Salesforce Authenticated User Permission Requirements for Archive

Required setup and configuration for an Authenticated User in the Archive managed package.

Note This content relates to Archive. For Salesforce Archive, see Store Data Externally with Salesforce Archive.

In the Salesforce API, the Authenticated User is the user that connects the application to the org. We recommend having a dedicated user as the Authenticated User.

The specific permissions for each user are defined either in the user's profile or via a permission set.

To use the Salesforce System Admin, assign the Salesforce admin profile. Then grant permissions specifically needed for Archive operations.

Note The Salesforce Integration User license isn't compatible with Archive, as it doesn't provide the necessary permission scope.

Basic Permissions

Permission	Permission Type	Purpose
Bulk API	System Permissions	Enables the Authenticated User to permanently delete records and bypass the Recycle Bin during Archive operations. This permission is necessary for managing large datasets and directly purging records without them lingering in the Recycle Bin.
Modify All	System Permissions	Grants a user full control over all records for a specified object. The user can view, edit, delete, and transfer ownership of records, regardless of sharing rules or other restrictions.

Permission

Permission Type

Purpose

Bulk API

System Permissions

Enables the Authenticated User to permanently delete records and bypass the Recycle Bin during Archive operations.

This permission is necessary for managing large datasets and directly purging records without them lingering in the Recycle Bin.

Modify All

System Permissions

Grants a user full control over all records for a specified object. The user can view, edit, delete, and transfer ownership of records, regardless of sharing rules or other restrictions.

In Setup, create a user with the System Admin profile.
Assign the Bulk API permission set to allow Archive to use Hard Delete and bypass the Recycle Bin.

Additional Permissions

To handle ContentDocuments and restore unarchived records correctly, the Authenticated User requires these additional permissions.

Permission	Purpose
Query All Files	Grants access to all files, bypassing sharing rules for complete capture during archiving.
Set Audit Fields upon Record Creation	Retains original metadata such as `CreatedBy`, `CreatedDate`, `ModifiedBy`, and `ModifiedDate` during unarchiving.
Update Records with Inactive Owners	Restores records assigned to inactive users.

Enable Org-Level Settings

In Setup, go to User Interface.
Check Set Audit Fields upon Record Creation and Update Records with Inactive Owners.

Special Configuration for Veeva-Integrated Orgs

If Archive is used with a Veeva-integrated Salesforce org, to support Archive operations specific to Veeva, the Authenticated User requires these permissions.

Veeva Administrator Permissions—Grants Veeva Administrator permissions to the Authenticated User.
CALL_ARCHIVE_USER Permission—Authenticated User can delete submitted Veeva calls, which is required for proper Archive functionality within Veeva.

Archive Admin Permission Set

The Archive Admin permission set provides comprehensive permissions for managing the Archive application and includes these permissions.

Permission	Description
Archive Abort Archive Activity	Abort running archive activities with a status of `Started`.
Archive Activities	Access the Activities table.
Archive Analyzer	Run storage analysis and create archive policies from the Storage Analyzer workflow.
Archive Enable Export	Export records from Archive.
Archive Enable Unarchive	Unarchive records from the Archive, or via the Archive SDK. If access to only one unarchive permission is required, use the custom permission and manually assign it to a custom permission set or a profile. Archive Unarchive—Permission to unarchive records from Archive only. Archive Unarchive SDK—Permission to unarchive records via Archive SDK only.
Archive Field-Level Security (FLS)	Run an Archive FLS report.
Archive Home Page	Access the Home Page.
Archive Legal Hold Admin	Enable legal hold operations, such as hold, unhold, search, and export of legal hold data.
Archive Legal Hold Table	Access Legal Hold report.
Archive Override Widget Restriction Rule	Override Archive Widget Restriction Rule.
Archive Policy Permission	Create Archive policies.
Archive Purge Policy Permission	Create Purge policies.
Archive Search	Search Archive records.
Archive Settings	View and configure Archive settings.
Archive View Archived Records	View archived records on the Visualforce page.
Export Abort Activity	Abort running export activities with a status of `Started`.
Unarchive Abort Activity	Abort running unarchive activities with a status of `Started`.

Important The Archive Analyzer permission set grants the ability to create, edit, and delete archive policies, in addition to read access to the entire archive. Because archive policies control data retention and can permanently delete data through purge policies, this permission set is generally reserved for Admins only.

The Archive Policy permission set also provides delete capabilities and is generally reserved for Admins only.

Archive Widget Access and Download Control

Standard users can't access archived data through Archive Widget and can encounter a system.security.NoAccessException error.

Optionally, to turn on Archive Widget access, assign the Archive View Archived Records user permission.

In Setup, locate Permission Sets.
Select Archive View Archived Records.
To assign the user permission to relevant users, click Manage Assignments.
Click Add Assignments.

Restrict File Downloads in Archive Widget

To prevent users from downloading files via Archive Widget, remove the download permission from a cloned permission set.

In Setup, clone Archive View Archived Records.
In the cloned set, remove DownloadFiles under Custom SystemPermissions.
Save the changes.
Assign the cloned set to the relevant users.