users and profiles from the
Available Members
box, and click the Add arrow to add them to the mobile configuration.
You can assign each user and profile to only one mobile configuration.
The Available Members box only displays users who have the Mobile User checkbox enabled.
4. If there are users or profiles in the Assigned Members box you do not want to assign to this mobile configuration, select those users and click the Remove arrow.
Warning: Removing a user from an active mobile configuration deletes the Salesforce-related data on the user's mobile device but does not delete the client application.
Set Total Data Size Limit
Different types of mobile devices offer different memory capacities, and some devices experience serious problems if all of the flash memory is used. To avoid overloading mobile devices, optionally specify a total data size limit for each mobile configuration.
The total data size limit prevents Salesforce from sending too much data to the mobile devices of users assigned to the mobile configuration.
To set the total data size limit, use the
Don't sync if data size exceeds
drop-down list to specify the amount of memory that is consistently available on the mobile devices of users who are assigned to this mobile configuration. If the combined size of all the data sets exceeds this limit, users assigned to this profile receive an error message on their mobile devices, and Salesforce will not synchronize any data sets in this mobile configuration.
Test your mobile configuration
to make sure the data sets do not exceed the total data size limit.
Tip: To reduce the size of your data, do one or more of the following:
• Delete a data set.
• Reduce the scope of your data sets.
• Refine the filter criteria of your data sets.
Complete Your Mobile Configuration
Click Save. Note that your mobile configuration is not active until you select the Active checkbox.
See Also:
Managing Salesforce Mobile Configurations
479
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Defining Data Sets
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view mobile data sets:
To create, change, or delete mobile data sets:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
Accessing Salesforce from a mobile device is very different than accessing it from your computer. This is because mobile devices generally have less memory and screen size than computers, and they do not maintain a constant network connection. To work with these limitations, each mobile configuration only transfers data sets, which are subsets of the records users access in the Salesforce online user interface. Mobile devices store data sets in on-board databases, allowing users to access their most important records and work offline when no network connection is available. Salesforce automatically synchronizes the on-board databases when the mobile device reestablishes a network connection.
Each data set can contain records related to a single object and is classified by the name of that object. For example, the
Accounts data set only includes account records.
Data sets can have child data sets, which are data sets that contain records associated with a top-level (parent) data set. For example, if the first level of your hierarchy has an Accounts data set, you can add a Contacts child data set that includes all contact records related to the account records. Child data sets appear as related lists on mobile devices.
A single mobile configuration can have multiple data sets for the same object and at different levels. For example, you can have an Events parent data set and an Events child data set under Leads.
Tip: Review the sample data sets
to see how you might define data sets for common groups of Salesforce users.
After
creating a mobile configuration
, you must define its data sets. To access the data sets for a mobile configuration:
1. Click Your Name > Setup > Mobile Administration > Salesforce Mobile > Configurations, and click the name of the mobile configuration you want to modify.
2. In the Data Sets related list, click Edit.
3. From the Data Sets page, you can:
•
.
• Remove a data set by selecting the data set you want to remove and clicking Remove.
• Edit a data set by selecting the data set you want to edit in the hierarchy. The right pane displays the filters for that data set.
•
Test your mobile configuration .
As you define and modify the data sets, Salesforce automatically saves your changes.
4. Click Done when you are finished.
480
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Adding Data Sets
To add a data set:
1. In the hierarchy, select Data Sets to create a parent data set, or select an existing data set to create a child data set.
2. Click Add....
3. In the popup window, select the object for the records you want the data set to include. Salesforce lets you create parent data sets for all custom objects and the following standard objects:
• Accounts
• Assets
• Attachments
• Cases
• Contacts
• Content
• Events
• Leads
• Notes
• Opportunities
• Price Books
• Products
• Solutions
• Tasks
• Users
Note:
• Although attachments are available as a data set, they're only supported in Salesforce Mobile for Android.
Salesforce Mobile for iPhone and BlackBerry don't currently support attachments.
• Salesforce Mobile supports default field values only for picklists and multiselect picklists. Default field values for other types of fields, such as checkboxes and numeric fields, do not appear in Salesforce Mobile.
When adding to an existing data set, the popup window displays any object with a relationship to the selected object. This includes child objects, and also parent objects with a master-detail or lookup relationship to the selected object.
For example, assume you created an account field called Primary Contact with a lookup relationship to the contact object.
If you add Account as a top-level data set in a mobile configuration, you see two sets of contacts when you add Contact below Account:
• Contact: Represents the standard relationship between the account and contact objects.
• Contact (Referenced by Account): Represents any object that is the parent in a lookup or master-detail relationship for the selected object. In this case, the contact object is referenced by the Primary Contact field on the account object.
Because Salesforce distinguishes between these two types of relationships, you could, for example, mobilize just the contacts referenced by a custom account field without sending any child contact records to the device.
4. Click OK. The data set you created appears in the hierarchy.
5. Optionally, use filters to restrict the records that a parent or child data set includes:
a. Use the Filter by Record Ownership options to configure Salesforce to automatically synchronize records based on the owner of the record. The possible options are:
481
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
• All Records : Salesforce automatically synchronizes all records the user can access. The All Records option is not available for tasks and events when they are parent data sets in a mobile configuration. This helps prevent failed data synchronization due to activity filter queries that take too long to run.
• User's Records : Salesforce automatically synchronizes all records the user owns.
• User's Team's Records : Salesforce automatically synchronizes all records owned by the user and the user's subordinates in the role hierarchy.
• User's Account Team's Records : Salesforce automatically synchronizes accounts for which the user is an account team member, but does not include accounts owned by the user.
• User's Opportunity Team's Records : Salesforce automatically synchronizes opportunities for which the user is an opportunity team member, but does not include opportunities owned by the user.
•
None (Search Only)
: Salesforce does not automatically synchronize any records for this data set; however, users can use their mobile devices to search all of the records they can access.
Salesforce only displays options that relate to the selected data set. For example, selecting an account data set displays the User's Account Team's Records option, while selecting an opportunity data set displays the User's
Opportunity Team's Records
option.
If your mobile needs for an object require a combination of the available record ownership filters, you can add the same object data set up to four times on the same hierarchy level. For example, a sales manager might want to synchronize his opportunities, opportunities owned by his subordinates, and opportunities for which he is an opportunity team member. In this case, you would add an opportunity data set and select
User's Team's Records
, then add a second opportunity data set at the same level in the hierarchy and select User's Opportunity Team's Records . Note that objects with only one ownership filter option, such as Case Comment, cannot be added multiple times at the same level of the hierarchy.
b. Set the filter criteria to automatically synchronize only records that meet specific criteria in addition to the Filter by
Record Ownership option you selected. For example, you can set the filter to only include opportunity records with amounts greater than $50,000, or contact records with the title “Buyer.”
c. To prevent a single data set from consuming all the memory on a mobile device, select the second radio button under
Set Max Record Limit and enter the maximum number of records this data set can transfer to mobile devices. Use the
Order By and Sort drop-down lists to specify which records are synchronized if the data size limit
is exceeded.
If the limit is reached, Salesforce updates the records currently on the mobile device approximately every 20 minutes, and replaces the records approximately every 24 hours in accordance with the Order By and Sort settings. For example, if the settings are Last Modified Date and Descending, Salesforce transfers the most recently modified records to mobile devices and removes the same number of records that were least recently modified.
If you selected the
None (Search Only)
Filter by Record Ownership option, the limit you set does not apply because no records are automatically synchronized.
Tip: Do not use Set Max Record Limit in place of filters. Only use Set Max Record Limit as a safety mechanism, and use filters as the primary means of limiting the number of records on a mobile device. This ensures that your mobile users receive the correct records on their devices.
Because of the memory restrictions of mobile devices, Salesforce prevents a single query from returning more than
2,500 records.
6. Be sure to
test your mobile configuration
to make sure the data does not exceed the total data size limit.
482
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
7. Click Done.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Merge Fields for Mobile Filter Criteria
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
Some of the $User merge fields are available when defining filters for mobile configurations and mobile custom views. In mobile configurations, you can use these merge fields to synchronize records where the user is linked to a record but is not the record owner. For example, you can send cases created by the current user to the mobile device, or you can send records to the device where the current user is referenced in a custom field. In mobile views, you can use the merge fields to define view based on the record owner; for example, you might create a view that displays the current user's accounts with a rating of “Hot”.
The following table describes the available user merge fields:
Merge Field
$User.ID
$User.Username
$User.Firstname
$User.Lastname
Description
References the ID of the current user. This merge field can be applied to fields that contain a user lookup. The valid operators for this merge field are Equals and Not Equal To.
When creating mobile view filters that reference an owner field, you can only use the
$User.ID
merge field.
References the username of the current user. This merge field can be applied to any text or lookup field, except picklists. The valid operators for this merge field are Equals, Not Equal To,
Greater Than or Equal, Less Than or Equal, Contains, Does
Not Contain, and Starts With.
References the first name of the current user. This merge field can be applied to any text or lookup field, except picklists. The valid operators for this merge field are Equals, Not Equal To,
Greater Than or Equal, Less Than or Equal, Contains, Does
Not Contain, and Starts With.
References the last name of the current user. This merge field can be applied to any text or lookup field, except picklists. The valid operators for this merge field are Equals, Not Equal To,
Greater Than or Equal, Less Than or Equal, Contains, Does
Not Contain, and Starts With.
483
Configure Salesforce Mobile Apps
Merge Field
$User.Fullname
Setting Up Salesforce Mobile
Description
References the first and last name of the current user. This merge field can be applied to any text or lookup field, except picklists. The valid operators for this merge field are Equals,
Not Equal To, Greater Than or Equal, Less Than or Equal,
Contains, Does Not Contain, and Starts With.
See Also:
Managing Salesforce Mobile Configurations
Salesforce Mobile Overview for Administrators
Sample Data Sets
Many administrators create mobile configurations based on the functional groups in their organization because users in the same group usually have similar mobile requirements for data. Below are sample data sets for common Salesforce groups. Your mobile users have unique needs, but you can use the examples as a reference to help you get started with mobile configurations.
Sales Manager
Sales managers usually need to see records they own and also the records of their subordinates. They also tend to closely monitor large deals in the pipeline.
This mobile configuration allows sales managers to see:
• The opportunities they own.
• The opportunities owned by users who report to them in the role hierarchy.
• All opportunities scheduled to close in the current quarter with an amount greater than $100,000.
• All accounts related to the opportunities.
• A subset of their contact and activity records.
Figure 1: Sample Mobile Configuration for Sales Managers
Sales Engineer
The sales engineer mobile configuration retrieves opportunities owned by the other members of the user's opportunity team, but does not include the user's records. The configuration is opportunity-based because all accounts and contacts sent to the device are related to the opportunities. The sales engineers would see activity history related to the opportunities on the device and also their own activities.
484
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Figure 2: Sample Mobile Configuration for Sales Engineers
Account Executive
This account executive mobile configuration is account-based, which means the device pulls down the user's accounts and opportunities related to those accounts. The opportunities are filtered so that only open opportunities scheduled to close in the current quarter appear on the device. The Task and Event child data sets retrieve all activities related to those opportunities, not just the user's activities. Only open tasks and events from a two-month window are sent to the device. The Task and Event parent data sets pull down just the user's activities and restrict the activities to open tasks and events scheduled for the next
30 days. The Contact data set delivers the user's contact records, but limits the record count to the 500 most recently active contacts.
Figure 3: Sample Mobile Configuration for Account Executives
Customer Support Representative
Customer support representatives are focused primarily on cases and solutions. This mobile configuration delivers all open cases to the user's device, along with related accounts, contacts, case comments, case history, tasks, and events. The Case
Solution child data set sends all solutions related to the cases, and the Solution data set lets the user search for solutions from the Solutions tab on the device. The support representatives also have access to a subset of their activity records.
485
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Figure 4: Sample Mobile Configuration for Customer Support Representatives
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Testing Salesforce Mobile Configurations
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile data sets:
To test Salesforce Mobile configurations:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
When you create a Salesforce Mobile configuration
, you specify a total data size limit for the configuration. The total data size limit prevents Salesforce from sending too much data to the mobile devices of users assigned to the mobile configuration.
To estimate the size of the data set that the mobile configuration will deliver to a user's device:
1. Click Your Name > Setup > Mobile Administration > Salesforce Mobile > Configurations, and click the name of the mobile configuration you want to test.
2. In the Data Sets related list, click Edit.
486
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
3. In the Test Data Size section, click the lookup icon next to the
Select a user
field to choose the user you want to test.
While users must be mobile-enabled in order to assign them to mobile configurations, you can test the configuration's data size against any user account.
The
Select a user
field defaults to the name of the user currently logged in; however, it is important to test a mobile configuration with the accounts of users who will actually be assigned to the configuration, particularly users who own a large number of records.
4. Select the Include metadata checkbox to include metadata in the estimate. Metadata consists of page layout and schema information, and the amount of metadata sent to a device can be very high depending on the size of your organization and the complexity of its setup.
Warning: It might take a while for Salesforce to calculate the metadata size in addition to the data size. Even if you choose to hide the metadata in your test results, the metadata is still factored into the total data size when the mobile device synchronizes with Salesforce.
5. Click Estimate Data Size.
The size of each data set is calculated. Results display in the hierarchy tree, which is the left pane of the data set region at the top of the page. Additional results appear in the Test Data Size section below the hierarchy.
• In the hierarchy tree, two numbers appear next to each data set. The first represents the number of records generated by the data set, and the second represents the total size of the data set in bytes or kilobytes. This breakdown is useful for identifying which data sets might require additional filtering criteria to reduce the size.
• The Test Data Size section provides an estimate of the data that the current mobile configuration would deliver to the selected user's device, including:
◊ The size and number of records in each object's data set.
◊ The total size and number of records, which includes records in the data set and marked records. A marked record is a record that is not part of a user's mobile configuration. There are two ways marked records can become part of the data set:
The user downloads records to his or her device through online searches, and the records are flagged so that they get sent to the user's device every time the device synchronizes with Salesforce.
Records in the user's data set contain lookup fields to records that do not match the mobile configuration's filter criteria. Salesforce synchronizes the records referenced in the lookup fields so that users do not encounter broken links in the mobile app.
Tip: For an accurate count of the marked records, synchronize the data in the mobile app before estimating the data size. To synchronize the data:
On an Android device, tap Application Info > Sync Now > Refresh All Data.
On a BlackBerry device, open the menu and select System Info, then open the menu and select
Refresh All Data.
On an iPhone device, tap More, then tap App Info. Tap Sync Now, then tap Refresh All Data.
◊ The size of the metadata that would be sent to the device for the user, if you selected the Include metadata checkbox.
◊ The total mobilized data set, which is the sum of all the records.
• Reports are not included in the data size estimate.
487
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
6. Compare the test results to the total data size limit that was set for the configuration; the limit is located in the top of the
Test Data Size section. Click the size limit to increase or decrease the value on the Edit Mobile Configuration page.
