Salesforce for License Logic Setup Guide

Overview

The Salesforce integration reads which licence each of your Salesforce users actually holds — not just who signs in, but what they are assigned and therefore what they cost.

Marketing Cloud is a separate connection. Salesforce Marketing Cloud Engagement authenticates through a different mechanism entirely, and has its own tile and its own guide. Connecting one does not connect the other, and connecting one does not overwrite the other.

What the connection is for

Two people can sign into Salesforce identically and cost you very different amounts. One holds a full Sales Cloud licence and a CPQ permission set licence; the other holds a Platform licence. The sign-in record looks the same for both. Only Salesforce knows which is which, and only its API can tell us — which is what makes this integration different from the SSO and desktop-agent data License Logic already has.

Key Benefits

• Per-user licence assignment — which user licence and which permission set licences each person actually holds
• Entitlement against consumption — licences purchased compared with licences assigned
• Reclaim candidates — expensive licences assigned to people with no matching activity

What you get

• A self-serve connection on the Integrations page
• Your Consumer Key and Consumer Secret stored encrypted, and checked against your org when you connect
• Connection status visible to your team, showing whether the credentials were accepted

Prerequisites

You need a License Logic account and a Salesforce administrator. The Salesforce side takes about fifteen minutes.

License Logic Requirements

• Account: active License Logic subscription
• Role: a role holding Settings: Edit — that is what the Connect action checks
• Page: Integrations in the left sidebar, which requires Integrations: View

If the Integrations page is missing, or Connect does nothing. These are two different permissions. Integrations: View shows the page and the tiles; Settings: Edit is what allows a connection to be made. A user can hold the first without the second, see the tile, and be unable to complete the connection. Your License Logic administrator grants both in People → Roles.

Salesforce Requirements

• Edition: an edition that permits API access and connected apps
• Role: a Salesforce administrator who can reach Setup → App Manager and edit connected app policies
• A dedicated integration user — the connected app runs as this user, and its permissions become the integration’s permissions
• My Domain enabled, so you have a <yourcompany>.my.salesforce.com host
• Network: nothing to install. License Logic calls your org outbound over HTTPS

The integration user is the real permission boundary. The client credentials flow runs as a specific Salesforce user that you nominate. Whatever that user can see, the integration can see — so nominate a dedicated integration user with only the object and field access this needs, not an administrator. This is enforced by Salesforce, not by a promise from us.

Setup Guide

There is one connection method: a connected app using the OAuth 2.0 client credentials flow. It is a pure machine-to-machine exchange — no redirect, no consent screen, no user password. Steps 1 to 4 are done in Salesforce; step 5 is done in License Logic.

Two different screens. The client credentials flow is enabled where you create the app, but the user it runs as is set somewhere else entirely — under Manage → Edit Policies. Missing the second screen is the most common reason a correctly built app cannot get a token.

Step 1: Create the connected app

1. In Salesforce, go to Setup, enter App Manager in Quick Find, and select App Manager
2. Click New Connected App
3. Give it a name such as License Logic Integration and supply a contact email
4. In the API (Enable OAuth Settings) section, tick Enable OAuth Settings

Step 2: Set the scope and enable the flow

1. Under Selected OAuth Scopes, add Manage user data via APIs (api)
2. Tick Enable Client Credentials Flow
3. Save the app

Salesforce may take a few minutes to apply a new or changed connected app. If the connection fails immediately after you save, wait several minutes and try again before changing anything — retrying too quickly is the most common cause of a failure that fixes itself.

Step 3: Assign the integration user

This is the step on the second screen.

1. From the connected app’s detail page, click Manage
2. Click Edit Policies
3. Under Client Credentials Flow, select the dedicated integration user the app should run as
4. Save

Without this, the app cannot obtain a token. The client credentials flow has no signed-in user to act as, so Salesforce requires you to nominate one explicitly. An app with the checkbox ticked but no run-as user set will fail at the token request with an error that does not obviously point here.

Step 4: Retrieve the Consumer Key and Consumer Secret

1. On the connected app’s page, click Manage Consumer Details
2. Verify your identity if prompted
3. Copy the Consumer Key and Consumer Secret

You will also need your My Domain URL, from Setup → My Domain. It looks like yourcompany.my.salesforce.com.

