---
schema_version: "1"
id: 0690bd22239be1918bb45572caed6f96fc1254cb6bf50fd7ddbc30f5af445132
title: Get Started with Backup & Recover for Salesforce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/backup_recover_o_get_started.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_get_started.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a840190bc942cdab945902115168e807fe5e97f80897f35ed37b168926b8aa28
description: Set up and run your first backup with minimal friction. As a first-time user, provision an Own account as the Master Admin, connect a Salesforce org, and add an initial backup service. Configure key security and user access settings so your team can operate securely.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Get Started with Backup & Recover for Salesforce

Set up and run your first backup with minimal friction. As a first-time user, provision an Own account as the Master Admin, connect a Salesforce org, and add an initial backup service. Configure key security and user access settings so your team can operate securely.

Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations.

## At a Glance

- **Goal:** Run your first Salesforce backup in Own as quickly and securely as possible.
- **Required for first backup:** Create your Salesforce Authenticated User, provision your Own account, configure network access only if your org requires allowlisting, add a backup service, and confirm backup status.
- **Recommended after first backup:** Configure single sign-on (SSO) or MFA, apply IP restrictions, configure Bring Your Own Key (BYOK), and set up business units and users. If you use BYOK, you're required to configure it before the first production backup.

## Quickstart Path

To run your first backup with minimal setup time, complete these steps in order.

1. [Create your Salesforce authenticated user](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_get_started.htm&release=264.0.0&type=5 "Create this user before you add your first backup service.")
2. [Get an Own from Salesforce Platform account](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_get_started.htm&release=264.0.0&type=5 "To use Backup & Recover for Salesforce, you must get an Own from Salesforce Platform account. Getting an Own from Salesforce Platform account is a two-part procedure.")
3. [Configure Salesforce network access for Own](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_get_started.htm&release=264.0.0&type=5 "If your Salesforce org restricts inbound traffic, enable Own's required IP addresses and URLs before adding your service. If your org doesn't restrict inbound traffic, skip this section.")
4. [Add a backup service](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_get_started.htm&release=264.0.0&type=5)
5. [Monitor the status of your first backup](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_get_started.htm&release=264.0.0&type=5)

The remaining sections cover recommended security configuration and user management. You can complete them before or after your first backup, except where noted.

For a clear first-time onboarding flow, complete the quickstart path first, confirm that your first backup starts, and then return to the optional hardening sections.

## Before You Begin: Key Concepts

Before you start, it helps to understand key concepts in Backup & Recover from Salesforce.

- Own from Salesforce Platform
- Salesforce Authenticated User
- Own Platform Master Admin

**Own from Salesforce Platform**

Backup & Recover runs on the Own from Salesforce Platform. It's a separate application with its own login, not a feature inside your Salesforce org.

You set up backup services and run backups in the Own app at `https://auth.owndata.com/`. You don't manage backups in Salesforce Setup.

Salesforce is the org that Own backs up. Own is the platform that performs and stores the backups.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_important.png)

Important You access Own outside of Salesforce. Log in to the Own app at `https://auth.owndata.com/` with your Own account, not your Salesforce credentials.

The Salesforce Authenticated User and the Own Platform Master Admin are two different accounts in two different systems. The Salesforce Authenticated User is in Salesforce, and the Master Admin is in Own Platform.

**Salesforce Authenticated User**

The **Salesforce Authenticated User** is the dedicated Salesforce user that Backup & Recover uses to access your Salesforce org. This user is separate from your Own platform account user.

Create a dedicated Salesforce user for this purpose to improve security and auditability. For required permissions, see [Salesforce Authenticated User Requirements for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_auth_user_perms.htm&type=5&language=en_US).

**Own Platform Master Admin**

The **Master Admin** is the user in your Own from Salesforce Platform account with the highest access privileges. The Master Admin can configure all settings, manage users, and access everything in the account.

When Own provisions the account, it assigns the person completing the setup as the Master Admin. This guide assumes that you're the Master Admin.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_important.png)

Important An account can have only one Master Admin. Only the Master Admin can transfer the Master Admin role to another user — plan ahead so the role doesn't become inaccessible if that person leaves. For information about how to make that transfer, read [Swap Master Admin Accounts](https://help.salesforce.com/s/articleView?id=platform.platform_o_swap_master_admin.htm&type=5&language=en_US). If you don't have access to the Master Admin account, contact Salesforce Support.

For more details about what the Master Admin can do, see [Roles & Permissions](https://help.salesforce.com/s/articleView?id=platform.platform_o_permissions_per_role.htm&type=5&language=en_US).

## Create Your Salesforce Authenticated User

Create this user before you add your first backup service.

See [Salesforce Authenticated User Requirements for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_auth_user_perms.htm&type=5&language=en_US).