• If the total data size is below the limit, the selected user can safely be assigned to the mobile configuration. However, keep in mind that the test results are an estimate because different devices have different storage algorithms.
•
, refining the
. Repeat the testing process until the data is below the total limit.
Note: The data size estimate in the Test Data Size section does not automatically refresh if you edit the data sets. Click Refresh Data Size to update the test results.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Managing Salesforce Mobile Devices
Editing Object Properties for Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
To edit Salesforce Mobile object properties:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
You can change the properties of standard and custom objects in the Salesforce Mobile app. For example, you can restrict the permissions of Salesforce Mobile users, or you can exclude unnecessary fields from the object's mobile page layout.
Salesforce Mobile object properties are customized per mobile configuration. To edit mobile object properties:
1. Click Your Name > Setup > Mobile Administration > Salesforce Mobile > Configurations.
2. Click the name of the mobile configuration you want to modify.
3. In the Mobile Object Properties related list, click Edit next to an object name.
Only objects you mobilized in the configuration's data set appear in the related list. You can’t change the properties of the user object.
4. From the Edit Mobile Configuration page, you can:
•
488
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
•
Customize Salesforce Mobile Page Layouts
5. Click Save.
Remove Mobile Permissions
The Salesforce Mobile app inherits the user's permissions from Salesforce. Some administrators want to further restrict the permissions of users when they access Salesforce data in Salesforce Mobile, usually due to limitations of the app or the possibility of user error. For example, users can inadvertently delete a record because they don't realize that deleting a record in Salesforce
Mobile also deletes the record in Salesforce. If this is a concern, administrators can prevent users from deleting records in the mobile application, regardless of their standard and custom object permissions in Salesforce. Also, Salesforce Mobile doesn’t support all Salesforce features, such as S-controls and Apex. If your business process for an object is unsupported by Salesforce
Mobile, you might choose to prevent mobile users from updating those records in the app.
In the Permissions section, select which permissions to remove from mobile users for this object. Use the Deny Create, Deny
Edit, or Deny Delete checkboxes to prevent users from creating, editing, or deleting records in Salesforce Mobile.
Note: Currently, you can't block mobile permissions for the content object.
Customize Salesforce Mobile Page Layouts
The Salesforce Mobile app inherits the user's page layouts from Salesforce. Administrators may want to exclude some fields from each object's mobile page layout because unnecessary fields consume memory and make it harder for users to scroll through pages on the mobile device.
In the Excluded Fields section, select which fields to display on the mobile device for this object. To add or remove fields, select a field name, and click the Add or Remove arrow.
• Administrators can view all available fields per object, regardless of field-level security.
• Certain fields are required in order for Salesforce Mobile to communicate with Salesforce. Those fields don’t display in the Available Fields box because they are mandatory and can’t be excluded from mobile page layouts.
• Fields used in custom mobile views can’t be excluded from mobile page layouts.
• If you mobilize the content object, all of the content object's fields display in the Available Fields box; however, the layout of the content detail page in the Salesforce Mobile app is hard-coded to show only a few fields. Excluding fields for the content object doesn't affect the page layout in the app.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Managing Salesforce Mobile Tabs
Creating Links to Web and Visualforce Mobile Pages for Salesforce Mobile
489
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Assigning Tabs to a Salesforce Mobile Configuration
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
To customize Salesforce Mobile tabs:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
For each mobile configuration, you can select the tabs that appear in the Salesforce Mobile app and define the order of the tabs. The available tabs for a mobile configuration include:
• Standard object tabs
• Custom object tabs
• Visualforce and web tabs that have been enabled for Salesforce Mobile
Warning: Not all websites and Visualforce features are supported on mobile devices. Carefully review the
for creating mobile-friendly pages before enabling Visualforce or web tabs for the Salesforce Mobile app.
By default, tabs work the same in the Salesforce Mobile app as in the full Salesforce site—if an object's tab is hidden in
Salesforce, it’s hidden in Salesforce Mobile as well.
Note: If you customize mobile tabs, the tabs you select for the mobile configuration are sent to users' mobile devices even if the tabs have not been added to a configuration. Although the tabs are sent to the device, they only display in the Salesforce Mobile app if users have permission to view the tab.
There are several reasons you might want to hide an object's tab in Salesforce Mobile even though the object records are sent to the device. The Salesforce Mobile app has much less screen space to display a row of tabs, so occasionally you might choose to reduce the number of tabs on the device. Also, sometimes a custom object has a relationship to a standard object, and users access the custom object record from the parent object record. In that case, you could mobilize the custom object but hide the tab.
To assign tabs to a mobile configuration:
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Configurations, and then click the name of a mobile configuration.
2. In the Mobile Tabs related list, click Customize Tabs to define mobile tabs for the first time. If you have already set up the mobile tabs, click Edit.
3. Select tabs from the Available Tabs list, and click the Add arrow to add them to the mobile configuration.
4. In the Selected Tabs list, choose tabs and click the Up and Down arrows to arrange the tabs in the order they should appear in the Salesforce Mobile app.
5. Click Save.
490
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Note: iPhone users can customize the order of their tabs in the Salesforce Mobile app. If the user customizes their tab order, any administrator changes to the tab order in the mobile configuration are ignored by the app, and any newly mobilized tabs are added below the user's existing tabs.
See Also:
Managing Salesforce Mobile Tabs
Enabling Web and Visualforce Tabs for Salesforce Mobile
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Enabling Web and Visualforce Tabs for Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
You can make web and Visualforce tabs available in the Salesforce Mobile app. When you build the web tab or Visualforce tab, edit the tab properties and select the Mobile Ready checkbox to ensure that the web page or Visualforce page displays and functions properly on a mobile device. Selecting the checkbox adds the tab to the list of available tabs for your mobile configurations.
It is important to note that most mobile browsers have technical limitations concerning display size, scripts, processor speed, and network latency. Review the following considerations before mobilizing your web and Visualforce pages to ensure that they are compatible with mobile browsers.
Mobile Web Tab Considerations
Consider the following when defining a web tab that will be used in the Salesforce Mobile app:
• The ability to mobilize web tabs is only available for BlackBerry and iPhone devices. If you mobilize a web tab, keep in mind that Android users can’t view the tab in Salesforce Mobile.
• The minimum BlackBerry operating system requirement for web tabs is 4.3.
• The tab type must be URL. The mobile application can’t run S-controls.
• Some web pages contain JavaScript and Flash, but not all mobile browsers support them:
◊ Apple's Safari browser supports JavaScript, but not Flash.
◊ The BlackBerry browser has limited support for JavaScript and no support for Flash.
• Before mobilizing a web tab, navigate to the target URL on one of your organization's mobile devices to verify that it works as expected in a mobile browser. In the event that your organization's device inventory includes phones with different operating systems—for example, both iPhones and BlackBerry smartphones—be sure to test on each type of device. If users can’t accomplish the necessary tasks on the web page from a mobile browser, do not mobilize the web tab.
• JavaScript must be enabled on BlackBerry devices in order to view JavaScript web pages. The BlackBerry administrator can globally enable JavaScript from the BlackBerry Enterprise Server. Users can also enable JavaScript on a BlackBerry smartphone by opening the BlackBerry browser, selecting Options > Browser Configuration, and then selecting the
Support JavaScript checkbox.
491
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Visualforce Mobile Tab Considerations
Consider the following when defining a mobile Visualforce tab:
• Visualforce Mobile is only available for BlackBerry and iPhone. If you mobilize a Visualforce tab, keep in mind that Android users can’t view the tab in Salesforce Mobile.
• The Salesforce Mobile app can run on BlackBerry operating system versions 4.3 through 7.0. For optimum performance, however, Salesforce recommends running Visualforce Mobile on BlackBerry smartphones installed with at least version
6.0.
• Because the display size is limited on mobile browsers, we recommend redesigning the Visualforce page to optimize it for mobile users:
◊ Set the sidebar and showHeader attributes on the <apex:page> tag to false . Phones have small screens and limited processing power, so it is essential that the page suppresses the tab header and sidebar.
◊ Set the standardStylesheets
attribute on the
<apex:page>
tag to false
. The standard Salesforce stylesheet causes pages to load slowly on the device. Additionally, most BlackBerry browsers older than the 6.0 OS can’t properly interpret CSS . The best approach to adding a stylesheet to your page is to include a <style> section just below the
<apex:page>
component.
◊ Set the columns attribute on the <apex:pageBlockSection> component to 1 . There is not enough room on a mobile device’s screen to display two columns, so specifying a one-column layout prevents fields from wrapping awkwardly on the page.
• Splash pages don’t display in the Salesforce Mobile app.
• In the Salesforce Mobile app, the Visualforce page is embedded in a tab, so you should avoid using tabs for navigation in mobile Visualforce pages.
• Even if you know that the mobile browser supports the JavaScript in your Visualforce page, keep your use of JavaScript to a minimum. Mobile devices generally have slow network connections, and too many scripts running on a page creates a poor user experience. To minimize the amount of JavaScript on your mobile Visualforce pages, try to build them using mostly HTML.
• All Visualforce pages contain JavaScript, even if you don’t create pages that use JavaScript code. JavaScript must be enabled on BlackBerry devices in order to view Visualforce pages. The BlackBerry administrator can globally enable JavaScript from the BlackBerry Enterprise Server. Users can also enable JavaScript on a BlackBerry smartphone by opening the
BlackBerry browser, selecting Options > Browser Configuration, and then selecting the Support JavaScript checkbox.
• The embedded browser in the BlackBerry client application doesn’t have built-in navigation. If your Visualforce page is a wizard, you should provide navigation links that allow users to return to the previous page and advance to the next page.
• BlackBerry administrators should be aware that the download size setting on the BlackBerry Enterprise Server affects how much data can be pushed to the device. Check that the download size setting is appropriate, and be sure to test your
Visualforce pages before deploying them to your Salesforce Mobile users.
• User agent inspection can be executed in a custom controller to support multiple devices. You can do this by inspecting the appropriate result of the getHeaders() method on the current page reference.
See Also:
Managing Salesforce Mobile Tabs
Managing Salesforce Mobile Configurations
Creating Links to Web and Visualforce Mobile Pages for Salesforce Mobile
Assigning Tabs to a Salesforce Mobile Configuration
492
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Creating List Views for Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile devices and users:
To manage Salesforce Mobile custom views:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
You can create custom list views for Salesforce Mobile users. Custom list views for Salesforce Mobile, also called mobile views, are different from Salesforce custom views in these ways:
• Administrators set up mobile views for each mobile configuration. The views are available to all users assigned to the configuration, and administrators can’t restrict visibility to certain groups of users within the configuration. Each mobilized object in a mobile configuration can have up to 10 custom views.
• Users can’t filter mobile views by All Records or My Records. The views apply to all records stored locally on the device regardless of ownership; however, ownership filters can be applied using the additional fields in the search criteria.
• Mobile views don't support filter logic.
• Mobile views are limited to a two-column display.
• Users can sort mobile views in ascending or descending order by up to two fields.
For each mobile configuration, you can define up to 10 custom views per object. These views are then pushed to the devices of users assigned to the affected configurations. To create a custom view for Salesforce Mobile:
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Configurations, and then click the name of
a mobile configuration. You might need to create a mobile configuration if you haven't already.
2. Scroll down to the Mobile Views related list.
3. Choose an object type from the Select an object drop-down list, and then click New Mobile View. Only objects included in the mobile configuration's data set appear in the drop-down list. You can’t create mobile views for the user object.
4. Enter the view name.
Because display space on mobile devices is limited, the maximum length of a mobile view name is 30 characters.
5. In the Specify Filter Criteria section, enter conditions that the selected items must match; for example, Amount is greater than $100,000 .
a. Choose a field from the first drop-down list.
Note: You can’t create views based on fields you
excluded from mobile page layouts
or fields that are hidden for all profiles and permission sets .
b. Choose a filter operator.
c. In the third field, enter the value to match.
493
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Warning: Note the following about filter criteria values for mobile views:
•
as a value in your filter criteria to reference the current user. You can't enter user names in your filter criteria.
• You can only enter special date values in your filter criteria, not actual dates.
• You can't use FISCAL special date values in the filter criteria.
d. Select Match All if items in the mobile view should match all the criteria you entered. Select Match Any if items in the mobile view should match any of the criteria you entered. Mobile custom views do not support advanced filtering options.
6. In the Select Fields to Display section, select the fields to use as display columns.
The default fields are automatically selected. You can choose up to two different columns of data fields to display in your mobile custom view.
7. In the Define Sort Order section, optionally set a primary and secondary sort order for the view.
a. Select a field in the Order By drop-down list. You can sort by fields that have been excluded from the object's mobile page layout.
b. Set the sort order to Ascending or Descending.
8. Click Save.
See Also:
Managing Salesforce Mobile Views
Managing Salesforce Mobile Configurations
Managing Salesforce Mobile Devices
Setting Up Mobile Dashboards
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view mobile configurations:
To mobilize dashboards:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
You can make the Dashboards tab available in Salesforce Mobile by adding it to the tabs for a
. Mobile dashboards allow field users to keep up with corporate metrics and key performance indicators even when they are away from their desks.
494
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Note the following about mobile dashboards:
• The Dashboards tab in the mobile application launches an embedded browser to display the dashboards.
• Due to screen size limitations, mobile dashboards display in a single column.
• Links to custom report details are disabled in mobile dashboards.
• The first time a user visits the Dashboards tab in Salesforce Mobile, the mobile application requests the last dashboard the user viewed in Salesforce. Depending on the strength of the cellular or WiFi signal, it could take several minutes before the dashboard displays on the page.
• Dashboards do not automatically refresh in the mobile application. Users can request a dashboard refresh by clicking the
Refresh button.
• Users are able to work offline in the mobile application. Without a wireless connection, users can see the last viewed dashboard, but they cannot refresh the dashboard or select a different one.
• The minimum BlackBerry operating system requirement for mobile dashboards is 4.5. Mobile dashboards are compatible with version 4.3, but tables in the dashboards might not display properly.
• BlackBerry administrators should be aware that the download size setting on the BlackBerry Enterprise Server affects how much dashboard data can be pushed to the device. Check that the download size setting is appropriate, and be sure to test your dashboards before deploying them to your mobile users.
Note: Currently, dashboards are only available in the BlackBerry and iPhone mobile client applications.
To enable mobile dashboards:
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Configurations, and then click the name of a mobile configuration.
2. In the Mobile Tabs related list, click Customize Tabs to define mobile tabs for the first time. If you have already set up the mobile tabs, click Edit.
3. Select Dashboards from the Available Tabs list, and click the Add arrow to add it to the mobile configuration. The
Available Tabs list includes standard object tabs and custom object tabs. It can also include web and Visualforce tabs.
Warning: If you have not yet customized tabs in the mobile configuration, you must select all the tabs that should appear in the mobile application, not just the Dashboards tab.
