Stop Connecting Your Integrations Through One Person's Login

This summer, a team I work with realized new leads from their help desk had stopped showing up in Salesforce. The leads were still coming in. They just weren't making it across.

The culprit was the sync between their help desk and Salesforce. It had been connected years earlier using an admin's personal Salesforce login. When that user's access was revoked, the connection dropped, and when we went to reconnect it, every field mapping had been wiped. For weeks, new leads only existed in the help desk, and nobody got an alert.

We kept the business moving with manual imports while the vendor sorted out their side. But the real fix was making sure it couldn't happen that way again.

Why this happens

When someone sets up an integration, the fastest path is to click "Connect to Salesforce" and log in as yourself. It works right away, so nobody thinks about it again. But now that integration depends on one person:

• Their password. A reset or an expired password can break the connection.
• Their permissions. Change their profile or remove a permission set, and the integration quietly loses access to the objects it writes to.
• Their employment. Deactivate the user when they leave and everything connected through them stops.
• Their name on everything. Every record the integration touches shows that person as the last modifier, so it's hard to tell what was changed by a human and what was changed by a sync.

It's one of the most common things I find in orgs that have grown without a full-time admin, and it's almost always invisible until something breaks.

The fix

1. List every integration and who it runs as. In Setup, Connected Apps OAuth Usage shows which apps are connected and which users authorized them. Login History, filtered to API logins, fills in the rest. Add anything installed as a package. You'll likely find a few tools nobody remembers connecting.
2. Create integration users. Salesforce Enterprise, Unlimited and Performance editions include five free Integration user licenses. They're API-only, so no one can log in to the UI with them, which is exactly what you want. Set them up with the "Salesforce API Only System Integrations" profile and the "Salesforce API Integration" permission set, and give each one a clear name like "Help Desk Integration."
3. Grant only what each integration needs. Build a permission set per integration with access to just the objects and fields it reads or writes. If a tool gets compromised or misbehaves, the damage stays small. And Last Modified By now tells you exactly which system made a change.
4. Save the mappings before you reconnect. Some tools reset field mappings when the connection changes. Take screenshots or export the mapping configuration first. This is the step that would have saved us a day of rebuilding.
5. Reconnect one integration at a time and test end to end. Pick a quiet window, switch the connection to the new integration user, and push a real test record through: a test ticket, a web form, a new contact. Confirm it lands where it should with the right fields filled in.
6. Watch for silence. A broken integration rarely throws an error you'll see. Build a simple report of records created by each integration user this week and put it on an ops dashboard. If a number that's usually in the dozens drops to zero, you'll know within days, not weeks.
7. Keep a fallback. Know how to export from the source tool and import into Salesforce by hand, so the team keeps working while you fix the connection.

A quick note: a few tools still need a full Salesforce license to work, so check with the vendor before you switch. And if you're on HubSpot, the same idea applies. Use private apps, whose access tokens belong to the app rather than a person, and make sure more than one admin knows what's connected.

How to tell if this is you

• Records in Salesforce show a real person as "Last Modified By" at 3 a.m.
• Nobody can say which user each integration connects through
• An integration has broken after someone left or reset a password
• You've found out a sync was down from a customer or a rep, not an alert
• Your connected tools were set up by someone who isn't on the team anymore

If any of these sound familiar, moving to integration users is usually a day or two of work, and the licenses are already included in most editions. Duplicate records are the other common way integrations go quietly wrong, so it's worth a look at how duplicate accounts break syncs too.

FAQ

What is a Salesforce Integration user license?

An API-only license for system integrations. Enterprise, Unlimited and Performance editions include five free, and Developer edition includes one.

Why did my Salesforce integration suddenly stop syncing?

A common cause is that the user it connects through was deactivated, changed their password or lost a permission. Check Connected Apps OAuth Usage and Login History in Setup to see which user it runs as.

Can every integration use an Integration user license?

Most API-based integrations can, but some tools still need a full Salesforce license. Check with the vendor before you switch.

How do I know if an integration has stopped working?

Report on records created by each integration user over time. A sudden drop to zero is usually the first sign.

If you'd like help untangling what's connected to your org, I'm always happy to talk it through.