---
schema_version: "1"
id: 9805333db21112d98eb37ae0912d71f3f1af7a21977afe0b18708aa611f19b1f
title: Authenticated User Permission Requirements for Archive
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/archive_authenticated_user_permission_requirements.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.archive_authenticated_user_permission_requirements.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 74164f607d77268fe809adb6be23104cda62048213eba96da3a7cb2e2f0b95bc
description: Archive connects to your Salesforce org through the API via an Authenticated User. This user account serves as the integration point for all Archive operations.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Authenticated User Permission Requirements for Archive

Archive connects to your Salesforce org through the API via an Authenticated User. This user account serves as the integration point for all Archive operations.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png)

Note The permission requirements in this topic are not applicable to orgs on Hyperforce. On Hyperforce, permissions are assigned automatically to the Platform Integration User (PIU), which replaces the authenticated user. For more information, see [Hyperforce Infrastructure in the Archive App](https://help.salesforce.com/s/articleView?id=xcloud.archive_hyperforce_infrastructure.htm&release=264.0.0&type=5 "Your Archive region—not your Salesforce org's Hyperforce status—determines whether Archive uses an authenticated user or the Platform Integration User (PIU), and which setup, security, and import and export options you see.").

We recommend that the Authenticated User be a dedicated Integration User, a full-licensed account created specifically so that all automated operations, such as purges, are logged to this user. This assignment provides a clean audit trail and distinguishes app-based actions from manual changes made by an admin.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_important.png)

Important The standard Salesforce Integration User license isn't compatible with Archive. The user account designated as the Authenticated User must be assigned a full Salesforce license with a profile that grants the full required permission scope, such as a clone of the Salesforce System Admin profile.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png)

Note Verify that the Integration User has read and delete access to all objects that you want to archive via the Field-Level Security (FLS) report.

## Basic Permissions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
          <colgroup>
            <col>
            <col>
            <col>
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75443e80">Permission</th>
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75443e83">Permission Type</th>
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75443e86">Purpose</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e80 ">Bulk API</td>

              <td data-label="Permission Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e83 ">System Permissions</td>

              <td data-label="Purpose" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e86 ">
                <p>Authenticated User with System Admin profile can activate
                  Hard-Delete to permanently delete records and bypass the Recycle
                  Bin during Archive operations.</p>
                <p style="margin-bottom:0;">This permission is necessary
                  for managing large datasets and directly purging records
                  without them lingering in the Recycle Bin.</p>
              </td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e80 ">Modify All</td>

              <td data-label="Permission Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e83 ">System Permissions</td>

              <td data-label="Purpose" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e86 ">Grants full control over all records for a specified object.
                The user can view, edit, delete, and transfer ownership of
                records, regardless of sharing rules or other
                restrictions.</td>

            </tr>
          </tbody>
        </table>

## Additional Permissions

To handle ContentDocuments and restore unarchived records correctly, the Authenticated User requires these additional permissions.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
          <colgroup>
            <col>
            <col>
          </colgroup>
          <tbody>
            <tr class="">
              <td class="slds-cell-wrap" style="vertical-align:top;">Permission</td>

              <td class="slds-cell-wrap" style="vertical-align:top;">Purpose</td>

            </tr>
            <tr class="">
              <td class="slds-cell-wrap" style="vertical-align:top;">Manage Multi-Factor Authentication (MFA) in API</td>

              <td class="slds-cell-wrap" style="vertical-align:top;">
                <p>When MFA enforcement is enabled, Salesforce restricts access to org-level
                  metadata fields.</p>
                <p>With this permission, Archive can read storage or limit fields, such as
                  FileStorageMB, through the API. </p>
                <p style="margin-bottom:0;">Without this permission, Archive processes that reference these fields can fail
                  or return incomplete results.</p>
              </td>

            </tr>
            <tr class="">
              <td class="slds-cell-wrap" style="vertical-align:top;">Query All Files</td>

              <td class="slds-cell-wrap" style="vertical-align:top;">Grants access to all files, bypassing sharing rules for
                complete capture during archiving.</td>

            </tr>
            <tr class="">
              <td class="slds-cell-wrap" style="vertical-align:top;">Set Audit Fields upon Record Creation</td>

              <td class="slds-cell-wrap" style="vertical-align:top;">Retains original metadata such as <code>CreatedBy</code>,
                <code>CreatedDate</code>, <code>ModifiedBy</code>, and
                <code>ModifiedDate</code> during unarchiving.
              </td>

            </tr>
            <tr class="">
              <td class="slds-cell-wrap" style="vertical-align:top;">Update Records with Inactive Owners</td>

              <td class="slds-cell-wrap" style="vertical-align:top;">Restores records assigned to inactive users.</td>

            </tr>
          </tbody>
        </table>

## Enable Org-Level Settings

1. In Setup, go to User Interface.
2. Select **Set Audit Fields upon Record Creation** and **Update Records with Inactive Owners**.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png)

Note Verify that the Integration User has read and delete access to all objects that you want to archive. You can verify this access via the Field-Level Security (FLS) report.