4. In the Selected Tabs list, choose the Dashboards tab and click the Up and Down arrows to define where the Dashboards tab should appear in the mobile application.
5. Click Save.
See Also:
495
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Enabling Reports in Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To create, edit, and delete public report folders:
User Permissions Needed
“Manage Public Reports”
To view Salesforce Mobile configurations: “View Setup and Configuration”
To enable reports in the Salesforce Mobile app:
1. Create a Mobile Reports folder in Salesforce. From the reports home page in the full site, click Create New Folder.
2. In the
Report Folder
field, enter: Mobile Reports .
The server won’t load reports on mobile devices unless this folder is named Mobile Reports . Be sure to check for any typos in the name before saving the folder. Additionally, Salesforce doesn’t require folder names to be unique. Salesforce
Mobile users can see any report stored in all folders named Mobile Reports unless you restrict access with the folder visibility option.
3. Choose a
Public Folder Access
option. This option doesn’t affect the ability of mobile users to run reports.
4. Optionally, select any unfiled reports and click Add to store them in the Mobile Reports folder. You can also add reports to the folder after saving the folder.
5. Choose a folder visibility option.
• This folder is accessible by all users gives every user in your organization the ability to see the list of mobile reports from their devices.
•
This folder is accessible only by the following users lets you grant access to a desired set of users.
Don’t make the
Mobile Reports
folder private unless you want to hide mobile reports from all users, including yourself.
6. Click Save.
7. Add reports to the Mobile Reports folder. Click the report name on the reports home page, then click Save As and save the report in the Mobile Reports folder.
After saving the report, you can edit the options to make the report easier to view on a mobile device. For example, you might reduce the number of columns or enter additional filtering criteria.
8. Add the Reports tab to your mobile configurations. Click Your Name > Setup > Mobile Administration > Salesforce
Mobile > Configurations, then click the name of a mobile configuration.
9. In the Mobile Tabs related list, click Customize Tabs to define mobile tabs for the first time. If you’ve already set up the mobile tabs, click Edit.
10. Select Reports from the Available Tabs list, then click the Add arrow to add it to the mobile configuration. The Available
Tabs list includes standard object tabs and custom object tabs. It can also include web and Visualforce tabs.
496
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Warning: If you have not yet customized tabs in the mobile configuration, you must select all the tabs that should appear in the Salesforce Mobile, not just the Reports tab.
11. In the Selected Tabs list, choose the Reports tab and click the Up and Down arrows to define where the Reports tab should appear in the Salesforce Mobile app.
12. Click Save.
Note: Currently, reports in Salesforce Mobile aren’t available on Android or iPhone devices.
See Also:
Setting Up Salesforce CRM Content for Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
User Permissions Needed
To view Salesforce Mobile configurations:
To create, change, or delete Salesforce Mobile data sets:
“View Setup and Configuration”
“Manage Mobile Configurations”
Note the following about how Salesforce CRM Content is implemented in Salesforce Mobile:
• Content record information is synchronized to the device; however, the files associated with the content records are not.
This allows users to deliver content from the app even when a file is too large to be downloaded to a mobile device.
• Users can't search for a specific piece of content in the app. They can only share the content available on the Content tab, which is automatically synchronized to their device based on the filters in their assigned mobile configuration.
• Users can't view a list of their subscribed content in the app. They also can't filter the list of records on the Content tab based on a particular library.
• While users can preview and share content from the app, they can't update the file associated with a content record. If they have the required permissions, they can edit the fields on the content detail page.
• Users must have a data connection to preview and deliver content. Without a data connection, they can only view the content detail page.
• Content in Salesforce Mobile is only supported on BlackBerry and iPhone devices.
• Content is not available in the free version of Salesforce Mobile.
• You can't block mobile permissions for the content object. Currently, the content object in Salesforce Mobile is read-only.
• You can't edit the mobile page layout for the content object. The content detail page in the app is hard-coded to display only a few fields.
497
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
To set up Content for a Salesforce Mobile configuration:
1. Click Your Name > Setup > Mobile Administration > Salesforce Mobile > Configurations, and then click the name of a mobile configuration.
2. In the Data Sets related list, click Edit.
3. Click Add....
4. In the popup window, select Content, then click OK.
5. Use field filters to specify which content records are synchronized.
Because users can't search for content in the Salesforce Mobile app, it's essential to set up filters that make important content available on the device. You can't create filters based on libraries or subscriptions, but here are a few options for setting up useful filter conditions:
• Date: Filter on the
Last Modified Date
,
Content Modified Date
, or
Created Date
fields. Use special date values like LAST 90 DAYS or LAST 180 DAYS to ensure that recently updated content records are synchronized.
• Owner: Filter on the author if certain people in your organization are responsible for publishing content.
• File Type: Filter on certain types of documents. For example, your opportunity team might generally be interested in presentations or PDF documents.
• Custom Fields: If you created custom content fields that help you categorize your content, filter on the custom fields.
For example, if you built a Functional Use field with picklist values, you could set up a filter condition where
Functional Use
equals Sales .
6. Optionally, prevent content records from consuming all the memory on a mobile device by selecting the second radio button under Set Max Record Limit and entering the maximum number of content records this configuration can transfer to mobile devices. Use the Order By and Sort drop-down lists to specify which records are synchronized if the data size limit for your mobile configuration is exceeded.
7. Click Done.
See Also:
498
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Configuring Salesforce Mobile Access for Partner Users
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations, data sets, mobile devices, and users:
User Permissions Needed
“View Setup and Configuration”
To create, change, or delete Salesforce Mobile configurations and data sets, test mobile configurations, edit mobile object properties, and manage mobile custom views:
“Manage Mobile Configurations”
You can allow partner users to access partner portal data on mobile devices using the Salesforce Mobile app.
Tips for setting up Salesforce Mobile access for partner users:
• Before setting up Salesforce Mobile for partner users, you must configure partner user accounts and purchase mobile licenses for each partner portal user that will be using Salesforce Mobile. Partner user profiles must be assigned to at least one active partner portal before partner users can use Salesforce Mobile. If a user profile is assigned to multiple partner portals, only the first assigned partner portal will be accessible using Salesforce Mobile.
• Custom mobile list views don’t affect list views in the partner portal.
• If you make User data sets available in the Salesforce Mobile app, partners can assign objects to their partner account users and all internal users. If you don’t make User data sets available, partners can only assign objects to internal or partner account users who are associated with records that you’ve made available on the mobile device.
See Also:
499
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
Creating Links to Web and Visualforce Mobile Pages for Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
User Permissions Needed
To create or change custom buttons or links: “Customize Application”
To improve the integration between the Salesforce Mobile app, Visualforce Mobile, and external websites, you can optionally create links from native Salesforce records to Visualforce Mobile pages or external websites. To create the links, build text formula fields on a standard or custom object. The field must be visible on the page layout to appear in the Salesforce Mobile app. The best practice is to include all embedded links in a separate section labeled “Mobile Links” at the bottom of the page layout. There is currently no way to hide these links in Salesforce, but users can collapse the section to keep the links out of the way.
To create a link from a native record to a Visualforce Mobile page or Web page:
1. Create a custom field by navigating to the fields area of the appropriate object:
• For standard objects, click Your Name > Setup > Customize, then select the appropriate object from the Customize menu, and click Fields.
• For custom objects, click
Your Name
> Setup > Create > Objects, and select one of the custom objects in the list.
2. Click New in the Custom Fields & Relationships section of the page.
3. Select
Formula
, then click Next.
4. Enter the field label.
The field name is automatically populated based on the field label you enter.
5. Select Text , then click Next.
6. In the formula editor, create the link to the custom Visualforce page or external website:
• To create a Visualforce link, type "visualforce:///apex/PageName" , and replace PageName with the name of your Visualforce page. You can append parameters to the string, such as ?contactid=" & Id" , in order to pass information from the record in the client application to the Visualforce page.
• To create a Web link, type "weblink:" , followed by the URL to which you want the link to point, such as
"weblink:http://www.salesforce.com" . You can append parameters to the string in order to pass information from the record in the client application to the Web page. For example, the following Web link launches a social networking site from a contact record and performs a search for the contact:
"weblink:http://m.linkedin.com/members?search_term=" &FirstName& "+" &LastName&
"&filter=name&commit=Search"
Note: The client application passes the Visualforce or Web link with all parameters to the embedded browser.
It is up to the website or Visualforce Mobile page to interpret any parameters. Be sure to construct your
Visualforce Mobile page to consume any parameters passed in the link.
500
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
7. Click Next.
8. Set the field-level security to determine whether the field should be visible or read only for specific profiles, and click Next.
9. Choose the page layouts that should display the field. In the next step, you will customize the layout to change the location of the field on the page.
10. Click Save.
11. Edit the object's page layout:
• For standard object page layouts, select Your Name > Setup > Customize, select the object, and choose the Page
Layouts link. Click Edit next to the name of the page layout you want to modify.
• For custom object page layouts, select Your Name > Setup > Create, select the object, and scroll to the Page Layouts section. Click Edit next to the name of the page layout you want to modify.
12. Drag a Section element from the palette to the page layout and drop it below the existing sections.
13. In the
Section Name
field, type Mobile Links .
14. Deselect the Edit Page option.
15. Select the 1-column layout, then click OK.
16. Drag the new text formula field from its current location into the new Mobile Links section.
17. Click Save.
See Also:
Notifying Users about Salesforce Mobile Availability
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To create HTML email templates:
To send mass emails to users:
User Permissions Needed
“Edit HTML Templates”
“Mass Email”
AND
“Manage Users”
When you're ready to deploy the Salesforce Mobile app to your users, send them an email to notify them about the availability of the app and provide installation instructions. You can send the email using your corporate email application, like Outlook, or you can send mass email from Salesforce. Either way, include the URL that launches the download:
• For Android and BlackBerry users, the download URL is mobile.salesforce.com
. The link is the same for the initial download and for subsequent upgrades.
501
Configure Salesforce Mobile Apps Setting Up Salesforce Mobile
• If you manage BlackBerry devices with a BlackBerry Enterprise Server, you can use Application Push to remotely deliver
Salesforce Mobile to users. For more information about BlackBerry Enterprise Application Push, see “BlackBerry Enterprise
Server Application Push” in the Salesforce Mobile Implementation Guide .
• You can obtain the iPhone download URL from iTunes. Open iTunes, click iTunes Store, then search for Salesforce
Mobile. Click the app icon to view details about the app. At the top of the iTunes window is a bread crumb path representing the application's location in the App Store: App Store > Business > Salesforce Mobile. Drag-and-drop the path into a text editor or word processing program to display the app’s download URL.
To send mass email to Salesforce Mobile users from Salesforce:
1. Create an email template that informs users about the availability of Salesforce Mobile by clicking Your Name > Setup >
Email > My Templates. Optionally, you can also create a separate email template for upgrade notifications. Include the download link in the templates.
2. Create a custom view on the Mass Email page that shows your Salesforce Mobile users only.
Note: The
Mobile User
checkbox on the user record assigns a mobile license to users, which enables use of the full version of Salesforce Mobile. But other Salesforce users can access the free version of Salesforce Mobile without an assigned mobile license, so you can’t filter for all Salesforce Mobile users by license. Create a view for users of the free versionby filtering by roles or profiles instead.
3. Send mass email to your Salesforce Mobile users, using the custom view that you created, by clicking
Your Name
> Setup
> Manage Users > Mass Email Users.
See Also:
Salesforce Mobile FAQ for Administrators
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
•
Is the mobile application secure?
•
•
Is there an easy way to deploy the mobile application to all of my BlackBerry users?
Is the mobile application secure?
All data transmitted between Salesforce and the mobile application is fully encrypted and secured over the air.
The mobile application has multiple layers of security at the device level. Device venders provide the ability to set password or passcode access restrictions. Users must be required to use the device protection in accordance with your organization's security policy. If the device is locked by password, it is difficult for unauthorized persons to obtain sensitive data.
502
Salesforce Mobile Managing Salesforce Mobile Configurations
Additionally, a user must have valid Salesforce credentials to activate the mobile application on the device. When a user registers a new wireless device, the Salesforce data on their old wireless device is automatically erased—users can only activate one mobile device at a time. Users are also warned when a new device is activated using their Salesforce account. If a logged in user exceeds the administrator-configured inactivity period on the mobile device, the mobile session is terminated and the password or passcode is required to reestablish the session.
Administrators can also remotely
delete data from any lost or stolen devices.
My users have Android, BlackBerry, and iPhone devices. Can we have multiple types of device in one organization?
Yes, one organization can have multiple types of devices. However, a user can only have one active device.
Is there an easy way to deploy the mobile application to all of my BlackBerry users?
If your organization manages BlackBerry smartphones using the BlackBerry Enterprise Server (BES), you can use Application
Push. Application Push is an administrator-initiated delivery technology on the BlackBerry Enterprise Server that installs applications on BlackBerry smartphones remotely. This technology is not developed or supported by Salesforce, but BlackBerry
Enterprise Server administrators can use it to install Salesforce Mobile on their BlackBerry users' mobile devices.
For instructions on how to configure the BlackBerry Enterprise Server v4.1 to push Salesforce Mobile to your BlackBerry users, see “BlackBerry Enterprise Server Application Push” in the Salesforce Mobile Implementation Guide .
You can find detailed information about Application Push in the official BlackBerry Enterprise Server Administrator Guide from
Research in Motion in the sections “Making additional BlackBerry device software and applications available to users” and
“Creating software configurations.” If you have any technical issues with Application Push, contact Research in Motion
Support.
Managing Salesforce Mobile Configurations
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
User Permissions Needed
“View Setup and Configuration”
To create, change, or delete Salesforce Mobile configurations: “Manage Mobile Configurations”
You can manage your existing Salesforce Mobile configurations from Your Name > Setup > Mobile Administration >
Salesforce Mobile > Configurations.
•
To define a new mobile configuration , click New Mobile Configuration.
• To modify a mobile configuration—including assigning different users or profiles and changing the maximum size of data sets—click Edit.
• To activate a mobile configuration, click Edit, select the Active checkbox, then click Save. Deselect Active to deactivate the mobile configuration.
503
Configure Salesforce Mobile Apps Managing Salesforce Mobile Configurations
• To delete a mobile configuration, click Del.
• To view details about a mobile configuration, click its name.
From a mobile configuration detail page, you can:
◊
Modify data sets for a mobile configuration by clicking Edit in the Data Sets related list.
◊
Change the properties of mobilized objects
by clicking Edit next to an object name in the Mobile Object Properties related list.
◊
Customize mobile configuration tabs by clicking Edit in the Mobile Tabs related list.
◊
Create custom views for a mobile configuration by clicking Edit in the Mobile Views related list.
