--- schema_version: "1" id: 7d414f70dd4ca4b050536ee7bf1a6785e544d21869c16ea4691b5e0940b10ac3 title: Salesforce External Connections collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/bi_integrate_connectors_salesforce_external_settings.md canonical_url: https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_salesforce_external_settings.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 6f8c23304f8500d14e81c62d6a5c82dabba7a35fab63b14b08bf4a97c3d14cea description: Use a Salesforce external connector to sync data from another Salesforce org to CRM Analytics. External connectors require OAuth 2.0 for server to server communication. products: - CRM Analytics - Cross Cloud release: "264" --- # Salesforce External Connections Use a Salesforce external connector to sync data from another Salesforce org to CRM Analytics. External connectors require OAuth 2.0 for server to server communication. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png) Note As of Summer '27, the SOAP API login() call in SOAP API versions 31.0 through 64.0 will no longer be supported and no longer be available. For more information, see [SOAP API login() Call in SOAP API Versions 31.0 Through 64.0 Is Being Retired](https://help.salesforce.com/s/articleView?id=release-notes.rn_api_upcoming_retirement_260rn.htm&release=260&language=en_US). The **Username** and **Password** authentication settings in Salesforce external connectors cease to function after October 27—31, 2026. Until then, data syncs for existing connections still run with warnings in the job logs. After support ends, the data syncs fail. New Salesforce external connectors require OAuth with Client ID and Client Secret for authentication. You must update existing Salesforce external connectors with Username and Password authentication to use OAuth settings. Restricted API access isn’t supported for Salesforce external connectors. Enable the Use Any API Client permission for the user creating the connector. For more information, see [Manage API Access](https://help.salesforce.com/s/articleView?id=xcloud.security_api_access_control_about.htm&type=5&language=en_US). To push data from CRM Analytics to a Salesforce org, use a [Salesforce Output Connection](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_output_salesforce.htm&release=264.0.0&type=5 "Push your prepared dataset data into any Salesforce org from CRM Analytics Salesforce Output connector and Data Prep. With your prepared data back in Salesforce, you can integrate external data, apply the suite of Salesforce automation tools to act on the data, and allow non-CRM Analytics users access to the data through reports and dashboards. External connectors require OAuth 2.0 for server to server communication."). ## Set Up an External Client App for OAuth External client apps (ECA) provide single sign-on (SSO) and use OAuth protocols to authorize external connections. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png) Note It’s recommended to create a separate Salesforce user account that isn’t assigned to a person to set up a connection. A person’s account can be deactivated when the user leaves your organization, which stops any connections created with the account from functioning. 1. To create an ECA for your ‌organization, from the Salesforce Setup page, enter External in the Quick Find box, and then select **External Client App Manager**. 2. Click **New External Client App**. 3. Enter the basic information. 1. Enter the name for the ECA to display in the External Client App Manager. 2. Enter the API name to be used when referring to your app from a program. This field defaults to a version of the app’s name with underscores in place of the spaces. 3. Enter the contact email for Salesforce to use in case we want to contact you or your support team. 4. Select **Local** for the Distribution State. 4. Click **Enable OAuth** to configure the OAuth policy. 5. Enter the app settings. 1. Enter the **Callback URL**. The callback URL is the app URL where you’re embedding the code and the URL can accept the authentication returned from the Salesforce ECA. An example of a callback URL is `https://<3p-domain>/callback.html`. 2. For **OAUTH Scopes**, select **Manage user data via APIS (api)** and **Access Analytics REST API resources (wave\_api)**. If you have other OAuth needs, select other scopes as needed. For more information, see [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US) 6. For Flow Enablement, select **Enable Client Credentials Flow**. This flow allows for server to server interactions. For more information, see [OAuth 2.0 Client Credentials Flow for Server-to-Server Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_client_credentials_flow.htm&language=en_US) 7. For Security, disable **Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows**. 8. Click **Create**. 9. On the Policies tab, click **Edit**. For OAuth Flows and External Client App Enhancements, ensure **Enable Client Credentials Flow** is enabled. Enter a user email for **Run As**. This user must be a valid execution user. 10. On the Settings tab, click **Consumer Key and Secret** to copy and save the values. You need the consumer key value for the Client Id and the consumer secret value for the Client Secret. ## Create the Connection 1. On the Data Manager Connections tab, click **New Connection**. 2. Select **Salesforce External Connector**, and click **Next**. 3. Enter the connector settings. 4. To verify your settings, click **Save & Test**. If the connection fails, CRM Analytics shows possible reasons. All settings require a value, unless otherwise indicated.
Connection Setting Description
Connection Name Required. Use a convention that lets you easily distinguish between different connections.
Developer Name Required. The API name for the connection. This name can’t include spaces. The API name is used in your recipes to reference data extracted through this connection. You can’t change the developer name after you create the connection.
Description Required. The connector description.
Authentication Type Required. The authentication type. Valid values include OAuth.
Username

No longer supported after Winter '27. User name used to connect to external Salesforce org.

