--- schema_version: "1" id: 53caa7e9731b42496a55b834838c49f4a13b90a4e044e72e00ca4863bf6e698c title: Salesforce Authenticated User Permission Requirements for Seeding collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/seeding_o_auth_user_perms.md canonical_url: https://help.salesforce.com/s/articleView?id=platform.seeding_o_auth_user_perms.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 48c370b10c76a6ad0343c630bb0a3e89acd428ea874403dfdcf986373208ecae description: In a Salesforce data environment, the Seeding application uses an authenticated user to access production and sandbox orgs. Authenticated users require specific permissions to perform tasks such as building templates that define subsets of related data to extract from a source org. And then using those templates to seed sandboxes with identical data structures. products: - Security - Salesforce Platform release: "264" --- # Salesforce Authenticated User Permission Requirements for Seeding In a Salesforce data environment, the Seeding application uses an authenticated user to access production and sandbox orgs. Authenticated users require specific permissions to perform tasks such as building templates that define subsets of related data to extract from a source org. And then using those templates to seed sandboxes with identical data structures. This article identifies and describes those Salesforce processing permissions that must be assigned to an authenticated user being used by the Seeding application. Also, because users can decide to anonymize data as part of executing a seeding job, the authenticated user also requires some Salesforce processing permissions to execute Anonymize-related processing tasks. ## Salesforce Authenticated User Permissions for the Seeding Application Assign/enable the following Salesforce permissions to an authenticated user that is used by the Seeding application: | Permission / Setting Name | Permission Type | Reason / Use Case | Documentation | | --- | --- | --- | --- | | API Enabled | System Permissions | Allows the Seeding application to authenticate/access Salesforce data. | Go to [Salesforce Product Help](https://help.salesforce.com/s/) and open a chat with Agentforce. | | Author Apex permission | System Permissions | Allows the Seeding application to disable/enable automations (normally part of the System Administrator profile). | [Author Apex](https://help.salesforce.com/s/articleView?id=000386957&type=1&language=en_US) | | Bulk API Hard Delete | Administrative Permission/System Permissions | Allows deleting field history - Anonymize-related processing (needed when user chooses to anonymize data as part of a seeding job). | [Activation of Bulk API Hard Delete on System Administrator Profile](https://help.salesforce.com/s/articleView?id=000385694&type=1&language=en_US) | | Customize Application | Administrative Permission | Allows the Seeding application to edit validation rules. | [Define Validation Rules](https://help.salesforce.com/s/articleView?id=platform.fields_defining_field_validation_rules.htm&type=5&language=en_US) | | Enable Email Drafts | A setting, not a permission | Supports Seeding. You must enable this setting if your service/sales reps use cases (case = a customer question, feedback, or issue). | See [Enable Email Drafts for Cases](https://help.salesforce.com/articleView?id=service.case_interaction_enabling_email_drafts.htm&type=5&language=en_US) in Add Functionality to the Case Feed in Salesforce Classic. | | Modify All Data | System Permissions | Enabling Modify All Data automatically enables a number of other permissions. | Modify All Data permission | | Set Audit Fields upon Record Creation | System Permissions | Allows the Seeding application to manage audit fields during record creation and populate the original created date of record. | [Modify All Data Permission in Salesforce](https://help.salesforce.com/articleView?id=000384401&type=1&language=en_US) | | Update Records with Inactive Owners | System Permissions | Allows the Seeding application to restore records with inactive owners. | [Enable the 'Create Audit Fields' permission](https://help.salesforce.com/articleView?id=000386699&type=1&language=en_US) | | View and Edit Converted Leads | App Permissions | Allows the Seeding application to update converted leads. | [View and Edit Converted Leads](https://help.salesforce.com/articleView?id=leads_view_edit_converted.htm&language=en_US) | | View Setup and Configuration | System Permissions | Allows the Seeding application to identify Salesforce sandbox types (Full, Partial, Dev Pro, Dev). | [View Setup and Configuration](https://help.salesforce.com/s/articleView?id=platform.admin_userperms.htm&type=5&language=en_US) | Make sure that the following, important issues are executed for an authenticated user, which is to be used by the Seeding application: - The authenticated user is attributed (is assigned) all the Permission Set Licenses (PSL) and Installed Managed Package Licenses (IMPLs) of the Salesforce org. Doing so, permits the Seeding application to access for processing purposes the special objects that are provided by specific added features and managed packages. - The option Session Activation Required is disabled in the Salesforce Permission Set that is assigned to the authenticated user. - The authenticated user's assigned Salesforce Profile permits the user to make changes (create, edit, delete) to all relevant and necessary objects. - All Seeding application IP addresses are permitted access to the customer's Salesforce orgs. ## Additional Information about User Profile Permissions For information about: - Using the Salesforce Integration User License (API Only) as your authenticated user, read the article [Salesforce Integration User License (API Only)](https://help.salesforce.com/s/articleView?id=platform.platform_o_integration_user_api.htm&release=264.0.0&type=5 "The Authenticated User connects the application to the client's Salesforce org. Own doesn't currently support this type of license because the standard API configurations for the Salesforce API Integration User license have insufficient privileges to support usage as the Authenticated User for Own applications: Backup & Recover, Archive, and Seeding."). - User profile permissions in Salesforce, see [Salesforce help page User Permissions](https://help.salesforce.com/articleView?id=platform.admin_userperms.htm&type=5&language=en_US).