◊ Clone the mobile configuration by clicking Clone.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Permissions
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
User Permissions Needed
“View Setup and Configuration”
To create, change, or delete Salesforce Mobile configurations: “Manage Mobile Configurations”
A mobile license is required for each user who will access the full version of the Salesforce Mobile app. You allocate mobile licenses using the Mobile User checkbox on the user record. For organizations using Unlimited and Developer Editions, salesforce.com provides a mobile license for each Salesforce license and the
Mobile User
checkbox is enabled by default for all users. Organizations using Professional or Enterprise Editions must purchase mobile licenses separately and allocate them manually.
To prevent users from activating the full version of Salesforce Mobile on their mobile devices before you’re ready to deploy the app, disable the
Mobile User
checkbox for all your users.
Any Salesforce user who doesn't have a mobile license can download a free, restricted version of Salesforce Mobile. Starting with Spring ’09, the free version of Salesforce Mobile is enabled by default in all new organizations. You can disable it to prevent unlicensed users from accessing Salesforce on mobile devices.
To disable the free version of Salesforce Mobile:
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Settings.
2. Click Edit.
3. Deselect Enable Mobile Lite .
504
Configure Salesforce Mobile Apps Managing Salesforce Mobile Configurations
4. Click Save.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Tabs
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile configurations:
To manage Salesforce Mobile tabs:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
To manage the tabs for a Salesforce Mobile configuration, click Your Name > Setup > Mobile Administration > Salesforce
Mobile > Configurations. Then click the name of the mobile configuration and scroll down to the Mobile Tabs related list.
If you’ve already customized the configuration’s tabs, the Mobile Tabs related list shows the selected tabs.
• To change the tab setup, click Edit.
• To delete the mobile tab setup and use the default tab behavior instead, click Reset to Default.
If you haven’t customized the configuration’s tabs, the related list indicates that the default tab behavior is used for the
configuration. To customize the tabs used by the configuration and define their order
on page 490, click Customize Tabs.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
505
Configure Salesforce Mobile Apps Managing Salesforce Mobile Configurations
Managing Salesforce Mobile Views
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile devices and users:
To manage Salesforce Mobile custom views:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
To manage the custom views for a Salesforce Mobile configuration, click
Your Name
> Setup > Mobile Administration >
Salesforce Mobile > Configurations. Then click the name of the mobile configuration and scroll down to the Mobile Views related list:
• To see a list of all your custom views, choose All Objects in the
Select an object
drop-down list. You can also use the Select an object drop-down list to filter the views by object type.
•
on page 493, select the object type from the Select an object drop-down list, and then click
New Mobile View.
• To make changes to a custom mobile view, click Edit next to the view name.
• To delete a mobile custom view, click Del next to the view name.
• To view details about a mobile custom view, click its name.
See Also:
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Managing Salesforce Mobile Devices
506
Configure Salesforce Mobile Apps Managing Salesforce Mobile Configurations
Salesforce Mobile Usage Data in Custom Report Types
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To create or update custom report types:
To delete custom report types:
User Permissions Needed
“Manage Custom Report Types”
“Modify All Data”
You can create custom report types with data that shows how your organization uses Salesforce Mobile. For example, the reports can show how often users access Salesforce Mobile, which mobile device models they use, and so forth.
To create a custom report type with Salesforce Mobile usage data, select the Mobile Session
Primary Object
when defining a custom report type. When you select the fields for the custom report type, choose from the following Salesforce Mobile-specific fields.
Mobile Usage Data Point
Brand
Data Size (Bytes)
Device Address
Device Application Version
Device Model
Device Operating System Version
Duration
Last Registration Date
Last Status Date
Manufacturer
Metadata Size (Bytes)
Owner: Full Name
Session Start Date
Status
Definition
Wireless carrier
Total size of records on device
Unique physical address of device (PIN for BlackBerry or
UDID for iOS)
Installed version of Salesforce Mobile
Model of device
Version of operating system installed on device
Duration of the mobile session in seconds
Date of last registration or activation
Date of last communication received from device
Manufacturer of device
Size of metadata (page layouts, picklist values, and so forth) on the device
Name of the device user
Date the mobile session started
Indicator that the user's data set exceeds the maximum allowed size by the mobile configuration
507
Salesforce Mobile Managing Salesforce Mobile Devices
Note:
• Mobile sessions are similar to Web-based sessions in login history reports; however, mobile sessions have a fixed timeout value of 20 minutes. Salesforce creates a new Mobile Session when a user logs into or launches Salesforce
Mobile after 20 minutes of inactivity in the app or on the device in general.
• Mobile session reports only have usage data for the Salesforce Mobile app and not the Chatter mobile app.
• Some devices do not provide every physical attribute. For example, Apple devices do not provide brand.
Managing Salesforce Mobile Devices
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile devices and users:
To manage Salesforce Mobile devices:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
After a user installs the Salesforce Mobile app on a mobile device and logs in for the first time, Salesforce collects information about the device and associates it with the user's record. The device information is read only.
While the device entry is created automatically, you can still view and manage all the mobile users and devices in your organization by clicking Your Name > Setup > Mobile Administration > Salesforce Mobile > Users and Devices.
From the All Mobile Users and Devices page, you can:
• View the list of users in your organization who have been enabled to use Salesforce Mobile.
• Create custom list views to see different subsets of your mobile users. For example, create a view that shows the users who have never logged in to Salesforce from theSalesforce Mobile app to evaluate the effectiveness of your organization's
Salesforce Mobile deployment efforts.
•
View details about a mobile device by clicking the device address.
• View details about a specific user by clicking the username.
• View details about a mobile configuration by clicking the mobile configuration name.
• Perform these actions on multiple users at the same time:
◊
Adjust the mobile session timeout value
◊
Erase the Salesforce data from a user's mobile device
◊
Delete a mobile device from a user's record
• Find out why a user's device isn’t synchronizing by hovering your mouse over the red error icon in the Status column.
Additional information about the synchronization errors appears on the device's detail page.
508
Configure Salesforce Mobile Apps Managing Salesforce Mobile Devices
Note: You can also manage mobile users from the Assigned Mobile Devices related list on the user detail page.
See Also:
Permanently Linking Salesforce Mobile Users to a Mobile Device
Viewing Salesforce Mobile Device Information
Setting Salesforce Mobile Session Timeout Values
Erasing Data in Salesforce Mobile
Salesforce Mobile Overview for Administrators
Managing Salesforce Mobile Configurations
Permanently Linking Salesforce Mobile Users to a Mobile Device
You can prevent mobile users from registering any mobile device other than the one they used for their initial Salesforce Mobile activation.
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile settings:
To change Salesforce Mobile settings:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
By default, Salesforce automatically associates a device record with the mobile user who most recently activated the device, so administrators don’t need to update the device record to assign the device to another user. While this behavior makes it easy to switch devices between users in your organization, some administrators prefer that users are permanently linked to the devices they were originally assigned. This helps administrators of organizations with highly sensitive data ensure that their users do not access corporate data from personal devices.
To permanently link a user to a mobile device:
1. Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Settings.
2. Click Edit.
3. Select Permanently Link User to Mobile Device .
4. Click Save.
Warning: Enabling the
Permanently Link User to Mobile Device
setting requires administrative action
509
Configure Salesforce Mobile Apps Managing Salesforce Mobile Devices order for the user to register a different device. If you don’t delete the device, the user won’t be able to access the
Salesforce Mobile app.
See Also:
Managing Salesforce Mobile Devices
Viewing Salesforce Mobile Device Information
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view Salesforce Mobile devices and users:
To manage Salesforce Mobile devices:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
Salesforce collects information about a mobile user's device the first time the user logs in to the Salesforce Mobile app. There are two ways to access the device details:
• Click
Your Name
> Setup > Mobile Administration > Salesforce Mobile > Users and Devices, and then click a device address in the list view.
• Click
Your Name
> Setup > Manage Users > Users. Click Edit next to a user's name, and then click the device address in the Assigned Mobile Devices related list.
From the Mobile Device page, you can:
• Review device information
•
Adjust the mobile session timeout value
•
Erase the Salesforce data from a user's device
•
Delete a device from a user's record
Below is a description of the fields in alphabetical order that are stored for each mobile device in your organization.
Field
Brand
Carrier
Connected Since
Description
The brand of the mobile device, if available.
The name of the carrier providing service for the mobile device, if available.
The date and time the device established a connection to the mobile server. The device loses a connection when the battery dies or when the session is closed because the server has not received data from the device for a long period of time.
510
Configure Salesforce Mobile Apps
Field
Connection Status
Created By
Data Size
Device Address
Device Model
Is Simulator?
Last Activated
Last Data Received
Last Registration
Last Status Date
Manufacturer
Metadata Size
Modified By
Number of Pending Outgoing Messages
Operating System
Managing Salesforce Mobile Devices
Description
The state of the device connection. Possible values for this field are Connected, Not Connected, and Not Available.
The name of the first user who registered the mobile device and the time and date the registration occurred.
The size of the Salesforce data currently stored on the user's mobile device. The mobile device periodically sends this information to Salesforce, which is helpful when troubleshooting synchronization errors resulting from an
The unique identifier of the user's mobile device.
The model of the mobile device.
A flag indicating whether the device is a simulator or a mobile device. A simulator is a software application that emulates the behavior of a mobile device.
The last time a full data set was downloaded to the mobile device. If a user's data set exceeds the limit defined in the assigned mobile configuration, the device can be registered but not activated.
The last time data was received from the device. This information is helpful for troubleshooting connection issues.
The last time a user registered the mobile device. The registration process creates the device record in Salesforce and associates it with the user who registered it.
The last time the mobile device notified Salesforce that the device is no longer synchronizing data due to an error. The
Last Status Date
field is only visible when an error is present.
The manufacturer of the mobile device.
The size of the Salesforce metadata currently stored on the user's mobile device. Metadata consists of page layout and schema information, and the amount of metadata sent to a device can be very high depending on the size of your organization and the complexity of its setup.
The name of the last user who registered the mobile device and the time and date the registration occurred.
The number of messages queued on the mobile server waiting to be sent to the device.
The type of operating system installed on the mobile device:
Android, BlackBerry, or iPhone.
511
Configure Salesforce Mobile Apps Managing Salesforce Mobile Devices
Field
Operating System Version
Phone Number
Salesforce Mobile Version
Size of Pending Outgoing Messages (Bytes)
Size of Outgoing Messages (Bytes)
Status
Username
Description
The version number of the operating system installed on the mobile device.
The phone number associated with the mobile device.
The version number and build number of the mobile client application installed on the device.
The total data size of the messages queued on the device waiting to be sent to the mobile server. Because the server processes messages almost instantaneously, this value is usually
0.
The total data size of the outbound message queue on the mobile server.
Indicates whether any synchronization errors exist between the device and Salesforce. The
Status
field is only visible when an error is present. The two error statuses are Data Limit
Exceeded and Unknown Error.
The Salesforce username of the user who is associated with the mobile device.
Note: If Salesforce detects the selected device was registered by a user in another organization, an error displays on the device detail page. This can happen when a device was registered to a user in your sandbox organization and then later activated by a user in your production organization. To remove the old device record from your organization,
.
See Also:
Managing Salesforce Mobile Devices
512
Configure Salesforce Mobile Apps Managing Salesforce Mobile Devices
Setting Salesforce Mobile Session Timeout Values
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To set Salesforce Mobile session timeout values:
User Permissions Needed
“Manage Mobile Configurations”
For security reasons, the Salesforce Mobile app is set to lock out users after 10 minutes of inactivity. Administrators can adjust or disable this setting on a device-by-device basis. For example, you might disable the Salesforce Mobile timeout setting if a mobile device's operating system has its own locking mechanism.
To change the Salesforce Mobile session timeout value:
1. Navigate to one of these pages:
• To deal with multiple devices at the same time, click
Your Name
> Setup > Mobile Administration > Salesforce
Mobile > Users and Devices. In the list view on the Mobile Users and Devices page, select the desired devices.
• To deal with a specific device, click Your Name > Setup > Manage Users > Users. Click a user's name, then click the device address in the Assigned Mobile Devices related list to see the Mobile Device page.
2. Click Set Mobile Session Timeout.
3. Choose the new timeout value in minutes. You can also choose Never Expire if users shouldn’t be locked out of the app.
4. Click Save.
Salesforce attempts to send a message containing the new session timeout setting to the selected mobile devices.
5. A confirmation page
summarizes the results for each mobile device you selected.
Mobile Session Timeout Results
After Salesforce sends the new session timeout session to the selected mobile devices, a results page provides information about the status of each message. The table below describes the three possible outcomes:
Result
Message successfully queued
Unable to send message
Description
The Salesforce Mobile server has sent the message to the device. Salesforce can’t detect if the message was received by the device.
A temporary communication problem between Salesforce and the Salesforce Mobile server prevented the message from being sent. Try again later.
513
Configure Salesforce Mobile Apps
Result
User has no mobile device
Managing Salesforce Mobile Devices
Description
The selected mobile user never registered a device, so therefore the message could not be sent.
See Also:
Managing Salesforce Mobile Devices
Erasing Data in Salesforce Mobile
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
User Permissions Needed
To delete the Salesforce data on a device running Salesforce
Mobile:
“Manage Mobile Configurations”
When a user accesses the Salesforce Mobile app, the user’s mobile device contains both the mobile app and a set of the user's
Salesforce data. An administrator can remove the data from a device without uninstalling the mobile app. This is an effective security tool when a user misplaces his or her device. You also must erase a device's data if you plan to give it to another user.
To erase the Salesforce data on one or more mobile devices:
1. Navigate to one of these pages:
• To deal with multiple devices at the same time, click Your Name > Setup > Mobile Administration > Salesforce
Mobile > Users and Devices. In the list view on the Mobile Users and Devices page, select the desired devices.
• To deal with a specific device, click Your Name > Setup > Manage Users > Users. Click a user's name, then click the device address in the Assigned Mobile Devices related list to see the Mobile Device page.
2. Click Erase Data, then click OK.
Salesforce attempts to send a message to the mobile devices to erase the data.
Erase Data Results
After Salesforce sends the message to the mobile devices to erase data, a results page provides information about the status of each message. The table below describes the three possible outcomes:
514
Configure Salesforce Mobile Apps
Result
Message successfully queued
Unable to send message
User has no mobile device
Managing Salesforce Mobile Devices
Description
The Salesforce Mobile server has sent the message to the device. Salesforce can’t detect if the message was received by the device.
A temporary communication problem between Salesforce and the Salesforce Mobile server prevented the message from being sent. Try again later.
The selected mobile user never registered a device, so therefore the message could not be sent.
See Also:
Managing Salesforce Mobile Devices
Managing Salesforce Mobile Devices
Deleting Mobile Devices
Free version available in: All editions except Database.com
Full version available in: Unlimited and Developer Editions, and for an additional cost in: Professional and Enterprise
Editions
To view mobile devices and users:
To delete mobile devices:
User Permissions Needed
“View Setup and Configuration”
“Manage Mobile Configurations”
There are two instances when you would delete a mobile device from a user's record:
• Your organization's mobile settings permanently link mobile users to their devices, and you need to assign a device to a different user. If you did not enable this setting, Salesforce automatically associates a device record with the mobile user who most recently activated the device, so it is unnecessary to delete a device to assign it to another user.