Required if the authentication type is Password.
Password

No longer supported after Winter '27. Password for the user specified in Username. Depending on your security settings, append the user’s security token to the end of the password. For information about obtaining a security token, see Reset Your Security Token.

Required if the authentication type is Password.
Client Id

Required. The client ID for your OAuth connection.

This value is the consumer key from your External Client App.
Client Secret

Required. The client secret for your OAuth connection.

This value is the consumer secret from your External Client App.
API Type Required. The API to use. Valid values include SOAP for SOAP API or BULKV2 (default) for Salesforce Bulk API 2.0. Use Salesforce Bulk API 2.0 if you encounter issues with larger data objects timing out with SOAP API.
Service URL

No longer supported after Winter '27. The login URL for the external org. The default value uses the generic Salesforce login URL for your org. For an added layer of security, update this field to use your org’s My Domain login URL. For a production org, use the format:https://<MyDomainName.my .salesforce.com/services/Soap/Identifier/VersionNumber.0

For example: 

https://mycompany.my.salesforce.com/services/Soap/u/54.0
Domain URL Required. The My Domain URL for your external Salesforce org. In the external Salesforce org, go to My Domain in Setup. The URL format must be https://*.salesforce.com
## Filter Data Synced to CRM Analytics Use filters to exclude unnecessary or sensitive data from syncing to CRM Analytics filters. Filters speed up data sync by pulling only the data you need into CRM Analytics. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png) Note If you expect to exclude data in the future, use a recipe filter instead of a data sync filter. 1. From Data Manager, click the **Connections** tab. 2. Select the connection associated with the object to filter. 3. Click the name of the object to filter. 4. Click **Data Sync Filter**. 5. Enter the filter. 6. Click **Save**. For the Salesforce External connector, enter a filter using a SOQL WHERE clause expression as described in the [SOQL and SOSL Reference](https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/sforce_api_calls_soql_select_conditionexpression.htm). For example, `"(FiscalQuarter = 2 OR FiscalQuarter = 3) AND Amount > 1000 AND Amount <= 20000"`. ## Salesforce External Connector Considerations Keep these behaviors in mind when working with the Salesforce External connector. - Connected object names must start with a letter and contain only letters, digits, or underscores. The name can’t end with an underscore. - A field name can contain only alphanumeric characters, dots, underscores, or dashes. If a field name contains other characters, such as spaces or brackets, the sync fails. - The connector can sync up to 100 million rows or 50 GB per object by default, whichever limit is reached first. The limits can be increased to a maximum of 2000 million rows or 1000 GB with a request to Salesforce support. When using the connector, Salesforce Government Cloud org data is protected in transit with advanced encryption and can sync up to 10 million rows or 5 GB for each connected object, whichever limit is reached first. - To improve data sync time, use incremental sync (beta). - The security settings of the user you use to connect with determine the objects and fields available to sync in the external org. - You can sync standard objects available in API versions 34.0 and later. - You can use the API Type BULKV2 only with API version 50.0 and later. - To troubleshoot connectivity issues between Salesforce orgs, review your org IP address restrictions and consider disabling the "Lock sessions to the IP address from which they originated" setting in both orgs. You can also search knowledge articles and known issues for more information. - When importing fields that contain a currency, the imported value isn’t converted. Take the example of an org that records values in British pounds that you’re importing into a local org that records values in US dollars. A value of 10 (GBP) is imported into the local org as a value of 10. #### See Also - [Salesforce External Connector Known Issues and Knowledge Articles](https://sfdc.co/sfeconnsearch) - [Add and Remove Remote Objects and Fields from Data Sync](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_replicate_connection.htm&release=264.0.0&type=5 "Update data sync for connected external data sources to keep up with your changing business by adding objects, removing objects, and managing which fields are synced. Synced data is stored in CRM Analytics as objects that can be used in recipes.") - [Configure Incremental Sync for Salesforce Data](https://help.salesforce.com/s/articleView?id=analytics.bi_extract_data_incrementally_in_replication.htm&release=264.0.0&type=5 "Before you run or schedule data sync, specify whether the sync extracts incremental changes or all records from each Salesforce object. By default, CRM Analytics performs an incremental sync. An incremental sync runs faster because it extracts only the latest changes to the Salesforce object.")