---
schema_version: "1"
id: 3b6f43524b37a6d0e08fffd2167f509b747b7b08d7763452cc7c020c88fbe615
title: Manage OAuth Access Policies for a Connected App
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_manage_oauth.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7499ded7999d4e10e4a3b3ec98debf31b633db27feef847771517d686409ed49
description: Configure OAuth access policies for OAuth-enabled connected apps. These policies include defining which users can access a connected app, what IP restrictions apply to the connected app, and how long a refresh token is valid for.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Manage OAuth Access Policies for a Connected App

Configure OAuth access policies for OAuth-enabled connected apps. These policies include defining which users can access a connected app, what IP restrictions apply to the connected app, and how long a refresh token is valid for.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d83278e62">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">To read, create, update, or delete connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
              Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">To update Profiles, Permission Sets, and Service Provider SAML Attributes:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">Customize Application AND Modify All Data AND Manage Profiles and Permission
              Sets</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">To rotate the consumer key and consumer secret:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">Allow consumer key and secret rotation</td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">To install and uninstall connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">
              <p>Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>
          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">To install and uninstall packaged connected apps:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d83278e62 ">
              <p>Download AppExchange Packages AND Customize Application AND either</p>
              <p style="margin-bottom:0;">Modify All Data
                OR Manage Connected Apps</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

1. From Setup, enter Connected Apps in the Quick Find box, then select **Manage Connected Apps**.
2. Click **Edit** next to the connected app that you are configuring access for.
3. Under OAuth Policies, click the **Permitted Users** dropdown menu and select one of the following options.
    
    - All users may self-authorize—Default. Allows all users in the org to authorize the app after successfully signing in. Users must approve the app the first time they access it.
    - Admin approved users are pre-authorized—Allows only users with the associated profile or permission set to access the app without first authorizing it. After selecting this option, manage profiles for the app by editing each profile’s Connected App Access list. Or manage permission sets for the app by editing each permission set’s Assigned Connected App list.
        
        In a Group Edition org, you can’t manage individual user access with profiles. However, you can manage all users’ access when you edit a connected app’s OAuth settings.
        
        ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_warning.png)
        
        Warning If you switch from All Users may self-authorize to Admin-approved users are pre-authorized, anyone using the app loses access, unless a user’s permission authorizes the connected app specifically. Connected apps that are part of a managed package use the default permission. In addition, if users have the Use Any API Client permission, they can access any connected app—even if its Permitted Users setting is set to Admin-approved users are pre-authorized. Be careful when using the Use Any API Client permission. As the name implies, you’re giving up your control over authorization.
4. Click the **IP Relaxation** dropdown menu, and select one of the following options to determine whether a user’s access to the app is restricted by IP ranges.
    
    - Enforce IP restrictions—Default. Enforces the IP restrictions configured for the org, such as the IP ranges assigned to a user profile.
    - Enforce IP restrictions, but relax for refresh tokens—Enforces the IP restrictions configured for the org, such as the IP ranges assigned to a user profile. However, this option bypasses these restrictions when the connected app uses refresh tokens to get access tokens.
    - Relax IP restrictions for activated devices—Allows a user running the app to bypass the org’s IP restrictions when either of these conditions is true.
        - The app has a list of allowed IP ranges and is using the web server authentication flow. Only requests coming from these IPs are allowed.
        - The app doesn’t have a list of allowed IP-ranges, but it uses the web server authentication flow, and the user successfully completes identity verification if accessing Salesforce from a new browser or device.
    - Relax IP restrictions—Allows a user to run this app without org IP restrictions.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note If you relax IP restrictions for your connected app and your org has Enforce login IP ranges on every request enabled, the access to your connected app can change. See [Connected App IP Relaxation and Continuous IP Enforcement](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_continuous_ip.htm&release=264.0.0&type=5 "For security reasons, if you relax IP restrictions for your connected app, and your org has enabled Enforce login IP ranges on every request, users can’t access the app in some circumstances. This access restriction applies to all OAuth-enabled connected apps, including mobile devices."). Also, IP restrictions are enforced only if they are configured on a user’s profile. The SAML bearer assertion and JWT bearer token flows always enforce IP restrictions regardless of the connected app policy. Connected apps that are part of a managed package use the default IP relaxation setting.
5. Select **Enable Single Logout** to automatically log users out of the connected app service provider when they log out of Salesforce.
6. If you selected **Enable Single Logout**, enter a single logout URL. Salesforce sends logout requests to this URL when users log out of Salesforce. The single logout URL must be an absolute URL starting with https://.
7. Select a **Refresh Token Policy** to determine how long a refresh token is valid for.
    
    If refresh tokens are provided, users can continue to access the OAuth-enabled connected app without having to reauthorize when the access token expires (defined by the session timeout value). The connected app exchanges the refresh token with an access token to start a new session. The Refresh Token policy is evaluated only during usage of the issued refresh token and doesn’t affect a user’s current session. Refresh tokens are required only when a user’s session has expired or isn’t available.
    
    For example, you set a refresh token policy to expire the token after 1 hour. If a user uses the app for 2 hours, the user isn’t forced to reauthenticate after 1 hour. However, the user is required to authenticate again when the session expires and the client attempts to exchange its refresh token for a new session.
    
    - **Refresh token is valid until revoked**—Default. The refresh token is used indefinitely, unless revoked by the user or Salesforce admin.
        
        Revoke tokens on a user’s detail page under OAuth Connected Apps or on the OAuth Connected Apps Usage Setup page.
    - **Immediately expire refresh token**—The refresh token is invalid immediately. The user can use the current session (access token) already issued, but can’t obtain a new session when the access token expires.
    - **Expire refresh token if not used for** `n`—The refresh token is valid as long as it’s been used within the specified amount of time. For example, if set to seven days, and the refresh token isn’t exchanged for a new session within seven days, the next attempt to use the token fails. The expired token can’t generate new sessions. If the refresh token is exchanged within seven days, the token is valid for another seven days. The monitoring period of inactivity also resets.
    - **Expire refresh token after** `n`—The refresh token is valid for a fixed amount of time. For example, if the policy states one day, the user can obtain new sessions only for 24 hours.

If your connected app is a canvas app that uses signed request authentication:

- Set Permitted Users to **Admin-approved users are pre-authorized**.
- Set Expire Refresh Tokens to **Immediately expire refresh token**.
- Give users access via profiles and permission sets.