• You want to move a device from your sandbox organization to your production organization.
To delete a mobile device:
1. Navigate to one of these pages:
• To deal with multiple devices at the same time, click Your Name > Setup > Mobile Administration > Salesforce
Mobile > Users and Devices. In the list view on the Mobile Users and Devices page, select the desired devices.
• To deal with a specific device, click
Your Name
> Setup > Manage Users > Users. Click a user's name, then click the device address in the Assigned Mobile Devices related list to see the Mobile Device page.
515
Install Packages and Manage Apps Installed Packages
2. On the Mobile Devices and Users page, select one or more devices, then click Delete Device. On the Mobile Device page, click Delete.
3. Click OK.
Salesforce attempts to delete the selected device(s).
4. A confirmation page
summarizes the results for each mobile device you selected.
Delete Device Results
After Salesforce sends the message to the mobile server to delete the devices, a results page provides information about the status of each device. The table below describes the three possible outcomes:
Result
Device deleted.
Device cannot be deleted at this time. Please try again later.
User has no mobile device.
Description
Salesforce removed the device record from your organization.
A temporary communication problem between Salesforce and the mobile server prevented the device from being deleted.
Try again later.
The selected mobile user never registered a device, so therefore the message could not be sent.
See Also:
Managing Salesforce Mobile Devices
Erasing Data in Salesforce Mobile
I
NSTALL
P
ACKAGES AND
M
ANAGE
A
PPS
Installed Packages
You can install packages into your Salesforce organization, and then configure and manage them by clicking
Your Name
>
Setup > Installed Packages.
516
Install Packages and Manage Apps Installed Packages
Installing a Package
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To install packages:
User Permissions Needed
“Download AppExchange Packages”
If you received an installation link, click the link and skip to step 4 below. Otherwise follow this procedure from the beginning.
Note: Only one person in your organization can install or upload a package at a time.
1. Click the AppExchange link in your organization or go directly to www.appexchange.com
.
2. Browse the AppExchange site to find the application you want to install.
3. Click Get It Now from the application information page.
Note: If the listing does not have a Get It Now option, contact the publisher for more information.
4. Enter your username and password, read the user terms, select the checkbox, and click Continue.
Note: If you are installing into a sandbox, replace the “www.salesforce.com” portion of the installation link with
“test.salesforce.com”. Note that this package is removed from your sandbox organization whenever you create a new sandbox copy.
5. If the package is password protected, enter the password you received from the publisher.
6. Review the package items and click Continue.
Note: Some package items, such as validation rules, record types, or custom settings may not display in the
Package Item list but are included in the package and installed with the other items. If there are no items in the
Package Items list, the package may contain only minor changes not recorded.
7. If it is a managed package, review the remote access applications that are listed to ensure they are acceptable, and click
Next to continue or Cancel to cancel package installation.
Note: Every remote access application represents a trusted application that is granted access to a user's Salesforce data after the user and the application have been verified.
8. If the installing package contains a remote site setting, you need to approve access to websites outside of Salesforce. The dialog box lists all the websites that the package communicates with. It is highly recommended that a website uses SSL
(secure sockets layer) when transmitting data. After making sure that the websites are safe, check Yes, grant access to these
third-party websites and click Continue, or click Cancel to cancel installing the package.
Warning: By installing remote site settings, you are allowing the package to transmit data to and from a third party website outside the Salesforce service. Contact the publisher before using the package to understand what
517
Install Packages and Manage Apps Installed Packages data is transmitted and how it's used. If you have an internal security contact, ask them to review the application and understand its impact before use.
9. Review the API access that package components have been granted to ensure they are acceptable.
10. When installing unmanaged packages, you can select
Resolve Naming Conflicts Automatically
. When this is selected, Salesforce changes the name of the component in the package being installed.
11. In Enterprise, Unlimited, and Developer Editions, choose a security option, and click Next:
Grant access to admins only
Specifies the following settings on the installing administrator’s profile and any profile with the "Customize
Application" permission:
• Object permissions—“Read,” “Create,” “Edit,” “Delete,” “View All,” and “Modify All” are all enabled
• Field-level security—Set to visible and editable for all fields
• Apex classes—Enabled
• Visualforce pages—Enabled
• App settings—Enabled
• Tab settings—Determined by the package creator
• Page layout settings—Determined by the package creator
• Record Type settings—Determined by the package creator
After installation, if you have Enterprise, Unlimited, or Developer Edition, you can set the appropriate user and object permissions on custom profiles as needed.
Grant access to all users
Specifies the following settings on all internal custom profiles:
• Object permissions—“Read,” “Create,” “Edit,” “Delete,” “View All,” and “Modify All” are all enabled
• Field-level security—Set to visible and editable for all fields
• Apex classes—Enabled
• Visualforce pages—Enabled
• App settings—Enabled
• Tab settings—Determined by the package creator
• Page layout settings—Determined by the package creator
• Record Type settings—Determined by the package creator
Note: The Customer Portal User, Customer Portal Manager, High Volume Customer Portal, Authenticated
Website, Partner User, and standard profiles receive no access.
Select security settings
Allows you to choose the usage access for all existing custom profiles in your organization. You can set each profile to have full access or no access for the new package and all its components.
Note:
• Depending on the type of install, you might not see this step. For example, in Group and Professional Editions, or if the package does not contain a custom object, Salesforce skips this step and the next, giving all users full access.
518
Install Packages and Manage Apps Installed Packages
• Permission sets aren't included in the security options. If your package includes permission sets, assign them after installation.
12. In Enterprise, Unlimited, and Developer Editions, if you chose Select security settings, select the level of access to give users in each profile and click Next. Standard options are:
• Full Access—Specifies the following settings for each profile:
◊ Object permissions—“Read,” “Create,” “Edit,” “Delete,” “View All,” and “Modify All” are all enabled
◊ Field-level security—Set to visible and editable for all fields
◊ Apex classes—Enabled
◊ Visualforce pages—Enabled
◊ App settings—Enabled
◊ Tab settings—Determined by the package creator
◊ Page layout settings—Determined by the package creator
◊ Record Type settings—Determined by the package creator
• No Access—Specifies the same settings as Full Access, except all object permissions are disabled.
You might see other options if the publisher has included settings for custom profiles. You can incorporate the settings of the publisher’s custom profiles into your profiles without affecting your existing settings. Choose the name of the profile settings in the drop-down list next to the profile you want them applied to. The current settings in that profile remain intact.
Alternatively, click Set All next to an access level to give this setting to all user profiles.
13. Click Install. If your installation fails, see Why did my install or upgrade fail?
on page 534.
Note: During installation, Salesforce checks and verifies any dependencies. An installer’s organization must meet all dependency requirements listed on the Show Dependencies page or else the installation will fail. For example, the installer's organization must have divisions enabled to install a package that references divisions.
Note: When you install a component that contains Apex, all unit tests for your organization are run, including the unit tests contained in the new package. If a unit test relies on a component that is initially installed as inactive, such as a workflow rule, this unit test may fail. You can select to install regardless of unit test failures.
14. Click OK.
15. Configure components in the package.
16. If the package includes permission sets, assign the included permission sets to your users who need them. In managed packages, you can't make changes to permission sets that are included in the package, but subsequent upgrades happen automatically. If you clone a permission set that comes with a managed package or create your own, you can make changes to the permission set, but subsequent upgrades won't affect it.
17. If you are reinstalling a package and want to re-import the package data using the export file you received after uninstalling,
see Importing Package Data on page 527.
519
Install Packages and Manage Apps Installed Packages
18. If you installed a managed package, click Manage Licenses, to assign licenses to users.
See Also:
Installation Guide: Installing Apps from Force.com AppExchange
Configuring Installed Packages
Available in: Professional, Enterprise, Unlimited, and Developer Editions
To install packages:
To configure installed packages:
User Permissions Needed
“Download AppExchange Packages”
“Customize Application”
Before making the package available to your users, make any necessary changes for your implementation. Depending on the contents of the package, you might need to customize the following items:
Configure Option
If the publisher included a link to an external website with information about configuration, AppExchange Downloads page displays a Configure option next to the package when you click Your Name > Setup > Installed Packages. Click
Configure to view the publisher's suggested configurations.
Custom Fields and Custom Links
Add any necessary custom fields or links to the new custom objects.
Custom Object
Enable tracking on objects that aren't in this package, but that have fields that are tracked in Chatter. For example, if you want to track a custom field on Account, you must make sure the Account standard object is enabled for tracking.
Custom Report Types
If the Report Type Name of a custom report type matches one used within your organization, change the Report
Type Name
after you install the package to avoid any confusion between the two report types.
Dashboard Running User
The
Running User
for any dashboards are set to the user installing the package. You can edit the properties of the dashboard and change the Running User to a user that has the security settings you want applied to the dashboard.
Folders
When apps contain documents, email templates, reports, or dashboards, Salesforce creates new folders in the installer’s organization using the publisher’s folder names. Make sure these folder names are unique in your organization.
All users can see new folders. Configure folder settings before you deploy if you want them to have limited visibility.
520
Install Packages and Manage Apps Installed Packages
Home Page Layouts
Custom home page layouts included in the package are not assigned to any users. To make them available to your users, assign them to the appropriate profiles.
List Views
List views included in apps are visible to all users. Change the visibility of these list views if necessary.
Page Layouts
All users are assigned the default page layout for any custom objects included in the package. Administrators of Enterprise,
Unlimited, and Developer Edition organizations can configure the page layout for the appropriate users.
If a custom object in the package includes any relationships to standard objects, add them as related lists on the appropriate page layouts.
If the package includes any custom links, add them to the appropriate page layouts.
If your organization has advanced currency management enabled, currency roll-up summary fields are invalid if they are on accounts and summarizing opportunity values, or on opportunities and summarizing custom object values. Remove these fields from any page layouts.
Permission Sets
Assign permission sets included in a package to the users who need access to the package.
You can't edit permission sets that are included in a managed package. If you clone a permission set that comes with the package or create your own, you can make changes to the permission set, but subsequent upgrades won't affect it.
Translation Workbench
Translated values for installed package components are also installed for any language that the developer has included.
Any package components the developer has customized within setup, such as a custom field or record type, display in the installer’s setup pages in the developer’s language (the language used when defining these components). Users in the installer’s organization automatically see translated values if their personal language is included in the package. Additionally, installers can activate additional languages as long as the Translation Workbench is enabled.
Workflow Alerts
If the recipient of a workflow alert is a user, Salesforce replaces that user with the user installing the package. You can change the recipients of any installed workflow alerts.
Workflow Field Updates
If a field update is designed to change a record owner field to a specific user, Salesforce replaces that user with the user installing the package. You can change the field value of any installed field updates.
Workflow Outbound Messages
Salesforce replaces the user in the
User to send as
field of an outbound message with the user installing the package.
You can change this value after installation.
Workflow Rules
Workflow rules are installed without any time-based triggers that the developer might have created. Set up time-based triggers as necessary.
521
Install Packages and Manage Apps Uninstalling a Package
Workflow Tasks
Salesforce replaces the user in the
Assigned To
field with the user installing the package. You can change this value after installation.
Make any more customizations that are necessary for your implementation.
Note: Anything you add to a custom app after installation will be removed with the custom app if you ever uninstall it.
See Also:
Uninstalling a Package
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To uninstall packages:
User Permissions Needed
“Download AppExchange Packages”
You can remove any installed package, including all of its components and all data in the package. Additionally, any custom fields, links, or anything else you added to the custom app after installation are also removed.
To remove a package:
1. Click
Your Name
> Setup > Installed Packages.
2. Click Uninstall next to the package that you want to remove.
3. Select
Yes, I want to uninstall...
and click Uninstall.
4. After an uninstall, Salesforce automatically creates an export file containing the package data, as well as any associated notes and attachments. When the uninstall is complete, Salesforce sends an email containing a link to the export file to the user performing the uninstall. The export file and related notes and attachments are listed below the list of installed packages. We recommend storing the file elsewhere because it is only available for a limited period of time after the uninstall completes.
page 527.
Notes on Uninstalling Packages
• If you are uninstalling a package that includes a custom object, all components on that custom object are also deleted. This includes custom fields, validation rules, s-controls, custom buttons and links, as well as workflow rules and approval processes.
• You cannot uninstall a package whenever any component in the package is referenced by a component that will not get included in the uninstall. For example:
522
Install Packages and Manage Apps Managing Package Installations
◊ When an installed package includes any component on a standard object that another component references, Salesforce prevents you from uninstalling the package. This means that you can install a package that includes a custom user field and build a workflow rule that gets triggered when the value of that field is a specific value. Uninstalling the package would prevent your workflow from working.
◊ When you have installed two unrelated packages that each include a custom object and one custom object component references a component in the other, Salesforce prevents you from uninstalling the package. This means that you can install an expense report app that includes a custom user field and create a validation rule on another installed custom object that references that custom user field. However, uninstalling the expense report app prevents the validation rule from working.
◊ When an installed folder contains components you added after installation, Salesforce prevents you from uninstalling the package.
◊ When an installed letterhead is used for an email template you added after installation, Salesforce prevents you from uninstalling the package.
• Uninstall export files contain custom app data for your package, excluding some components, such as documents and formula field values.
Managing Package Installations
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To uninstall packages:
To assign licenses for a managed package:
To download or delete the export file for an uninstalled package:
“Download AppExchange Packages”
“Manage Package Licenses”
“Download AppExchange Packages”
View a list of the packages you installed from AppExchange and data export files from uninstalled packages by clicking Your
Name
> Setup > Installed Packages. These packages can be either managed or unmanaged.
Note: Salesforce only lists license information for managed packages. For unmanaged packages, the license-related fields, such as Allowed Licenses, Used Licenses, and Expiration Date, will display the value “N/A.”
Using this list, you can:
• Click Uninstall to remove the package and all its components from your Salesforce organization.
• Click Manage Licenses to assign available licenses to users in your organization. This is only available for licensed managed packages.
Note: If you purchased a site license or if the managed package is not licensed, Salesforce automatically assigns licenses to all your users and the ability to manage licenses is not available. Your users can use the package as long as they have the appropriate permissions.
• Click Configure if the publisher has included a link to an external website with information about configuring the package.
• Click the package name to view details about this package.
523
Install Packages and Manage Apps Managing Package Installations
• View the publisher of the package.
• View the status of the licenses for this package. Available values include:
◊ Trial
◊ Active
◊ Suspended
◊ Expired
◊ Free
This field is only displayed if the package is managed and licensed.
• Track the number of licenses available ( Allowed Licenses ) and the number of licenses that are assigned to users ( Used
Licenses
).
• View the date your licenses for this package are scheduled to expire.
• View the date your licenses were installed.
Note: If you have not installed a licensed managed package, the
Publisher
,
Status
,
Allowed Licenses
,
Used
Licenses , and Expiration Date fields do not appear.