Step 5: Connect in License Logic

1. In License Logic, click Integrations in the left sidebar
2. Find the Salesforce tile and click Connect
3. Enter your My Domain URL — hostname only, with no https:// and no trailing slash
4. Optionally enter the Integration user — the user you nominated in Step 3, recorded so your team knows whose permissions apply
5. Paste the Consumer Key and Consumer Secret
6. Click Connect

Field	Required	What to enter
My Domain URL	Yes	yourcompany.my.salesforce.com. Hostname only. Must be a .salesforce.com address
Integration user	No	The user the connected app runs as. Recorded for your reference only
Consumer Key	Yes	From Manage Consumer Details. Stored encrypted
Consumer Secret	Yes	From Manage Consumer Details. Stored encrypted; never shown again

Enter the host, not the full URL. The field takes yourcompany.my.salesforce.com — not https://yourcompany.my.salesforce.com/ and not plain salesforce.com, which is nobody’s org host and is correctly rejected. Legacy instance hosts such as na123.salesforce.com are accepted.

What Data Is Synced

Salesforce is the most complete of these integrations, because it publishes both halves of the licence picture: which licence each person is assigned, and how many of each licence you own. Most systems answer only the first.

Users

From the User object:

Field	Used for
Id	Internal key for joining assignments to people
Name	Display name
Email	The join key to your License Logic employee records
IsActive	Excludes deactivated users from assigned-seat counts
LastLoginDate	Identifies assigned seats with no recent use
UserType / Profile.Name	Context for what the user is
Department, Title	Where present, for grouping by team

Base licence, per user

Each user’s base licence comes from User.UserLicenseId, resolved against the UserLicense object. This is what separates a full Sales Cloud user from a Platform user — two people whose sign-in records look identical and whose cost is not.

Add-on licences, per user

Permission set licences are the add-ons that sit on top of a base licence — CPQ, Field Service, Einstein and similar. These come from PermissionSetLicenseAssign (AssigneeId and PermissionSetLicenseId), which is the row that says this person holds this add-on. Nothing else substitutes for it.

What you own

Entitlement totals come from two objects:

Object	Fields	Gives you
UserLicense	Name, MasterLabel, TotalLicenses, UsedLicenses, Status	Base licences owned against used
PermissionSetLicense	MasterLabel, TotalLicenses, UsedLicenses, ExpirationDate	Add-on licences owned against used, and when they lapse

Inactive assignments are excluded, and that is load-bearing. When a licence line is superseded, vendors routinely leave the old assignment rows in place rather than clearing them — so the same person appears against both the dead licence and its replacement. Counting those stale rows inflates assigned seats and shrinks the idle-seat number by the same amount, which is precisely the figure you would have acted on. Only live assignments are counted.

Read-only, and narrow. Every call is a SOQL read against the objects above. License Logic issues no writes, and reads no leads, opportunities, accounts, cases or custom objects — it has no reason to and does not ask for them. What it can see at all is bounded by the integration user you nominated.

Where Your Salesforce Data Appears

Salesforce data lands in the places you already use to answer licence questions, rather than in a separate Salesforce area you would have to remember to visit.

Applications

Your Salesforce row on the Applications page stops relying on sign-in counts and starts showing licence facts:

• Total licences — the seats you hold, sourced from the Salesforce API rather than typed in by hand
• Assigned — how many of those seats are actually allocated to a person
• Breakdown by licence type — entitled against assigned, per licence, ordered so the largest gap is first. That top row is the one worth acting on, and it is rarely the alphabetically-first one
• Idle seats — the difference, which is the number that converts into a renewal conversation

Application drill-down

Opening Salesforce shows every holder with the base licence and any add-on licences they hold, plus when they last signed in. This is the view that turns “we are over-licensed” into a specific list of names, which is what a reclaim actually needs.

Insights → Employee

Each employee’s record gains Salesforce as a source alongside SSO sign-in, desktop agent and card-spend data. Opening a person shows the applications they hold, so a leaver review or a role change can see the Salesforce seat in the same place as everything else they hold.

Suppliers and renewals

Because seat counts arrive as data rather than as a number someone typed into a contract, your Salesforce agreement can be compared against actual allocation as the renewal approaches — which is the moment the difference is worth money.