1. In Salesforce, create a dedicated user account and use it only for Backup & Recover authentication. See [How To: Add New Users and Assign Licenses](https://help.salesforce.com/s/articleView?id=005225092&type=1&language=en_US)
2. Assign the required permissions and access for Backup & Recover. For detailed permission requirements, see [Salesforce Authenticated User Requirements for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_auth_user_perms.htm&type=5&language=en_US).
3. Save the login credentials securely so that you can use them during service authentication in Own.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_important.png)

Important If you make changes to the Salesforce Authenticated User username, this breaks the authentication connection and requires reauthentication to restore the backup service. See [Reauthenticate Salesforce Services in Backup & Recover for Salesforce](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_reauthenticate_service.htm&release=264.0.0&type=5 "If you get a message about an inactive Authenticated User, a revoked token or an authentication error, you can restore access and functionality by reauthenticating the Salesforce Authenticated User.").

## Configure Salesforce Network Access for Own

If your Salesforce org restricts inbound traffic, enable Own's required IP addresses and URLs before adding your service. If your org doesn't restrict inbound traffic, skip this section.

See [Own Regional Locations and IP Addresses for Allowlisting](https://help.salesforce.com/s/articleView?id=platform.platform_o_aws_regions_for_allowlist.htm&type=5&language=en_US).

1. Review the required regional IP addresses and URLs in [Own Regional Locations and IP Addresses for Allowlisting](https://help.salesforce.com/s/articleView?id=platform.platform_o_aws_regions_for_allowlist.htm&type=5&language=en_US).
2. Add the required entries to your Salesforce/network allowlists.
3. Confirm that no firewall, proxy, or network policy blocks Own from reaching your Salesforce org.

## Own Backup Service Types

There are four backup service types, each representing the type of data that's backed up.

 
| **Service Type** | **What's Backed Up** |
| --- | --- |
| Production Data | Salesforce records, files, content documents, and Chatter posts |
| Production Metadata | Org customizations: custom fields, custom Apex code, page layouts, reports, permission sets |
| Sandbox Data | Salesforce records, files, content documents, and Chatter posts in sandbox environments only |
| Sandbox Metadata | Org customizations: custom fields, custom Apex code, page layouts, reports, permission sets in sandbox environments only |

These backup services run daily.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_note.png)

Note If you have Continuous Data Protection, you can back up data for specific objects on a continuous basis. This guide doesn't cover Continuous Data Protection. For more details about the feature, see [Set Up Continuous Data Protection](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_setup_cdp.htm&type=5&language=en_US).

## Get an Own from Salesforce Platform Account

To use Backup & Recover for Salesforce, you must get an Own from Salesforce Platform account. Getting an Own from Salesforce Platform account is a two-part procedure.

First, your company representative contacts Salesforce to provision your account. They're asked to nominate the Master Admin and region.

Second, as the nominated Master Admin, you respond to the welcome email. If you haven't received the welcome email, follow the steps for [Reset Passwords for an Existing User](https://help.salesforce.com/s/articleView?id=platform.platform_o_sign_up_and_in.htm&type=5&language=en_US).

1. Contact Salesforce by using the [Salesforce Contact Us form](https://www.salesforce.com/company/contact-us/). For **Product Interest**, select **Salesforce Platform**.
2. After Own sets up your account, you receive a welcome email that prompts you to set your password. If needed, check your spam folder and add `@owndata.com` to your email allowlist.
3. Use the first link in the email to set your password.
4. If the first link expires, use the second link to request a new password link.

The first time you log in to the Own app at `https://auth.owndata.com/` (not Salesforce), Own prompts you to add a backup service. Add the service, then return later to configure security and user access.

## Add a Backup Service

Before you start, log out of your Salesforce org. This action makes sure that Own authenticates as your dedicated Salesforce authenticated user, rather than your current admin session.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_important.png)

Important If you use BYOK, configure your key before you run the first backup for your production org. See [Bring Your Own Key (BYOK, BYOKMS and BYOKV) for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.administration_o_backup_byok_byokms_byokv.htm&type=5&language=en_US).

In the Own app:

1. Go to the Backup tab and click **New Service**.
2. Select **Salesforce**.
3. Select a service type.
4. (Optional) If you use a custom domain in Salesforce, click **Use Custom Domain**, and enter your custom domain.
5. Click **Add Service**. You're prompted to authenticate with Salesforce, authorizing Own to access your org. Use the credentials for your Salesforce authenticated user.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_note.png)

Note After you create the service, Own starts a full backup of your org immediately. This first backup copies your entire dataset and usually takes longer than later backups. Own runs data and file backups as separate processes: the data backup typically completes first. The file backup continues until complete. Due to the large size of files, their backup continues on each consecutive day until the files backed completes. Monitor progress on the Backup Services page, and watch for the completion email. The schedule and service settings in the next section apply to subsequent backups.

## Configure Own Security and Access Recommended After First Backup

Protect your Own from Salesforce Platform account by limiting access and implementing security features. These steps are optional, but recommended.