After an uninstall, Salesforce automatically creates an export file containing the package data, as well as any associated notes and attachments. When the uninstall is complete, Salesforce sends an email containing a link to the export file to the user performing the uninstall. The export file and related notes and attachments are listed below the list of installed packages. We recommend storing the file elsewhere because it is only available for a limited period of time after the uninstall completes.
Using this list, you can:
• Click Download to open or store the export file.
• Click Del to delete the export file.
See Also:
Displaying Installed Package Details
Displaying Installed Package Details
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To uninstall packages:
To manage user licenses for an AppExchange package:
“Download AppExchange Packages”
“Manage Package Licenses”
The package detail page displays essential details about the package you installed from AppExchange. To access the package detail page, click Your Name > Setup > Installed Packages, then click the name of the package you want to view.
From this page, you can:
524
Install Packages and Manage Apps Managing Package Installations
• Click Uninstall to remove the package and all its components from your Salesforce organization.
• Click Manage Licenses to assign available licenses to users in your organization. This is only available for licensed managed packages.
Note: If you purchased a site license or if the managed package is not licensed, Salesforce automatically assigns licenses to all your users and the ability to manage licenses is not available. Your users can use the package as long as they have the appropriate permissions.
• Optionally, click View Dependencies and review a list of components that rely on other components, permissions, or preferences within the package.
Viewing Installed Packages
The installed package page lists the following package attributes (in alphabetical order):
Attribute
Action
Description
Can be one of two options:
• Uninstall
• Manage Licenses
Allowed Licenses
Description
Installed Date
Expiration Date
Namespace
Package Name
Publisher
Remote Access
Status
The total number of licenses you purchased for this package.
The value is “Unlimited” if you have a site license for this package. This field is only displayed if the package is managed and licensed.
A detailed description of the package.
The date of the package installation.
The date that this license expires, based on your terms and conditions. The expiration date is “Does Not Expire” if the package will never expire.This field is only displayed if the package is managed and licensed.
The one to 15-character alphanumeric identifier that distinguishes a package and its contents from packages of other developers on AppExchange.
The name of the package, given by the publisher.
The publisher of an AppExchange listing is the Salesforce user or organization that published the listing. This field is only displayed if the package is managed and licensed.
A list of the remote access applications that can have access to a user's Salesforce data after the user and the application have been verified.
The state of a package. Available values include:
• Trial
• Active
• Suspended
• Expired
• Free
525
Install Packages and Manage Apps Managing Package Installations
Attribute
Used Licenses
Version Name
Description
This field is only displayed if the package is managed and licensed.
The total number of licenses that are already assigned to users.
This field is only displayed if the package is managed and licensed.
The version name for this package version. The version name is the marketing name for a specific release of a package. It is more descriptive than the
Version Number
.
Viewing Installed Package Details
The installed package detail page lists the following package attributes (in alphabetical order):
Attribute
API Access
Description
First Installed Version Number
Installed By
Modified By
Namespace
Package Name
Package Type
Publisher
Version Name
Description
The type of access that the API and dynamic Apex code that package components have. The default setting is Unrestricted, which means that all package components that access the API have the same access as the user who is logged in. Click Enable
Restrictions or Disable Restrictions to change the API and dynamic Apex access permissions for a package.
A detailed description of the package.
The first installed version of the package in your organization.
This field is only displayed for managed packages. You can reference this version and any subsequent package versions that you have installed. If you ever report an issue with a managed package, you should include the version number in this field when communicating with the publisher.
The name of the user that installed this package in your organization.
The name of the last user to modify this package, including the date and time.
The one to 15-character alphanumeric identifier that distinguishes a package and its contents from packages of other developers on AppExchange.
The name of the package, given by the publisher.
Indicates whether this is a managed or unmanaged package.
The publisher of an AppExchange listing is the Salesforce user or organization that published the listing. This field is only displayed if the package is managed and licensed.
The version name for this package version. The version name is the marketing name for a specific release of a package. It is more descriptive than the Version Number .
526
Install Packages and Manage Apps Managing Package Installations
Attribute
Version Number
Description
The version number for the latest installed package version.
The format is majorNumber.minorNumber.patchNumber
, such as 2.1.3. The version number represents a release of a package. The
Version Name
is a more descriptive name for the release. Note that the patchNumber is generated only when you create a patch. If there is no patchNumber
, it is assumed to be zero (0).
You can also see a list of the components included in an installed package. The following component information is displayed
(in alphabetical order):
Attribute
Name
Parent Object
Type
Description
Displays the name of the component.
Displays the name of the parent object a component is associated with. For example, a custom object is the parent of a custom field.
Displays the type of the component.
See Also:
Managing Package Installations
Importing Package Data
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To import Force.com AppExchange package data: The permissions required to use the import tool you choose, such as the import wizard or Data Loader.
When you uninstall an AppExchange package, Salesforce automatically creates an export file containing the package data as well as any associated notes and attachments. If you choose to install the package again, you can import this data.
To import your AppExchange package data, use one of the following tools that is available for your Edition:
• For Group Edition, use the appropriate import wizard.
• For Professional Edition, use the appropriate import wizard or any compatible salesforce.com ISV Partner integration tool.
527
Install Packages and Manage Apps Managing Licenses for Installed Packages
• For Enterprise, Developer, and Unlimited Edition, use the Data Loader.
Notes on Importing AppExchange Package Data
• Salesforce converts date fields into date/time fields upon export. Convert the appropriate fields into date fields before you import.
• Salesforce exports all date/time fields in Greenwich Mean Time (GMT). Before importing these fields, convert them to the appropriate time zone.
• The value of auto number fields may be different when you import. To retain the old values, create a new custom auto number field on a custom object before importing the data.
• Salesforce updates system fields such as Created Date and Last Modified Date when you import. To retain the old values for these fields, contact salesforce.com support.
• Relationships are not included in the export file. Recreate any master-detail or lookup relationships after importing your data.
• Record type IDs are exported but not the record type name.
• Field history is not exported.
• Recreate any customizations that you made to the package after installation.
See Also:
Displaying Installed Package Details
Managing Package Installations
Managing Licenses for Installed Packages
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To manage licenses for a AppExchange package: “Manage Package Licenses”
When you install a licensed managed package in your organization from AppExchange, you purchase a certain number of licenses from the package developer or publisher. You can assign each license to a user within your organization. If you assign all available licenses, but would like to grant licenses to additional users, you can reassign a license or purchase more. To get more licenses, contact the publisher of the managed package.
Note: If you purchased a site license or if the managed package is not licensed, Salesforce automatically assigns licenses to all your users and the ability to manage licenses is not available. Your users can use the package as long as they have the appropriate permissions.
1. Click
Your Name
> Setup > Installed Packages.
2. Click Manage Licenses next to the package.
Note: To assign licenses for a package, you must have access to the package and at least one available license.
528
Install Packages and Manage Apps Managing Licenses for Installed Packages
• To assign licenses to more users, click Add Users.
• To remove a license from a user, click Remove next to the user's name. To remove licenses from multiple users, click
Remove Multiple Users.
• Click any column heading to sort the users in ascending order using the data in that column. Click the heading again to sort in descending order.
• If available, select fewer or more to view a shorter or longer display list.
See Also:
Assigning Licenses for Managed Packages
Assigning Licenses for Installed Packages
Removing Licenses for Installed Packages
Responding to License Manager Requests
Assigning Licenses for Managed Packages
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To edit users:
User Permissions Needed
To manage licenses for an AppExchange package:
“Manage Users”
“Manage Package Licenses”
When you install a licensed managed package in your organization from AppExchange, you purchase a certain number of licenses from the package developer or publisher. You can assign each license to a user within your organization. If you assign all available licenses, but would like to grant licenses to additional users, you can reassign a license or purchase more. To get more licenses, contact the publisher of the managed package.
The Managed Packages related list on the user detail page lists all managed packages that user is assigned. Assigning a license for a managed package makes the package available to the user within Salesforce.
Unmanaged packages will not appear on this list, as you cannot assign licenses for them.
To assign a user to a license for one of the available managed packages:
1. Click
Your Name
> Setup > Manage Users > Users.
2. Click Assign Licenses from the Managed Packages list.
3. Select the package you want to assign to the user. All available managed packages are listed in the Unassigned Packages list. After selecting a package, Salesforce automatically moves it to the Selected Packages list.
The Unassigned Packages list displays all packages that this user could access if assigned a license. Packages will not appear on this list if they are unmanaged, uninstalled, in use, or not available.
• Click a letter to view the packages that begin with that letter or click All to display all available managed packages.
• Click select shown to select all packages displayed in the Unassigned Packages list on the current page, adding them to the Selected Packages list below.
529
Install Packages and Manage Apps Managing Licenses for Installed Packages
• Click deselect shown or deselect all to move packages from the Selected Packages area to the Unassigned Packages area.
4. Click Add.
To revoke a license from this user, click the
Remove
link next to the appropriate package name.
See Also:
Managing Licenses for Installed Packages
Assigning Licenses for Installed Packages
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To manage licenses for an AppExchange app:
User Permissions Needed
“Manage Package Licenses”
To assign licenses to Force.com AppExchange users:
Note: If you purchased a site license or if the managed package is not licensed, Salesforce automatically assigns licenses to all your users and the ability to manage licenses is not available. Your users can use the package as long as they have the appropriate permissions.
1. Click Your Name > Setup > Installed Packages to find the installed package that has available licenses.
2. Click the Manage Licenses link next to the package name.
3. Click Add Users.
4. Choose a view from the drop-down list, or click Create New View to build a new custom view.
5. Click a letter to filter the users with a last name that corresponds with that letter or click All to display all users who match the criteria of the current view.
6. Select users.
• To select individual users, use the checkboxes. Selected users are listed in the Selected list. When the list includes all users to which you want to assign licenses, click Add.
• To select all users for the current view, click Add All Users then click OK.
Note: You can also add a single user from the user's detail page.
See Also:
Managing Licenses for Installed Packages
530
Install Packages and Manage Apps Managing Licenses for Installed Packages
Removing Licenses for Installed Packages
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
User Permissions Needed
To manage licenses for an AppExchange package: “Manage Package Licenses”
To remove licenses for an AppExchange package from multiple users:
1. Click Your Name > Setup > Installed Packages.
2. Click Manage Licenses next to the package name.
3. Click Remove Multiple Users.
4. To show a filtered list of items, select a predefined list from the
View
drop-down list, or click Create New View to define your own custom views.
5. Click a letter to filter the users with a last name that corresponds with that letter or click All to display all users who match the criteria of the current view.
6. Select users.
• To select individual users, use the checkboxes. Selected users appear in the Selected for Removal list. When the list includes all users for which you want to remove licenses, click Remove.
• To select all users in the current view, click Remove All Users, then click OK.
You can also remove licenses for an AppExchange package from a single user using the following options:
1. Click
Your Name
> Setup > Manage Users > Users and click Remove next to the package in the managed packages list.
2. Click Your Name > Setup > Installed Packages, then click Manage Licenses next to the package name, and click Remove next to the user.
See Also:
Managing Licenses for Installed Packages
531
Install Packages and Manage Apps Managing Licenses for Installed Packages
Responding to License Manager Requests
Available in: Developer Edition
Package uploads and installs are available in Group, Professional, Enterprise, Unlimited, and Developer Editions
To respond to registration requests:
User Permissions Needed
“Customize Application”
A license manager is a Salesforce organization that tracks all Salesforce subscribers installing a particular AppExchange package.
Salesforce administrators can choose to designate another organization as the license manager for one of their packages. The license manager does not need to be the same organization as the one from which the package is managed. To choose another organization as the license manager, all you need is an email address (not a Salesforce username). If a Salesforce administrator selects to have a third-party license manager and enters your email address, you will receive a license management request in email.
To respond to a registration request:
1. Click the link in the license management request email. This displays the registration request in the requestor's Developer
Edition organization.
2. Click Accept to complete the registration process. Alternatively, click Reject to decline the request and close the browser; this prevents you from using the link again.
Note: If you accept this request, you authorize Salesforce to automatically create records in your Salesforce organization to track information about this package. Choosing a license manager organization is permanent and cannot be changed.
3. Enter the username and password for the Salesforce organization you want to use to manage licenses for this package. A license manager can be any Salesforce organization that has installed the free License Management Application (LMA) from Force.com AppExchange.
4. Click Confirm.
See Also:
Managing Licenses for Installed Packages
532
Install Packages and Manage Apps Upgrading Packages
Upgrading Packages
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
To upload packages:
To install and uninstall packages:
User Permissions Needed
“Upload AppExchange Packages”
“Download AppExchange Packages”
Salesforce supports upgrades for managed packages only. Publishers can publish an upgrade for a managed package and notify installers that the new version is available. Installers of a managed package can then install the upgrade as follows:
1. Before you install an upgrade, determine if the app you installed was from a managed package. Look for the Managed
- Installed icon on the detail pages for each component and on the list of packages installed.
If the app you installed is not from a managed package, upgrades for it are not available.
2. Then, install the upgrade in the same way you would install any other package from Force.com AppExchange directory.
If the publisher provided a link to the new version, follow the link to the package posting and install it in your organization.
The first page of the install wizard lists the current version you have installed, the version you are about to install, and a list of additional components included in the new version.
Notes on Upgrading Managed Packages
Consider the following when upgrading a managed package:
• All existing custom objects that were previously deployed will still be deployed. Salesforce prompts you to deploy any new custom objects or previously undeployed custom objects.
• Profile settings are editable but not upgradeable. After upgrading, update the profile settings for any custom objects included in the package. The developer can make changes to profile settings after releasing them, but those changes will not be included in an upgrade. However, changes made to permission sets are included in the upgrade for any permission sets that were included in the package.
• If the developer chooses to add universally required custom fields, the fields will have default values.
• Translation Workbench values for components that are “editable but not upgradeable” are excluded from upgrades.
• If an installed package has
Restricted
API access, upgrades will be successful only if the upgraded version does not contain any s-controls. If s-controls are present in the upgraded version, you must change the currently installed package to Unrestricted API access.
• When you upgrade a package, changes to the API access are ignored even if the developer specified them. This ensures that the administrator installing the upgrade has full control. Installers should carefully examine the changes in package access in each upgrade during installation and note all acceptable changes. Then, because those changes are ignored, the administrator should manually apply any acceptable changes after installing an upgrade.
See Also:
Force.com Quick Reference for Developing Packages
533
Install Packages and Manage Apps Installing Packages FAQ
Installing Packages FAQ
Available in: Group, Professional, Enterprise, Unlimited, and Developer Editions
•
Can I uninstall packages that I installed from AppExchange?
•
•
•
Why did my install or upgrade fail?
•
Can I customize AppExchange packages?
•
Who can use AppExchange packages?
•
How can I upgrade an installed package?
•
How secure are the components I install?
•
What happens to my namespace prefix when I install a package?
