Required permissions for Salesforce Nonprofit Cloud and Education Cloud integrations

Before you begin

The Salesforce user who connects the integration must meet these requirements:

• Use a full Salesforce user license. API-only and free Salesforce Integration licenses do not provide all permissions required by the current connection flow.
• Assign the required access through the user’s profile, permission sets, and permission set licenses. Salesforce applies the access allowed by the user license, so a permission set cannot grant access that the license does not support.
• Make the Person Account and Organization Account record types available to the integration user. Set the record type that the integration uses as the default. Missing record type access can prevent Fundraise Up from creating Account records.

System permissions

Grant these system permissions to the integration user:

• API Enabled: Allows Fundraise Up to use the Salesforce API.
• Customize Application: Allows Fundraise Up to create or update the custom field used to identify synchronized records.
• Manage Profiles and Permission Sets: Allows Fundraise Up to configure field-level access for the integration user’s profile during connection or reconnection.
• Modify All Data or Modify Metadata Through Metadata API Functions: Allows Fundraise Up to create or update required metadata during connection or reconnection.

To configure system permissions:

1. In Salesforce, go to Setup > Users > Profiles.
2. Open the profile assigned to the integration user.
3. Open System Permissions, then click Edit.
4. Select each required permission, then save your changes.

Marketing User access

Select the Marketing User checkbox on the Salesforce user record. Campaign object permissions alone do not allow the integration to create or update Campaign records.

To enable this setting:

1. In Salesforce, go to Setup > Users > Users.
2. Open the integration user.
3. Click Edit.
4. Select Marketing User, then save your changes.

Object permissions

Grant Read, Create, Edit, and Delete permissions for these objects:

• Account.
• Contact.
• AccountContactRelation.
• Campaign.
• GiftTransaction.
• GiftCommitment.
• GiftCommitmentSchedule.
• GiftRefund.
• GiftDesignation.
• GiftTribute.
• GiftTransactionDesignation.

To configure object permissions:

1. In Salesforce, go to Setup > Users > Profiles.
2. Open the profile assigned to the integration user.
3. Open Object Settings.
4. Select an object, then click Edit.
5. Select Read, Create, Edit, and Delete.
6. Save your changes, then repeat these steps for each required object.

Access for an existing integration

When you move an existing integration to a dedicated Salesforce user, also grant View All and Modify All for these objects:

• Account.
• GiftTransaction.
• GiftDesignation.
• GiftCommitment.

These permissions let the new integration user access records that another Salesforce user created or owns.

Contact Point Email access

If you configure the integration to synchronize supporter email addresses to Contact Point Email, grant the integration user access to the ContactPointEmail object. Also grant field-level access to its ParentId field.

Fundraise Up ID field

During connection or reconnection, Fundraise Up creates or updates the GiftTransaction.FundraiseUpId__c field. The integration uses this field to identify synchronized GiftTransaction records.

The integration user needs:

• Metadata access to create or update the field.
• Read and edit field-level access to GiftTransaction.FundraiseUpId__c.
• Permission to update the integration user’s profile when Fundraise Up configures field-level access automatically.

If your organization manages field-level security with permission sets instead of the user profile, make sure that the effective permissions still give the connected user read and edit access to this field.

Verify effective access

Salesforce calculates a user’s effective access from several layers. Before connecting or reconnecting the integration, verify all of these layers:

• The Salesforce user license supports the required objects and system permissions.
• The user profile includes the required baseline access.
• Assigned permission sets and permission set licenses provide any additional access.
• Field-level security allows the user to read and edit fields used by the integration.
• Record type assignments include the Person Account and Organization Account record types.
• The Marketing User checkbox is selected on the user record.

After updating permissions, reconnect the integration and confirm that the connection completes without permission or metadata errors.