Salesforce – Playbooks Integration User
Why does Playbooks require an Integration User?
Overview
In addition to the Basic Users who use the Playbooks product everyday, Playbooks requires an Integration User (a.k.a. Service User, Access User) be setup to connect the CRM to the Playbooks Account in order to perform many of the administrative and product related API requests between Salesforce and Playbooks. Setting up an Integration User with the correct permissions and field accessibility is important for best application usage.
What is the purpose of an Integration User?
The Integration User account is used to:
- Synchronize data between Playbooks and Salesforce: create and update tasks, update specific Playbooks fields on the lead, contact, account, task, and entity records, and retrieve user names and roles.
- Query CRM for qualifying records of Automation Rules (Robots).
- Retrieve data from Salesforce for Buyer Intelligence services to analyze and to later update records with scores according to Prioritization with AI models.
Create a new Integration User in Salesforce or use an existing user?
The bottom line is the Integration User usually requires greater permissions than a basic end user or even most managers are granted. In those instances it is necessary to utilize a different user with greater permissions.
Some organizations already have an Integration User configured for other vendors (like Marketo) and may be able to use the same account. Other organizations determine it is best to create a new user. I’ve seen many of these organizations create a new user in Salesforce with First Name = XANT, and Last Name = Playbooks. The Salesforce account must be given an email address not assigned to any other Salesforce or Playbooks user. Some organizations will use an existing email address to a distribution group, for example: operations@samplecompany.co.
This basic information (name, email, and in some cases the User ID) is required early in the provisioning/setup process. (See Step 2 – Provision a Playbooks Account)
A question that often comes up, is will this account use up a Salesforce license? Yes, this must be a fully provisioned Salesforce account with API Enabled. That is why some Playbooks customers will use an existing Integration User account, or identify an existing Sys Admin or Manager that meets the minimum permission requirements. As long as the existing Integration User account can be assigned the Playbooks Permission Set (described below) then you should be just fine.
Permissions and Requirements
Because the Integration User is performing synchronization and retrieval tasks listed above it must have a higher level of permissions than a basic user. A list of required field and object permissions can be found in the Playbooks Reporting Fields document. This list will detail the permissions required for both the Integration User and the Basic User.
The best way to implement these permissions is to create a Permission Set for the Integration user and a second Permission Set for the Basic User. Column G of the Playbooks Reporting Fields document details the field permissions for the Integration User and column H details the field permissions for the Basic User.
Note: The Playbooks Reporting Fields document contains details for existing (standard) Salesforce fields as well as custom Playbooks fields. Not all custom Playbooks fields are necessary for all customers. (For example, only customers that purchased the Accelerate package will need to install the Buyer Intelligence Package so they will have the Priority Score fields needed to push scores to.) If the custom field is included in an unmanaged package, the name of the unmanaged package will be indicated in column B.
Additional Salesforce Permissions
- API Enabled: The Integration User (and all Playbooks end users) need to have the API Enabled permission. This allows the users Authenticate to Salesforce using Oauth 2.0 and make other API requests. There are also implied permissions to standard Salesforce fields when this is enabled that Playbooks will need access to. To enable this permission, go to Setup > Manage Users > Profiles > (the assigned profile for the Integration User) > Admin Permissions > check the box for “API Enabled”.
- Password Never Expires. This is highly recommended for the Integration User. As advised above, if a non-user is specified as the Integration User then setting the password to never expire ensures there will never be interruption in service due to the Integration User’s password in Salesforce expiring. To implement this change go to Setup > Manage Users > Profiles > (the assigned profile for the Integration User) > Password Policies > set the “Users password expires in” to Never Expires.
Frequently Asked Questions
Q: Can an existing Service Account / Integration User be used or does a new account need to be created specifically for Playbooks?
A: Yes, if the existing user can be assigned the recommended permission set. If, however there is a conflict then a new user will need to be created.
Q: If I don’t create an Integration User account, what happens?
A: The first user to authorize Playbooks automatically becomes the Integration User. If that account does not have sufficient permissions, your organization may run into issues with anything related to synchronizing data or gathering data for Buyer Intelligence. Also, if the user acting as the Integration User ever leaves the organization and their user account is deactivated, the connection to Playbooks will no longer function. You will need to re-activate that user to restore the integration and then setup a new user with the appropriate permissions, make sure they complete the authorization, and then contact XANT support to help switch the Integration User.
Q: How often do I need to reauthorize the Integration User?
A: Almost never unless a significant change is made to the permissions – or the password changes.
Q: How do I change the Integration User?
A: This article describes how to change the Integration User.