•
Can I reinstall an AppExchange package after uninstalling it?
•
Can I uninstall packages that I installed from AppExchange?
Yes. All your installed packages are listed in the Installed Packages page. You can remove any package by clicking the Uninstall link next to the package name.
Why did my uninstall fail?
Salesforce prevents you from uninstalling a package if it causes any remaining components to malfunction.
Who can use AppExchange?
Anyone can browse and test drive AppExchange listings. Salesforce administrators and users with the “Download AppExchange packages” permission can install AppExchange apps. To publish an app on AppExchange, a user must have both “Create
AppExchange packages” and “Upload AppExchange packages” permissions.
Why did my install or upgrade fail?
An install can fail for several reasons:
• The package includes custom objects that will cause your organization to exceed its limit of custom objects.
• The package includes custom tabs that will cause your organization to exceed its limit of custom tabs.
534
Install Packages and Manage Apps Installing Packages FAQ
• The developer of the package has uploaded a more recent version of the package and has deprecated the version associated with this installation URL. Contact the publisher of the package to get the most recent installation URL.
• You are trying to install an extension to a package, and you don't have the base package installed.
• The package requires that certain components are enabled in your organization, or that required features are enabled in your edition.
• The package contains Apex code and you are not authorized to run Apex in your organization.
• The package you are installing has a failing Apex test.
Can I customize AppExchange packages?
Yes, all packages are customizable. However, to ensure compatibility with future versions, some aspects of managed packages can't be changed.
For a list of components that are editable in a managed package, see ISVforce Guide .
Who can use AppExchange packages?
If you use an Enterprise, Unlimited, or Developer Edition organization, you can choose which user profiles have access to the package as part of the installation process. Packages installed in Professional and Group Edition organizations are installed with “Full Access” to all user profiles. However, regardless of Edition, all custom objects are installed in “In Development” mode which hides them from all standard users. Users must have the “Customize Application” permission to view custom objects in “In Development” mode. When you are ready to roll out the package to other users, change the custom object status to “Deployed.”
How can I upgrade an installed package?
Managed packages are completely upgradeable. Before installing a package, contact the publisher to determine if it’s managed.
How secure are the components I install?
Salesforce.com performs periodic security reviews of all publicly listed applications on AppExchange. When installing third party applications with access to data, these applications may have access to other data within the organization where the package was installed. Private listings do not go through a security review and administrators should inspect the application carefully before determining whether it should be installed within their organization.
What happens to my namespace prefix when I install a package?
A namespace prefix is a globally unique identifier that you can request if you plan to create a managed package. All the components from a managed package that you install from another developer contain the developer's namespace prefix in your
535
Install Packages and Manage Apps Connected Apps Overview organization. However, unmanaged packages can also have a namespace prefix if they originated from an organization that contained a managed package. When you install an unmanaged package that contains a namespace prefix, Salesforce replaces the developer's namespace prefix with yours.
Can I reinstall an AppExchange package after uninstalling it?
Yes. You can reinstall a package in the same manner that you installed it.
Why do the custom apps, objects, and tabs in an installed package appear to not affect the limits for my Salesforce Edition?
The custom apps, tabs, and objects contained in a package that is publicly posted on the AppExchange do not count against the limits of your Salesforce Edition.
Connected Apps Overview
A Connected App is an application that integrates with salesforce.com using Identity and Data APIs, such as SOAP API or
REST API. Connected Apps use the standard OAuth 2.0 protocol to authenticate, provide Single Sign-On, and provide tokens for use with Salesforce APIs. In addition to standard OAuth capabilities, Connected Apps allow Administrators explicit control over who may use the application, and various security policies which should be enforced.
Connected Apps begin with a developer defining OAuth metadata about the application, including:
• Basic descriptive and contact information for the Connected App
• The OAuth scopes and callback URL for the Connected App
• Optional IP ranges where the Connected App might be running
• Optional information about mobile policies the Connected App can enforce
In return, the developer is provided an OAuth client Id and client secret, as well as an install URL for the Connected App.
The developer can then provide this URL to a Salesforce administrator.
The administrator can install the Connected App into their organization and use profiles, permission sets, and IP range restrictions to control which users can access the application. Management is done from a detail page for the Connected App.
The administrator can also uninstall the Connected App and install a newer version. When the app is updated, the developer can notify administrators that there is a new version available for the app—their existing installation URL installs the new version.
Installing a Connected App
You install a Connected App with the installation URL provided by the Connected App developer. The easiest way to install the app in your organization is
1. Log into your Salesforce organization.
2. Paste the URL into your browser to start the installation process.
536
Install Packages and Manage Apps Connected Apps Overview
You’ll see a confirmation screen with the app name, its description and logo, and information about how to control user access to the app after it’s installed.
3. Click Install to complete the installation.
If you are logged into more than one Salesforce organization, the installation will select one. Check the username shown in the upper right corner to make sure that the app will be installed in the correct organization. If the username shown isn’t the correct one, click Not you? to log out and stop the installation.
If any version of the Connected App is already installed in your organization you’ll see an error message telling you this.
Uninstall your current version and then install the new version.
After installing a Connected App, you’re shown the detail page for the app. You can edit the app policies from this page.
Managing a Connected App
To view and update properties of a Connected App, find the app under
Your Name
> Setup > Manage Apps > Connected
Apps and click Edit next to it. To view and update details for the app, click the app’s name.
Editing a Connected App
You can edit, uninstall, and review information about a Connected App from this page.
• Click
Edit
to make changes to the app on the Edit page.
App Policies are available for every Connected App.
◊ Permitted Users determines who can run the app.
All Users , the default, allows anyone in the organization to self-authorize the app. This means each user has to approve the app the first time they access it. If you switch from
All Users
to
Admin-approved users
, anyone currently using the app loses their access unless they belong to a permission set you have specified for the app.
Admin-approved users limits access to those users with the permission set or sets specified, but these users don’t need to approve the app before they can access it. You manage permission sets for the app from the Detail page.
◊ IP Restrictions refers to the IP restrictions that the users of this Connected App are subject to. An administrator can choose to either enforce or bypass these restrictions by choosing one of the following options.
Enforce IP Restrictions
– Default. A user running this app is subject to the organization’s IP restrictions, such as IP ranges set in the user’s profile.
Relax IP Restrictions with Second Factor – A user running this app bypasses the organization’s IP restrictions if either of these conditions are true:
The app has IP ranges whitelisted and is using the Web server OAuth authentication flow. Only requests coming from the whitelisted IPs are allowed.
The app has no IP range whitelist, is using the Web server or user-agent OAuth authentication flow, and the user successfully completes Identity Confirmation.
-
Relax IP Restrictions
– A user running this app is not subject to any IP restrictions.
◊ Start URL is used if the Connected App uses single sign-on. In this case, set the URL to the page where the user starts the authentication process. This location will also appear in the application switcher menu.
537
Install Packages and Manage Apps Connected Apps Overview
◊
Require Users to Log In
specifies how frequently a user must log in to maintain the permissions their client application needs from the Connected App. You may specify that they only need to log in the first time they use the app, every time they use it, after a certain period of inactivity, or after a certain period of time.
◊ Mobile Integration settings are available for any Connected App that’s a mobile application.
Session Timeout specifies how much time can pass while the app is idle before the app locks itself and requires the PIN before continuing. Allowable values are none (no locking), 1, 5, 10, and 30 minutes.
-
Pin Length
sets the length of the identification number sent for authentication confirmation. The length can be from 4 to 8 digits, inclusive.
• Uninstall the Connected App by clicking
Uninstall
. Click
OK
to confirm the uninstallation. You have to uninstall an app before you can install a new version.
• If the app has been deleted by its developer,
Remove
is the only action available, and removes the app from the list.
Viewing Connected App Details
The Detail page shows you information about the Connected App, including its version and scopes. You can edit, uninstall, and check usage of the Connected App from here, and also associate profiles and permissions with this app.
• Click
Edit
to make changes to the app on the Edit page.
• Uninstall the Connected App by clicking
Uninstall
. Click
OK
to confirm the uninstallation. You have to uninstall an app before you can install a new version.
• Click View App Usage to see the usage report for Connected Apps in your organization.
• Click Manage Profiles to select the profiles for this app from the Application Profile Assignment page. Select the profiles to have access to the app.
• Click
Manage Permission Sets
to select the permission sets for the profiles for this app from the Application Permission
Set Assignment page. Select the permission sets to have access to the app.
Only the users belonging to at least one of the selected profiles or permission sets can run the app if you have selected
Admin-approved users
for the
Permitted Users
value on the Edit page. If you selected
All Users
instead, profiles and permission sets are ignored.
Upgrading a Connected App
you can install the new one. Use the same Installation URL you used previously to
Uninstalling a Connected App
You remove a Connected App from your organization by uninstalling it. You also must uninstall a Connected App before you can install a new version of the same app. To uninstall a Connected App:
1. Click Your Name > Setup > Manage Apps > Connected Apps for the list of installed apps.
2. Click Uninstall next to the name of the app you wish to remove.
3. Click OK in the confirmation window.
538
Set Up and Maintain Your Salesforce Organization Printable Resources for Administrators
Note: When a Connected App is uninstalled, the access and refresh tokens of all users of the application are removed.
This prevents a user from running the application later, using an existing access token, without explicitly approving the application themselves.
Monitoring Usage for a Connected App
To view information on the usage of any Connected Apps in the organization, click
Your Name
> Setup > Manage Apps >
Connected Apps Usage. For each Connected App in use, the table shows the name of the app, available actions, and the number of active users. Connected Apps that are installed but not yet used don’t appear in the table.
Click the number of active users to see usage information for that Connected App. For each user you’ll see:
• When they first used the app
• The last time they used the app
• The number of times they’ve used the app
You can revoke access for individual users with the Revoke action on the user’s row. Click the Revoke All button at the top of the report to revoke access for everyone using the Connected App.
Printable Resources for Administrators
In addition to online help, salesforce.com publishes printable documentation to help you successfully administer Salesforce.
These documents include tip sheets, user guides, implementation guides, and other resources that describe the features and capabilities of Salesforce. These documents are available as Adobe ® PDF files. Adobe Reader ® is required to open PDF files; to download the latest version of Reader, go to www.adobe.com/products/acrobat/readstep2.html
.
Salesforce Implementations
• Salesforce Enterprise Edition Upgrade Guide
• Setting Up SalesforceGroup Edition
• Salesforce Limits Quick Reference Guide
Security and Data Management
• Security Implementation Guide
• Single Sign-On Implementation Guide
• Tips & Hints for Sharing Data
• Understanding Defer Sharing Calculations
• Managing Data Quality
• Implementing Data.com Clean for Accounts, Contacts, and Leads
• Importing Your Organization’s Accounts and Contacts
• Using Mass Delete to Undo Imports
• Getting Started with Divisions
• Data Loader Guide
• Salesforce Field Reference Guide
• Resolving Data Conflicts and Errors in Force.com Flex Apps
539
Set Up and Maintain Your Salesforce Organization Videos for Salesforce Administrators
Videos for Salesforce Administrators
In addition to online help, salesforce.com creates video demos to help you learn about our features and successfully set up and manage Salesforce.
Data Import
Video Title For End Users For
Administrators
Data Import Overview (1:38 minutes)
If you’re importing data into Salesforce, the Data Import video series is a must-see.
This overview video gives a quick glimpse of what each video covers, and lets you use the clickable list of titles to access the videos you’re interested in.
Preparing Your Data for Import (4:54 minutes)
Learn how to clean up your import files and get Salesforce ready, as well as best practices for keeping data clean once it’s been imported.
Cleaning and Preparing Your Data Using Excel (11:27 minutes)
Excel offers many features and functions to make quick work of getting your data files ready for import. We’ll show you some practical ways to use these features with your import data.
Should I Use Data Loader (6:34 minutes)
Learn Data Loader in depth, so you can decide whether it’s right for your needs.
We compare it to the Import Wizards and also list some other tools you might consider.
Importing Your Data in the Right Order (7:49 minutes)
Learn, step by step, which objects should be imported, and when.
Best Practices for Importing Data (2:47 minutes)
Learn the top pain points experienced by our customers, so you can avoid them entirely! This video could save you hours of frustration. We detail how to delete a bad import, how to back up data before import, and more.
540
Set Up and Maintain Your Salesforce Organization Videos for Salesforce Administrators
Users’ Access to Data
Video Title
Who Sees What: Overview (4:33 minutes)
Learn how you can control who sees what data in your organization.
Who Sees What: Organization Access (4:25 minutes)
Learn how to restrict login through IP ranges and login hours.
Who Sees What: Object Access (5:51 minutes)
Learn how you can grant users access to objects by using profiles.
Who Sees What: Organization-Wide Defaults (6:36 minutes)
Learn how you can restrict access to records owned by other users.
Who Sees What: Record Access via the Role Hierarchy (7:29 minutes)
Learn how you can open up access to records using the role hierarchy.
Who Sees What: Record Access via Sharing Rules (4:27 minutes)
Learn how you can grant access to records using sharing rules.
Who Sees What: Field-level Security (3:58 minutes)
Learn how you can restrict access to specific fields on a profile by profile basis.
Creating a Criteria-Based Sharing Rule (1:13 minutes)
Learn how to create a sharing rule based on a field value in a record.
Managing Users
Video Title For End Users For
Administrators
Removing Users’ Access to Salesforce (3:45 minutes)
Deactivating users in Salesforce removes access to their account data while preserving their historical activity and records. Once you understand why you deactivate users rather than deleting them, learn how to deactivate someone and see what happens to their data.