1. Restrict access to trusted IP ranges. See [Configure IP Address Restrictions](https://help.salesforce.com/s/articleView?id=platform.platform_o_config_ip_address_restrict.htm&type=5&language=en_US).
2. Configure identity security with [Enable Single Sign-On](https://help.salesforce.com/s/articleView?id=platform.platform_o_single_sign_on.htm&language=en_US&type=5) or [Set Up Multi-Factor Authentication](https://help.salesforce.com/s/articleView?id=platform.platform_o_mfa.htm&type=5&language=en_US).
3. Secure your backup data with your own encryption keys by using [Bring Your Own Key (BYOK, BYOKMS and BYOKV) for Backup & Recover](https://help.salesforce.com/s/articleView?id=platform.administration_o_backup_byok_byokms_byokv.htm&type=5&language=en_US).
4. If your use case requires automation and integrations, enable API with [Access Own through the Own API](https://help.salesforce.com/s/articleView?id=platform.platform_o_access_through_api.htm&language=en_US&type=5).

## Manage Business Units and Add Users

To make sure that each user gets the right scope and role from the start, set up business units before adding users.

  
| User Role | Manage Business Unit | Add Users |
| --- | --- | --- |
| Master Admin | Yes | Yes |
| Admin | Yes | Yes |
| Security Admin | No | Yes |

1. Create or review business units in **Account Settings** | **Business Units**. See [Manage Business Units](https://help.salesforce.com/s/articleView?id=platform.platform_o_business_units.htm&type=5&language=en_US).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-own_from_salesforce-264-0-0-production-enus/8ac98673-ede2-4046-a41e-2d5c846f24ff/images/icon_note.png)
    
    Note If you use System for Cross-domain Identity Management (SCIM) provisioning, the default business unit must keep the name **Default Business Unit**. Renaming or deleting it causes the SCIM integration to fail.
2. Add users in **Account Settings** | **Users** and assign role and business unit. See [Add Users](https://help.salesforce.com/s/articleView?id=platform.platform_o_add_user.htm&type=5&language=en_US). Review role capabilities as needed in [User Roles](https://help.salesforce.com/s/articleView?id=platform.platform_o_user_roles.htm&type=5&language=en_US).

When you add a new user, that user has 48 hours to verify the email address. If the user doesn't verify in time, remove the user and add them again.

## Configure Backup Service Options

Your first backup has started. The next settings apply to subsequent scheduled backups. After you configure them, the next backup run applies them.

On the Backup Services page, click the backup service you created. The service's Dashboard opens.

Go to **Options**, then **General**.

1. Change the name of your backup service.
    
    We suggest using a descriptive name, for example, "Production Data."
2. Enter the time of day that you want the daily backups to start.
    
    For example, during off-peak hours.
    
    Set your time zone correctly on the **Edit Profile** tab.
3. Select a day for the weekly backup.

Backup & Recover performs a full weekly backup followed by daily synthetic full backups until the next full backup day.

A synthetic full backup captures change and merges them with a previous full or synthetic full backup to create an updated complete backup. Learn more about [Backup Types for Salesforce](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_backup_types.htm&type=5&language=en_US).

For details on other configuration options, see [Essential Service Options in Backup & Recover for Salesforce](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_service_options.htm&type=5&language=en_US).

## Monitor the Status of Your Backup

On the [Backup Services](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_services_screen.htm&type=5&language=en_US) page, view the status for each service. Own backs up data and files in separate processes. This process lets data backups finish faster while file backups continue until completion. The main status on the Backup Services page shows the data backup status. When file backup completes, the page also shows a checkmark icon and "Files completed."

Click the service to see its [Backup Service Dashboard](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_service_dashboard.htm&type=5&language=en_US). On the dashboard, view a visual representation of the number of records added, changed, or removed over time.

If a backup fails or behaves unexpectedly, identify the cause and resolve it using [Backup & Recover for Salesforce Troubleshooting](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_troubleshoot.htm&type=5&language=en_US)

## Next Steps

With a backup service running, explore the tools and settings for day-to-day backup management.

- In [Key Features of Backup & Recover for Salesforce](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_key_features.htm&type=5&language=en_US), explore Backup Service Dashboard, Smart Alerts, and the Find, Compare, and Restore tools.
- In [Essential Service Options in Backup & Recover for Salesforce](https://help.salesforce.com/s/articleView?id=platform.backup_recover_o_service_options.htm&type=5&language=en_US), review backup schedule, retention policies, and options to pause or archive a service.
- In [Managing Multi-Region Accounts in Own from Salesforce](https://help.salesforce.com/s/articleView?id=platform.platform_o_multi_region_account.htm&type=5&language=en_US), provision and link multi-region Own accounts.
- In [Audit Log](https://help.salesforce.com/s/articleView?id=platform.platform_o_audit_log.htm&type=5&language=en_US), review a detailed record of recent events across all users.