Where a utilisation percentage would mislead, we leave it blank. Some products carry a large free or limited tier, so dividing users by paid seats produces a confident-looking figure that is simply wrong. Where that applies, License Logic shows no pacing rather than a computed number — an honest gap beats a precise fiction.

Two switches, not one. A tenant needs the integration connected and the licence display enabled for it. That is deliberate: it stops a seat panel appearing for a tenant whose connection cannot actually compute one, which would show an empty panel rather than an honest absence. We enable both together and tell you when we have.

Sync Schedule & Refresh

Daily sync

License Logic reads Salesforce once per day, overnight UTC, in the same window as our other licence integrations. Each run replaces the previous day’s picture, so revoked seats and new assignments are both reflected without anything to reconcile by hand.

Initial sync

Your first sync is scheduled once your connection is confirmed, and completes in minutes for a typical org — it reads user and licence metadata, not your records, so its size is a function of headcount rather than data volume.

What triggers a sync

• Initial connection — your first sync is scheduled once your connection is confirmed
• Daily scheduled sync — automatically, once per day
• Reconnection — reconnecting with new credentials resumes syncing on the next scheduled run

A failed sync leaves yesterday’s data in place. If a run cannot complete — Salesforce is unreachable, or the credential has been revoked — License Logic keeps the previous successful result rather than emptying the panel. “This tenant has no licences” and “we could not read them today” look identical on screen, so we never let a failure produce the first one.

Disconnecting Salesforce

Disconnecting deletes your stored Salesforce credentials. They are removed from the database outright, not disabled behind a flag, so reconnecting means entering them again, and any data already synced is removed with them. Your Salesforce account itself is untouched, but you may need to issue a new credential there if you did not keep the original.

To disconnect:

1. Go to Integrations in the left sidebar
2. Find the Salesforce tile (showing “Connected”)
3. Click Disconnect
4. Confirm in the dialog

Revoking from the Salesforce side

In Salesforce, go to Setup → App Manager, find the connected app, and either delete it or use Manage → Edit Policies to block access. You can also rotate the Consumer Secret from Manage Consumer Details, which invalidates the copy License Logic holds. Any of these stops the connection immediately.

Revoking on the vendor side and disconnecting in License Logic are independent. Doing both is the complete removal: one stops the credential working, the other removes our copy of it.

Security & Data Handling

What License Logic holds

A connected app’s Consumer Key and Consumer Secret — never a user password. These are application credentials issued by Salesforce. They cannot be used to sign in to Salesforce as a person, and they can be revoked without touching any user account. Optionally, your My Domain host and the name of your integration user, neither of which is a secret.

Control	Detail
Encryption at rest	AES-256-GCM with a random initialisation vector per value, applied before the value is written to storage
In logs	Never written. Connection events are logged with the credential values redacted
Retrievable via API	Never returned — not even to your own administrators. The connection-status endpoint is built from the non-secret fields only, so a secret cannot be read back through it
In transit	TLS 1.2 or above, passed in a request header or form body. Never placed in a URL or query string
Who can connect or disconnect	Only a user holding Settings: Edit in your License Logic tenant
Who can see the connection status	A user holding Integrations: View. Status shows the non-secret settings, whether the connection is verified, and when it was made
Tenant scope	Stored against your License Logic tenant. Connect, status and disconnect are all keyed on the caller’s own tenant, so no request from another customer can reach your connection
Permissions the credentials carry	Those of the integration user you nominated in Setup Step 3, as enforced by Salesforce. License Logic cannot widen this
Relationship to Marketing Cloud	Stored separately. Connecting or disconnecting one has no effect on the other, and neither can overwrite the other

Verification on connect

When you click Connect, License Logic stores your credentials and then makes one live call to Salesforce to check them. The tile shows verified if that call succeeds.

A failed check never discards your credentials. They are stored first and checked second, deliberately: a network problem on our side must not cost you a credential you have already generated. If the check does not succeed, the tile reports that the credentials were saved but not yet confirmed, and you can correct the details without going back to Salesforce to issue a new one.