For End Users For
Administrators
541
Index
A
Access about
revoking
access control in Connected App
Account statement
Accounts converting leads to, mass importing, permissions
mass transferring
mass, converting leads to
ACT!
exporting data
field mapping for import
Activating critical updates
Activities
controlled by parent
enabling Spell Checker
Adding
licenses
Addresses mass updating
Administrative permissions
Apex adding users to monitor monitoring system logs
resetting debug logs viewing debug logs
Apex Data Loader
See Data Loader
Apex REST API
Apex SOAP API
App permissions
AppExchange
downloads packages
who can use
Apps who can use packages
assigning licenses for managing licenses for
revoking licenses for
visibility, setting in permission sets
visibility, setting in profiles
Archiving field history
Articles exporting
Attachments
HTML security
Auditing
fields
authentication providers
Authentication providers
,
Index
Authentication providers (continued)
Janrain
,
Salesforce scope
sites
startURL
B
Background jobs about
sharing recalculation
viewing
Backing up data exporting your data
Billing information
Billing Information
Bulk API uploading attachments
C
Calendar enabling click-and-create event creation enabling drag-and-drop editing enabling Home tab hover links
Campaign members
Campaign Members importing, permissions updating, permissions
Campaigns
import file
import wizards
importing members
Certificates
CA-signed creating
editing
uploading
viewing
Checkout adding licenses
converting a trial
granting access to users
Cleaning data implementation guide
Collapsible sections customizing
Command line
configuration file (Data Loader)
encrypted password (Data Loader)
encryption key (Data Loader)
field mapping file (Data Loader)
importing data (Data Loader) introduction (Data Loader)
prerequisites (Data Loader)
542
Company information editing
fields
language setting
Connected App
access contro in
create details
editing
installing
IP restrictions for
managing
monitoring usage start URL
uninstalling upgrading
Contacts
importing, permissions
Content
setup for Salesforce Mobile
Cookies
Corporate currency
See Currency
Creating groups
mobile configurations
Salesforce Mobile custom views creating a Connected App
Credit card information
Credit Memo
Criteria-based sharing rules
Critical updates
activating overview
Currency
active
conversion rates
corporate currency
importing multiple currencies
inactive
multicurrency
supported
Custom fiscal year about
customizing
customizing labels
setting
templates
Custom objects delegated administration
importing
permissions
Custom Objects importing, permissions
Custom Report Types
mobile
Custom views mobile custom views permission sets
profiles
Customer Portal
organization-wide defaults
Customizable forecasts about fiscal year
Customizing
collapsible sections dashboard settings
quick create
related list hovers related list loading
report headers report settings
search
search results filters
tags
user interface
D
Dashboard Finder enabling
Dashboards
email settings
enable mobile access
enabling Dashboard Finder
Lotus Notes image compatibility
Data mobile
sending to portal users user interface settings
exporting
importing
Data Loader attachments batch files
batch mode
batch mode parameters blank fields, replacing
Bulk API
column mapping
command line interface
command line introduction
command line operations config.properties
configuration file (command line) configuring
configuring batch processes data loader guide
Data Loader not importing special characters data types
date formats
date, wrong
encrypted password (command line) encryption key (command line)
importing data (command line) importing, permissions
field mapping file (command line)
importing, wrong date installed files
installing logging in
overview
password encryption
prerequisites (command line)
Index
543
Data Loader (continued) sample files
settings
Spring Framework
starting batch processes system requirements
third-party licenses troubleshooting
uninstalling
updating fields with blank values uploading
uploading attachments using
when to use wrong date
Data quality
tip sheet
Data Residency Option
set up
Data sets
samples in Salesforce Mobile
Data storage
Data.com Clean implementation guide
Deactivating users
Debug logs
adding users to monitor monitoring
removing users from monitoring
resetting retaining
viewing
Debugging
adding users to monitor monitoring logs
removing users from monitoring
resetting debug logs
viewing logs
Defer Sharing
tip sheet for administrators
Defer sharing calculations
Defining custom fiscal year
Delegated authentication
configuring single sign-on single sign-on
Deleting
import data
licenses
mobile devices
multiple records
sample data
users
Desktop clients setting user access
Devices deleting
Divisions about
default division for users mass transfer of records
tip sheet for administrators
Documentation implementation guides printable
tip sheets user guides
Documents
HTML security
Domain name
getting system performance information
implementation guidelines
rolling out setting up
testing
URL changes
Domains
DRO
E
Editing groups users
editing a Connected App
Salesforce Mobile deployment
Email templates folders
Enable
Mobile Dashboards for iPad app
Salesforce Touch
Enhanced lists
enabling
Enhanced lookups enabling
Enhanced page layout editor enabling
Enhanced profile user interface about apps
enabling
system
Enterprise Edition upgrade guide
Error page
customizing in SAML
Events enabling Spell Checker
Export file backup data
creating for import
Exporting backup data
data for import wizards from ACT!
from GoldMine 4.0
from GoldMine 5.0
from other data sources from Outlook
from Palm Desktop from Salesforce
Extended Mail Merge
activating
delivery options
Index
544
F
FAQ campaign import file
Data Loader
campaign import wizards component security
converting mass leads
customizing packages
Data Loader not importing special characters
de-duplicating data house backup data
import size restrictions
Import wizard, updating
importing campaign members
importing contact and business account data
importing contact and business account records
importing contact data
importing custom objects
importing duplicate leads
importing fields
importing multiple currencies
importing new contacts and business accounts
importing or uploading data
importing solutions from HTML importing with Data Loader
importing, permissions
installed packages and limits personal site
lead import limit
Logging into Data Loader
mass upload
mass-converting leads package install failure
package upgrade failure
permissions needed to import
prepare lead import file
preventing duplicate accounts
preventing duplicate custom objects
preventing duplicate solutions security
reinstalling AppExchange packages replacing fields with blank values
solution import limits supported languages
uninstalling AppExchange packages uninstalling packages
updating fields with blank values updating records, import wizard
Updating, mass records using AppExchange
using AppExchange packages what data can be imported
wrong date imported to Salesforce with Data Loader
Field-level security accessibility
permission sets
profiles
Fields access
accessibility
archiving history
Fields (continued) auditing
company information field-level security
history
mass updating addresses permissions
reference guide roles
sharing model
tracking changes
user
File storage
Floating report headers enabling
Folders
accessibility creating
deleting
documents
email templates permissions
Force.com API usage
Force.com business logic
Force.com Flex tip sheet for users
Force.com most used licenses
Force.com portal roles
Force.com schema usage
Force.com user interface
G
General permissions
Generating security keys
Getting started mass upload
supported languages
GoldMine exporting from GoldMine 4.0
exporting from GoldMine 5.0
Group Edition
tip sheet for administrators
Group membership calculations
Groups
about
creating and editing
member types viewing lists
H
History disabling field tracking fields
Hover details enabling
I
Identity provider about
Index
545
Identity provider (continued) editing
enabling example values
viewing details
Identity providers
error log event log
examples portals
sites
success log
Implementation guides
Implicit sharing
Import queue
Import wizards accessing
Import My Contacts
Import My Organization's Custom Objects
Import My Organization's Person Accounts
Import My Organization's Solutions
Import My Organization’s Accounts and Contacts
Import My Organization’s Leads
Import My Person Accounts
import queue
Importing accounts
accounts for single user campaign import file
campaign import wizards campaign members
,
contact and business account data
contact and business account records
contacts
contacts for multiple users contacts for single user
creating export file data
creating new contacts and business accounts
custom objects
data
Data Loader, wrong date
data preparation
date, wrong
de-duplicating data
duplicate leads
field mapping for ACT!
field mapping for leads
field mapping for organization import
field mapping for other sources
field mapping for Outlook
fields
import queue
importing or uploading data lead import limit
leads
leads for multiple users multiple currencies
overview
package data
permissions
Importing (continued) person accounts
prepare contact data
prepare lead import file
preventing duplicate accounts
preventing duplicate custom objects preventing duplicate solutions
Record owner column size restrictions
solution import limits solutions
solutions from HTML
tip sheet for administrators
undoing an import
using import wizards
wrong date
Inline editing
enabling
permission sets
profiles
installing a Connected App
Invoice
IP addresses trusted whitelist
IP restrictions for Connected App
J
Just-in-time provisioning example SAML assertions
Just-in-Time provisioning portal requirements
requirements
Just-in-Time provisioning errors
K
Key pairs creating
L
Languages setting the organization language
settings
Leads
converting to accounts, mass
creating import file
field mapping for import
importing
importing, permissions
mass transferring
mass, converting to accounts
Licenses adding or subtracting
feature licenses
for managed packages
Platform
Portal
Salesforce users
users
Index
546
Licenses (continued)
Links viewing by type
Visualforce Mobile
Locale
supported
SAML
Logging in as another user
SAML start page
Logging out
Login activation
enabling identity provider failures
history
IP address ranges, restricting restricting
hours, restricting
identity confirmation
identity provider
restricting IP addresses organization-wide service provider
session security
trusted IP addresses
Lookups
enabling auto-completion enabling enhanced lookups
recent items
specifying filter fields
M
Managed packages assigning licenses for
managing a Connected App
Manual sharing
Marketing User assigning
Mass delete tip sheet for administrators
Mass mail
Salesforce Mobile deployment
Mass updating
addresses
Master encryption keys
Mobile
,
usage data reports
Mobile Dashboards for iPad settings
Mobile usage data reports
Modify All permission
Monitoring import queue
monitoring usage of a Connected App
Monthly export
Data
Multicurrency
See Currency
My Domain overview
N
Network access
O
Object permissions permission sets
profiles
Object-level security specifying
Organization profile
See Company information
Organization-wide sharing settings about
specifying for external users
Other data sources exporting data
Outlook
exporting data
field mapping for import
P
Packages configuring installed packages importing data installations
installing packages
licenses
managing licenses for uninstalling packages
upgrading packages
Page layouts assigning
enhanced editor, enabling
Salesforce Mobile
Palm exporting data
Partner Portal organization-wide defaults
Salesforce Mobile access, configuring
Passwords
changing by administrator
changing by user
expiring
expiring all passwords
policies
settings and controls
Permission sets
about
app permissions
apps
assigned users
assigning cloning
creating deleting editing
,
enhanced list views field permissions
licenses
Index
547
Permission sets (continued) list views, creating and editing navigating
object permissions overview page
searching system
system permissions tab settings
user licenses viewing
viewing lists
Permissions
about
administrative
app field
general
Modify All
object
revoking
Salesforce Mobile
searching system
user
View All
Person accounts importing
Personal groups
Personal tags deleting for deactivated users
enabling
Picklists
state and country picklists—beta
Portals organization-wide defaults
Profiles
about
assigned users editing
cloning creating
creating list views deleting
desktop client access
editing, original user interface
enhanced list views
enhanced user interface, about
field permissions field-level security
login hours
,
login IP address ranges object permissions
overview page
page layout assignments
record types searching
tab settings
user permissions viewing
viewing lists
Public groups
Public tags enabling
Q
Quick Create customizing
R
Record owner column creating import files
Record types assigning page layouts for
specifying in profiles
Related lists enabling separate loading
Remote site configuration
Report Builder upgrading
Report timeout warning disabling
Reports
column row
email settings
floating header row
Salesforce Mobile
sending to portal users
timeout warning
upgrading report builder
user interface settings
Request parameters scope
site
startURL
Role hierarchies
about
Roles
assigning to users fields
managing viewing
Rotating master encryption keys
Rules, sharing
See Sharing rules
S
Salesforce Mobile changing timeout values
creating mobile configurations
custom list views
custom report types
dashboards data sets
default mobile configuration
disable access emailing users
enable users
enabling Content
erasing data
global variables
Index
548
Salesforce Mobile (continued) merge fields
mobile configurations mobile devices
object properties overview
partner user access permissions
reports
sample data sets settings
setup tabs
testing mobile configurations tips
users
viewing device detail
Salesforce Touch
settings
Visualforce tabs
SAML
about
authentication providers
,
custom error page
enabling identity provider
example assertions identity provider
Just-in-Time for portals
Just-in-Time provisioning
Just-in-Time provisioning errors
Just-in-Time provisioning requirements
login history login page
logout page prerequisites
service provider single sign-on
start page
validating single sign-on
validation errors
viewing single sign-on
Scheduled jobs about
viewing
scope request parameter
Searching customizing
permission sets
profiles
Security auditing browsers
CAPTCHA certificates
cookies
enabling identity provider field permissions
field-level
field-level security house backup data identity provider
implementation guide
Security (continued) infrastructure
Just-in-Time for portals
Just-in-Time provisioning
Just-in-Time provisioning requirements key pair
login challenge
login IP address ranges login restrictions
manual sharing
master encryption keys network
object permissions object-level
organization-wide sharing settings overview
personal site queues
record-level security
restricting IP addresses organization-wide role hierarchies
service provider session
sharing rules single sign-on
SSL
timeout
token trust
user
user authentication
Security and sharing
managing
Service contracts mass transferring
Service provider about
defining example
viewing details
Service providers enabling
examples
mapping users
portals
prerequisites
sites
Session security
Setup delegating setup tasks
Force.com API usage
Force.com business logic
Force.com most used licenses
Force.com portal roles
Force.com schema usage
Force.com user interface monitoring changes
system overview
Sharing
Apex managed
built-in sharing behavior
Grant data access using hierarchies
Index
549
Sharing (continued) objects
organization-wide defaults
organization-wide sharing settings
overrides
recalculation
rule considerations
rules, See Sharing rules
separate organization-wide defaults settings
tip sheet for administrators
Sharing groups
See Groups
Sharing model
object permissions and
Sharing rules about
account territories account territory
accounts
campaigns
cases
categories
contacts
criteria-based
custom objects
defer sharing calculations deferring calculations
group membership calculations
leads notes
opportunities
Quick Text
sharing rule recalculation
Sharing, manual
See Manual sharing
Sidebar enabling collapsible sidebar hover details
showing custom components
Tags component single sign-on
identity provider values
Single sign-on
authentication providers best practices
debugging
configuring delegated authentication
delegated authentication
example
example SAML assertions
implementation guide
login errors login history
overview
prerequisites
SAML
SAML validation
viewing
Site configuring remote site request parameter
SOAP API
Solution Managers assigning
Solutions
importing
importing, permissions
Spell Checker
enabling
Spring Framework, see Data Loader
start URL in Connected App startURL request parameter
State and country picklists—beta converting data
converting data overview enabling and disabling
overview
scanning data and customizations overview
scanning state and country data and customizations
Storage limits data storage limits file storage limits
System log, see Debug logs
system overview
System permissions
T
Tab Bar Organizer
Tabs enabling
mobile
Salesforce Mobile visibility settings
Tags visibility settings, descriptions
adding to sidebar
customizing
deleting for deactivated users
enabling
Tasks
enabling Spell Checker
Team
See Account team
See Case teams
Territories hierarchies
Time Zone
supported
Time zone setting
Tip sheets
Training history
Transferring
divisions
multiple records
records
Transferring records overview
Trial organizations converting a trial
deleting sample data
overview
starting new trials
trust
Index
550
Twisties enabling collapsible sections
U
Undoing an import
uninstalling a Connected App
Updates activating
critical updates
Updating
blank values
Contacts
Custom Objects
Leads
mass records
Person Accounts
Solutions
Updating records
Import wizard
upgrading a Connected App
User guides
User interface header settings
theme
User licenses
See Licenses
User permissions
User profiles
See Profiles
User roles
See Roles
User setup
changing default division changing passwords
delegated administration
Users fields groups
personal groups public groups
access
Users (continued) adding a single user
adding multiple
assigned to permission sets assigned to profiles
assigning permission sets assigning roles
changing profiles
Customer Portal licenses deactivating
deleting editing
feature licenses
license types managing
object permissions
partner portal licenses
permissions
,
Platform licenses
revoking access
revoking permissions
Salesforce licenses
Salesforce Mobile unlocking
V
Videos
Administration
Security
View All permission
Visualforce
creating mobile tabs
enable for Salesforce Touch
Visualforce Mobile links
W
Weekly export
Data
Workflow monitoring debug logs
Index
551
Lataa
Julkinen linkki päivitetty
Chattisi julkinen linkki on päivitetty. You may view and manage your chat links after registration here.
Dokumentin julkinen linkki
Mainos
