---
schema_version: "1"
id: 07e2a609d1a0737f42a47391ec0998a93db84643071a57e49dfa9e239d9c93dc
title: Salesforce Data Access in CRM Analytics
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/bi_security_salesforce_object_field_levels.md
canonical_url: https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8b23daeccc5774e0a6972c2d8ed05e345dd6920ce7ef9e3a2e2007f5d3fbc3f5
description: "CRM Analytics requires access to Salesforce data when extracting the data and also when the data is used as part of row-level security. CRM Analytics gains access to Salesforce data based on permissions of two internal CRM Analytics users: Integration User and Security User."
products:
  - CRM Analytics
  - Cross Cloud
release: "264"
---
# Salesforce Data Access in CRM Analytics

CRM Analytics requires access to Salesforce data when extracting the data and also when the data is used as part of row-level security. CRM Analytics gains access to Salesforce data based on permissions of two internal CRM Analytics users: Integration User and Security User.

CRM Analytics uses the permissions of the Integration User to extract data from Salesforce objects and fields when a dataflow job runs. Because the Integration User has View All Data access, consider restricting access to particular objects and fields that contain sensitive data. If the dataflow is configured to extract data from an object or field on which the Integration User does not have permission, the dataflow job fails.

When you query a dataset that has row-level security based on the User object, CRM Analytics uses the permissions of the Security User to access the User object and its fields. The Security User must have at least read permission on each User object field included in a predicate. A predicate is a filter condition that defines row-level security for a dataset. By default, the Security User has read permission on all standard fields of the User object. If the predicate is based on a custom field, then grant the Security User read access on the field. If the Security User does not have read access on all User object fields included in a predicate expression, an error appears when you try to query the dataset using that predicate.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_important.png)

Important Because CRM Analytics requires the Integration User and Security User to access Salesforce data, do not delete either of these users.

- **[Control Access to Salesforce Objects and Fields](https://help.salesforce.com/s/articleView?id=analytics.bi_security_salesforce_object_field_levels_control_access.htm&release=264.0.0&type=5)**  
    CRM Analytics requires access to Salesforce data when extracting the data and also when the data is used as part of row-level security. Configure the permissions of the Integration User on Salesforce objects and fields to control the dataflow’s access to Salesforce data. Configure the permissions of the Security User to enable row-level security based on custom fields of the User object.