Where your credentials are sent

The My Domain URL you enter is restricted to a .salesforce.com address. That restriction is a security control, not a convenience: the verification call sends your client secret to the host you type, so accepting an arbitrary hostname would make this form a way to have License Logic deliver your secret to somewhere it should not go. If you paste a host outside that domain, the connection is refused before anything is sent.

Access control

• Settings: Edit is required to connect or disconnect
• Integrations: View is required to see the Integrations page and connection status
• All endpoints are authenticated through your License Logic session

Data retention

Credentials are retained until you disconnect, at which point they are deleted from the database outright rather than disabled behind a flag.

Deleting the connected app or rotating its Consumer Secret in Salesforce stops the connection immediately, whether or not you also disconnect in License Logic. Doing both is the complete removal.

For more about License Logic’s security practices, see our Security Policy or contact security@licenselogic.co.

Troubleshooting

“Credentials saved, verification pending”

The credentials were stored but the token request did not succeed. In order of likelihood:

• You tried within a few minutes of saving the app. Salesforce takes a short while to apply a new or changed connected app. Wait several minutes and reconnect before changing anything
• No run-as user is set. Setup Step 3 — Manage → Edit Policies → Client Credentials Flow. The flow cannot issue a token without one, and this is the most commonly missed step
• Enable Client Credentials Flow is not ticked on the app
• The scope is missing. The app needs Manage user data via APIs (api)
• The Consumer Secret was truncated or is stale after a rotation
• The My Domain host is wrong — it must be the host of the org where the app was created

Your credentials are stored either way, so you can correct the Salesforce side and reconnect without generating a new key pair.

“My Domain URL should be your own .salesforce.com host”

The host you entered is outside .salesforce.com, or is the bare apex salesforce.com. Enter your own org host, for example yourcompany.my.salesforce.com. Find it at Setup → My Domain.

The Connect button does nothing, or the tile is missing

This is almost always permissions. Integrations: View shows the page; Settings: Edit is required to connect. Ask your License Logic administrator to check both in People → Roles.

Connected, but no data has appeared yet

Your first sync is scheduled once your connection is confirmed, so data appears shortly after rather than the instant you click Connect. If the tile shows the connection as verified, the credential side is done. If nothing has appeared after your first scheduled sync, contact support and we will look at the run.

We connected Marketing Cloud and now Salesforce shows as disconnected

That should not happen: they are stored as two independent connections and neither overwrites the other. If you are seeing it, contact support — that is a fault worth reporting rather than working around.

Frequently Asked Questions

Does License Logic receive a Salesforce user’s password?

No. The connection uses OAuth 2.0 client credentials, so License Logic holds a connected app’s Consumer Key and Consumer Secret issued by Salesforce. Those cannot be used to sign in as a person.

Can License Logic change anything in our Salesforce org?

No. The integration reads licence and user information. It does not create, edit or delete records, users, permission sets or configuration. Today it does not read anything at all.

What can the connected app actually see?

Exactly what the integration user you nominated can see, as enforced by Salesforce. That is why the guide recommends a dedicated integration user rather than an administrator: it is the control you hold, and it is a real one.

Do we need a separate connection for Marketing Cloud?

Yes. Marketing Cloud Engagement authenticates through an Installed Package rather than a connected app, and has its own tile and its own guide. The two are stored independently and do not interfere with each other.

Do we need one connection per Salesforce org?

Each License Logic tenant holds one Salesforce core connection. If you run several production orgs and need all of them covered, contact support so we can plan that properly rather than having you overwrite one with another.

Who at our company can see this connection?

Anyone with Integrations: View can see that Salesforce is connected, the My Domain host, the integration user name if you entered one, and whether the credentials were verified. The Consumer Key and Secret are never shown to anyone, including your own administrators.

What happens if we disconnect?

The stored credentials are deleted from License Logic, and any Salesforce data already synced is removed with it. Your Salesforce account itself is untouched — the connected app remains valid there until you revoke it.

Support

If you need help with the Salesforce integration:

• Email: support@licenselogic.co
• In-app chat: click the chat icon in the bottom-right corner of License Logic
• Security questions: security@licenselogic.co

When contacting support, please include your company name, your My Domain host, and a description of the issue. Never send a credential by email — if we need to look at a connection, we can do so from our side.

If you would like to be told when the sync for this integration is enabled, say so and we will add you to the notification list for it.