Connecting to Salesforce

The native Salesforce integration is the cornerstone of the Agentic Marketing Platform. Connecting your Salesforce org is a foundational step that allows Qualified to use your system of record to identify visitors, personalize conversations, and create or update Lead and Contact records. 

To ensure the highest level of security, we strongly recommend following the Principle of Least Privilege when creating your integration user. Instead of assigning a full System Administrator profile, you should create a dedicated custom profile or permission set that grants only the specific permissions required for the Qualified integration to function.

This guide will walk you through our recommended best practices for establishing a secure and powerful connection.

• Step 1: Choose your Default Push Destination
• Step 2: Choose Your Integration User Strategy
• Step 3: Create & Configure the Integration User
• Step 4: Complete Security Prerequisites
  
• Step 5: Connect to Qualified
• Step 6: Post-Connection Configuration
• Next Step: Sales Rep Connections

<span id="step-1"></span>

Step 1: Decide your default push destination 

Determine where Qualified will create new leads and update existing records across your Salesforce and connected Marketing Automation Platform. If your system architecture is designed to have all data flow through a Marketing Automation Platform before moving to Salesforce, you can restrict your Salesforce integration user permissions appropriately for your situation.

<span id="step-2"></span>

Step 2: Choose your integration user strategy

The first step is to decide which type of Salesforce user account will connect Qualified and Salesforce. While several strategies are possible, we strongly recommend creating a Dedicated, Qualified-only User for the most secure, stable, and reliable integration. The table below outlines the pros and cons of each approach.

<table><thead>
 <tr>
   <th>Setup</th>
   <th>Pros<br></th>
   <th>Cons</th>
 </tr></thead>
<tbody>
 <tr>
   <td>⭐️ Dedicated, Qualified-only integration user</td>
   <td>This is best practice and the recommended option. The user is granted precise permissions and all updates made within Salesforce are clearly attributable to Qualified.</td>
   <td>This requires the purchase or use of a dedicated Salesforce user license, which may require time to set up at your company.</td>
 </tr>
 <tr>
   <td>Shared integration user with other connected apps</td>
   <td>If you already have an Integration User for other apps, this may be faster than creating a new, dedicated Qualified User.</td>
   <td>Qualified must share the permissions and limits of the shared integration user. If this user’s access is shut down, all connected apps will be impacted. You will be unable to easily determine which system is creating or updating records.</td>
 </tr>
 <tr>
   <td>Existing individual user</td>
   <td>This is both the fastest and most affordable option, because it uses an Individual User that already exists in your Salesforce. There’s no need to create anything new.</td>
   <td>This method poses a significant security risk by granting full system access. All data changes are attributed to the individual user, making platform-specific auditing difficult, and the integration will break if the user leaves the company or their account is compromised.</td>
 </tr>
</tbody></table>

<span id="step-3"></span>

Step 3: Create & Configure the Integration User

Please work with your Salesforce Administrator to create a custom profile or permission set with the following minimum required permissions.

The Permission Checklist

Use this checklist to verify that the user account has the required permissions.

1. General Permissions

• API Enabled: The "API Enabled" checkbox is checked on the user's Profile or an assigned Permission Set.
• Access Activities: The "Access Activities" checkbox is checked.
• Edit Events & Tasks: The "Edit Events" and/or "Edit Tasks" checkboxes are checked.
• View and Edit Converted Leads: Verify this permission is UNCHECKED.

2. Object-Level Permissions

If Salesforce is your designated default push destination:

• Leads: Read, Create, Edit
• Contacts: Read, Edit
• Accounts: Read, Create, Edit
• Opportunities: Read
• Campaigns: Read, Edit
• Objects related to Leads, Contacts, Accounts: Read

If a Marketing automation platform is your designated default push destination:

• Leads: Read
• Contacts: Read
• Accounts: Read, Create, Edit
• Opportunities: Read
• Campaigns: Read, Edit

3. Minimum Field-Level Access

The integration user must have Read access to all fields that Qualified needs to reference and Edit access to all fields that Qualified will update.

Because each Salesforce org has different field customizations, consider starting by granting Read access to all standard and custom fields on the supported objects (Leads, Contacts, Accounts, Opportunities, Activities, Campaigns, Campaign Members).

Then, narrow down Edit access only to the fields that Qualified will write to during normal operation (for example, Lead Status, Owner, or Campaign Status).

To use Related Object Filtering, your Salesforce integration must have Read access to the following metadata objects:

• EntityDefinition
• FieldDefinition
• EntityParticle
• PicklistValueInfo

If these permissions are missing, related custom objects or fields may not appear when building filters.

Any new fields added after implementation should be reviewed and granted appropriate access if they are used by Qualified.

⚠️ Important: Your Qualified Success Architect can help you navigate creating your integration user for your unique Salesforce environment.  You will be able to identify which fields are required for the business teams who will be operating Qualified by first connecting Qualified to a Salesforce Sandbox and iterating on your required user permissions. This approach ensures Qualified can function reliably while still following the Principle of Least Privilege. 

4. Dashboard Field Access

To power the Qualified Dashboards in your analytics suite, specifically the "Revenue Influence" and "Pipeline Influence" dashboards, the integration user requires at least Read access to the following fields.

• Account Object: LastModifiedDate, Id, Website, Name, Owner.Name
• Opportunity Object: Id, Name, StageName, Amount, CloseDate, IsClosed, CreatedDate, AccountId

<span id="step-4"></span>

Step 4: Complete Security Prerequisites

Restrict API Access by IP Address (Recommended)

For an added layer of security, we strongly recommend restricting API access to only Qualified's servers. This ensures that the integration user can only be accessed from our trusted network.

A Salesforce Administrator can do this by setting Login IP Ranges on the integration user's custom profile and adding the following static IP addresses:

• 34.236.78.183
• 52.20.17.105
• 3.92.37.95

Review Salesforce Automation

Please ensure there are no validation rules, Apex triggers, or flows that would prevent the API user from successfully creating or updating the objects listed in the permission checklist.

<span id="step-5"></span>

Step 5: Connect to Qualified

Once your user is created and configured, you can establish the connection.

1. In Qualified, navigate to Settings → Integrations → Salesforce → Connection. 
2. Click Connect to Salesforce.
3. A Salesforce pop-up window will appear. Enter the login details for the dedicated integration user.
   Note: you may need to click "Use Custom Domain" before entering your credentials to properly authenticate. 
4. Click Log In and follow any verification prompts.
5. After logging in for the first time, install Qualified as a Connected App in Salesforce Setup. 

You will know the connection is successful when you return to the Salesforce settings page in Qualified and see the integration user's name displayed under the “Org-level account” section.

<span id="step-6"></span>

Step 6: Post-Connection Configuration

With the connection active, you can now configure several settings to fine-tune how data flows between Qualified and Salesforce:

• Update Salesforce Fields: Click this button to sync any new or changed fields from your Salesforce objects (Lead, Contact, Account, etc.) into Qualified. It's a good practice to do this any time your Salesforce admin makes changes to your page layouts.
• Sync Frequency: Use this setting to control how often Qualified pulls the latest data from Salesforce, ensuring the information your team sees is always current.

<span id="next-steps"></span>

Next Steps: Sales Rep Connections

This guide covers the main org-level connection required for Qualified to sync with Salesforce. After this org-level connection is complete, your individual sales reps will also need to connect their personal Salesforce accounts to Qualified.

This is a simple, one-click process that does not require any special permissions for the reps. This personal-level connection is what ensures records, like Leads and Contacts, are correctly assigned and attributed to the specific sales rep who interacted with a visitor.