## Special Configuration for Veeva-Integrated Orgs

If Archive is used with a Veeva-integrated Salesforce org, the Authenticated User requires these permissions to support Archive operations specific to Veeva.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small "><colgroup><col> <col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Permission</td><td class="slds-cell-wrap" style="vertical-align:top;">Purpose</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Veeva Administrator</td><td class="slds-cell-wrap" style="vertical-align:top;">Grants Veeva Administrator permissions to the Authenticated User.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">CALL_ARCHIVE_USER</td><td class="slds-cell-wrap" style="vertical-align:top;">The Authenticated User can delete submitted Veeva calls, which is required for proper Archive functionality within Veeva.</td></tr></tbody></table>

## Archive Admin Permission Set

The Archive Admin permission set gives Authenticated User access to comprehensive permissions for managing Archive and includes these permissions.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png)

Note Before continuing setup, make sure the Archive Admin permission set is assigned to these users.

- Integration User—Required for the API user to run scheduled and background processes.
- Salesforce Admin—Required for the admin to access and complete all setup and configuration steps.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
          <colgroup>
            <col>
            <col>
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75443e344">Permission</th>
              <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d75443e347">Description</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Abort Archive Activity</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Abort running archive activities with a status of
                <code>Started</code>.
              </td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Activities</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Access the Activities table.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Analyzer</td>



              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Run storage analysis and create archive policies from the Storage Analyzer workflow.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Enable Export</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Export records from the archive.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Enable Unarchive</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">
                <p>Unarchive records from the Archive, or via the Archive SDK. </p>
                <p>If you need
                  only one unarchive permission, you can enable one of these custom permissions,
                  and then manually assign it to a custom permission set or profile.</p>
                <ul>
                  <li>Archive Unarchive—Permission to unarchive records from Archive only.</li>

                  <li>Archive Unarchive SDK—Permission to unarchive records via Archive SDK
                    only.</li>

                </ul>
              </td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Field-Level Security (FLS)</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Run an Archive FLS report.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Home Page</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Access the home page.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Legal Hold Admin</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Enable Legal Hold operations, such as hold, unhold, search, and export of
                legal hold data.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Legal Hold Table</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Access the Legal Hold report.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Override Widget Restriction Rule</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Override Archive Widget Restriction Rule.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Policy Permission</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Create archive policies.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Purge Policy Permission</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Create purge policies.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Search</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Search archived records.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive Settings</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">View and configure Archive settings.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Archive View Archived Records</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">View archived records on the Visualforce page.</td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Export Abort Activity</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Abort running export activities with a status of
                <code>Started</code>.
              </td>

            </tr>
            <tr class="">
              <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e344 ">Unarchive Abort Activity</td>

              <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d75443e347 ">Abort running unarchive activities with a status of
                <code>Started</code>.
              </td>

            </tr>
          </tbody>
        </table>

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_important.png)

Important The Archive Analyzer permission set grants the ability to create, edit, and delete archive policies, in addition to read access to the entire archive. Because archive policies control data retention and can permanently delete data through purge policies, this permission set is generally reserved for admins only.

The Archive Policy permission set also provides delete capabilities and is generally reserved for admins only.

## Archive Component Access and Download Control

Standard users can't access archived data through the Archive component and can encounter a `system.security.NoAccessException` error.

Optionally, to turn on component access, assign the Archive View Archived Records user permission.

1. In Setup, locate Permission Sets.
2. Select **Archive View Archived Records**.
3. To assign the user permission to relevant users, click **Manage Assignments**.
4. Click **Add Assignments**.

## Restrict File Downloads in the Archive Component

To prevent users from downloading files via the component, remove the download permission from a cloned permission set.

1. In Setup, clone Archive View Archived Records.
2. In the cloned set, remove `DownloadFiles` under Custom SystemPermissions.
3. Save the changes.
4. Assign the cloned set to the relevant users.

#### See Also

- [Activation of Bulk API Hard Delete on System Administrator Profile](https://help.salesforce.com/s/articleView?id=000385694&type=1&language=en_US)
- [Enable Custom Permissions in Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_custom_perms.htm&type=5&language=en_US)
- [Enable Custom Permissions in Profiles](https://help.salesforce.com/s/articleView?id=platform.users_profiles_custom_perms.htm&type=5&language=en_US)