--- schema_version: "1" id: b43ab76e73645406b337c7084ac2ef1ad79930c19bc0e7e7ac340d9bcf56f921 title: Manage Access to a Connected App collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_manage.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 63f2832d8126ecc7c77f008ed8cbfc73400b7468b1e220a9f8bafe5d4c6c1855 description: After a connected app is installed in your org, you can manage access to it. Configure permissions and policies for the app, explicitly defining who can use the connected app and where they can access the app from. These permissions and policies, which include user-access, IP range restrictions, and multi-factor authentication (MFA), provide extra security for your org. products: - Security - Cross Cloud release: "264" --- # Manage Access to a Connected App After a connected app is installed in your org, you can manage access to it. Configure permissions and policies for the app, explicitly defining who can use the connected app and where they can access the app from. These permissions and policies, which include user-access, IP range restrictions, and multi-factor authentication (MFA), provide extra security for your org. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience

Connected Apps can be created in: Group, Professional, Enterprise, Performance, Unlimited, and Developer Editions

Connected Apps can be installed in: All Editions
![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png) Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support. See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details. - **[Manage Third-Party Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_third_party.htm&release=264.0.0&type=5)** If your org uses third-party apps, such as those installed from the AppExchange, you can set security policies to control what data the third-party app can access from your org. You can also define who can use the third-party app. In addition to setting security policies to manage third-party apps, you can uninstall, and—when necessary—block these apps from the Salesforce org. - **[Install a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_how_to_install.htm&release=264.0.0&type=5)** You install a connected app by installing a managed package that includes the connected app as a component. For example, ISVs package connected apps to make them available on AppExchange. You can also install an OAuth connected app from the Connected Apps OAuth Usage page. This page lists all OAuth connected apps that users in your org are connecting to currently—including apps that developers created in other Salesforce orgs. - **[Uninstall a Third-Party Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_uninstall_third_party.htm&release=264.0.0&type=5)** You can uninstall a third-party connected app from your org. However, uninstalling an app doesn’t delete the connected app. Instead it removes the OAuth policies that you set for the app in your org. Because you’re removing the policies for apps that users can still access, you’re actually loosening your security measures. We recommend uninstalling a connected app only when the original developer deletes the app from their org. To make a connected app inaccessible to your org’s users, block the app. This action ends all current user sessions with the connected app and prevents all new sessions until you unblock the app. - **[Manage Start URL Settings for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_start_url.htm&release=264.0.0&type=5)** A start URL defines the page where users are directed to when they run the connected app. The start URL can be configured by the app owner during the setup process or managed later. If you don’t configure a start URL, users are sent to the app’s default start page after authorization completes. Start URL settings apply to all connected apps, except canvas apps. If your app is a canvas app, the connected app ignores the start URL fields. Instead, it uses the canvas app URL specified when the connected app was created. - **[Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&release=264.0.0&type=5)** Configure OAuth access policies for OAuth-enabled connected apps. These policies include defining which users can access a connected app, what IP restrictions apply to the connected app, and how long a refresh token is valid for. - **[Connected App IP Relaxation and Continuous IP Enforcement](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_continuous_ip.htm&release=264.0.0&type=5)** For security reasons, if you relax IP restrictions for your connected app, and your org has enabled **Enforce login IP ranges on every request**, users can’t access the app in some circumstances. This access restriction applies to all OAuth-enabled connected apps, including mobile devices. - **[Manage Session Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&release=264.0.0&type=5)** Configure a connected app’s session policies to define how long a user’s session can last before reauthenticating. You can also use session policies to block user access to the connected app, or to require two-factor authentication to access the app. - **[Manage Mobile Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_mobile.htm&release=264.0.0&type=5)** Configure policies for mobile connected apps that enforce PIN protection. These policies include setting the length of the connected app’s PIN, and defining how long a session can be idle before requiring re-entry of the PIN. - **[Manage Access Through a Custom Connected App Handler](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_custom_handler.htm&release=264.0.0&type=5)** Write a custom connected app handler in Apex to customize how the connected app is invoked. The custom handler can support new protocols or respond to user attributes in a way that benefits a business process. - **[Manage Other Access Settings for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_additional_settings.htm&release=264.0.0&type=5)** The Connected App Detail page provides an overview of access settings assigned to the connected app, including OAuth policies and session policies. From this page, you can click **Edit Policies** to manage access to the connected app. You can also manage profiles, permission sets, custom attributes, and custom scopes associated with the connected app. - **[User Provisioning for Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning.htm&release=264.0.0&type=5)** You can use a connected app to link your users with a third-party app. User provisioning for a connected app simplifies account creation and links your Salesforce users’ accounts to their third-party accounts. After the accounts are linked, you can configure the App Launcher to display the connected app as a tile. With a single click, users get instant access to the third-party app. - **[Manage Current OAuth Connected App Sessions](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&release=264.0.0&type=5)** The Connected Apps OAuth Usage page displays current OAuth app connections. For apps that aren't installed, it also displays usage attempts that Salesforce automatically denied due to security restrictions. From this page, you can install or uninstall third-party connected apps, revoke an app’s active sessions, and block or unblock org-wide access to the app. - **[Manage OAuth-Enabled Connected Apps Access to Your Data](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_request_manage.htm&release=264.0.0&type=5)** All users can manage a OAuth-enabled connected app’s access to their Salesforce data from their personal settings. The apps that have permission to access Salesforce data are listed under advanced user details. Users can get information about each app and revoke the app’s access. #### See Also - [Create a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create.htm&release=264.0.0&type=5 "When you create a connected app, make sure that you understand how it’s going to be used so you can configure the appropriate settings. For example, if you’re creating a connected app to integrate an external application with your Salesforce API, configure the connected app with OAuth authorization settings. Or if you’re creating a connected app to act as a service provider in a SAML single sign-on (SSO) flow, configure SAML settings.") - [Edit a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_edit_parent.htm&release=264.0.0&type=5 "After you create a connected app, you can make changes to it’s configuration. The actions that you can perform depend on the type of connected app. Use the App Manager to get a list of apps available in your org, including connected apps. From here, you can edit, reconfigure, or delete the connected app.") - [Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_overview.htm&release=264.0.0&type=5 "A connected app is a framework that enables an third-party application to integrate with Salesforce by using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect. Connected apps use these protocols to authenticate, authorize, and provide single sign-on (SSO) for third-party applications. The third-party applications that are integrated with Salesforce can run on the customer success platform, other platforms, other devices, or even SaaS subscriptions. For example, when you log in to your Salesforce mobile app and see your data from your Salesforce org, you’re using a connected app.")