---
title: "Salesforce integration requirements"
slug: "salesforce-integration-requirements"
description: "What your Salesforce org needs to connect to Opensense: admin access, the AppExchange package, and permissions for targeting, signatures, and user sync."
updated: 2026-10-14T00:00:00.000Z
canonical: "https://help.opensense.com/docs/salesforce-integration-requirements"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.opensense.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce integration requirements

## Overview

This article describes what your Salesforce org needs to connect to Opensense. The permissions and configuration depend on which features of the integration you use. Your Opensense implementation team handles the configuration after your requirements are confirmed.

:::note[Available on select plans]
Salesforce integration is available on select Opensense plans. Contact your account manager to confirm that your plan includes CRM connectivity.
:::

## Before you start

You need:

- A Salesforce admin account
- Your Salesforce **Instance URL** (for example, `https://yourcompany.my.salesforce.com`)
- The **admin email address** for your Salesforce account
- API access turned on for your Salesforce org

:::caution[Use the salesforce.com URL]
To find your Instance URL in Lightning Experience, select your avatar, then **View Profile**. You can also find it in **Setup**: search for **My Domain**, and use the **Current My Domain URL**. Use the `*.salesforce.com` version of the URL, not `*.lightning.force.com`.
:::

## What you can use this integration for

The Opensense Salesforce integration supports three independent use cases. You can use one, two, or all three, depending on your organization's needs.

<dl class="kb-insights-summary">
  <div><dt id="recipient-based-banner-targeting">Recipient-based banner targeting</dt><dd>Opensense queries your Salesforce CRM data to decide which banner campaign content to serve on outbound emails. Banners can target the recipient's contact, account, lead, or opportunity attributes. This is the most common use of the Salesforce integration.</dd></div>
  <div><dt id="salesforce-email-signatures">Salesforce email signatures</dt><dd>For teams that send email directly from Salesforce, Opensense applies centrally managed signatures to those emails. Opensense pushes a <a href="https://help.opensense.com/docs/choose-a-deployment-method#plain-text-block-ptp">Plain Text Block (PTP)</a> to each user's native Salesforce email signature field. It then processes outbound emails through its relay, to add the full signature before delivery.</dd></div>
  <div><dt id="user-directory-sync">User directory sync</dt><dd>Opensense pulls your Salesforce user records as the source of truth for sender signature fields: name, title, phone, department, and similar data. This is useful for organizations that manage employee data mainly in Salesforce, rather than in a directory like Microsoft 365 or Google Workspace.</dd></div>
</dl>


## Required for everyone: the AppExchange package

Whichever features you use, install the Opensense managed package in your Salesforce org from the AppExchange. Your implementation team gives you the listing link. After installation, configure the connected app so that all user profiles have access.

The integration is installed in your **production** Salesforce org.

:::caution[Need a sandbox?]
If you need a sandbox configuration, give Opensense that information during implementation.
:::

To complete the configuration, your Salesforce admin needs access to **Manage Connected Apps** (in **Setup**, under **Apps** > **Connected Apps**), to authorize the Opensense app and assign profiles.

## Permissions by use case

The object and field permissions depend on which features of the integration your organization uses. Find your use cases in the columns, then review their sections below.

<div class="kb-deployment-compare kb-deployment-compare--plain">
  <div class="kb-deployment-compare__viewport" role="region" aria-label="Salesforce permissions by use case" tabindex="0">
    <table>
      <colgroup><col class="kb-deployment-compare__feature-col"></colgroup>
      <thead>
        <tr>
          <th scope="col">Object or setting</th>
          <th scope="col"><span class="kb-deployment-compare__method">Banner targeting</span></th>
          <th scope="col"><span class="kb-deployment-compare__method">Salesforce signatures</span></th>
          <th scope="col"><span class="kb-deployment-compare__method">Directory sync</span></th>
        </tr>
      </thead>
      <tbody>
        <tr><th scope="row">Contact, Lead, Account, Opportunity</th><td>Read</td><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td></tr>
        <tr><th scope="row">User</th><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td><td>Read and edit</td><td>Read</td></tr>
        <tr><th scope="row">User: Email Signature field</th><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td><td>Write</td><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td></tr>
        <tr><th scope="row">User: sender data fields</th><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td><td>Read</td></tr>
        <tr><th scope="row">Email Delivery Settings and Deliverability (Setup)</th><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td><td>Admin access</td><td><span aria-hidden="true">—</span><span class="sr-only">Not needed</span></td></tr>
      </tbody>
    </table>
  </div>
</div>

:::caution[Field-level security applies to every object]
If the admin account used for the integration can't see a field, Opensense returns a blank value for that field, even when it has object-level read access.
:::


### Banner targeting permissions

Opensense needs read access on the Salesforce objects it queries for targeting. At minimum, it needs read access on the objects that your banner campaigns target:

<dl class="kb-insights-summary">
  <div><dt>Contact</dt><dd>Contact-level recipient targeting</dd></div>
  <div><dt>Lead</dt><dd>Lead-level recipient targeting</dd></div>
  <div><dt>Account</dt><dd>Account-level ABM targeting</dd></div>
  <div><dt>Opportunity</dt><dd>Deal stage targeting</dd></div>
</dl>

:::note[Read-only access]
This access is **read-only**. Opensense doesn't create, update, or delete CRM records.
:::

To find the Salesforce field API names to use for targeting, see [Finding Salesforce field API names to query in Opensense](https://help.opensense.com/docs/how-to-find-fields-you-would-like-to-query).


### Salesforce signature permissions

To apply Opensense signatures to emails sent from Salesforce, your Salesforce admin needs two more areas of Salesforce Setup:

<dl class="kb-insights-summary">
  <div><dt>Email Delivery Settings</dt><dd>To route email through Opensense, on the <strong>Email Relays</strong> page. Salesforce also needs an email domain filter (<strong>Email Domain Filters</strong>) for a relay to work.</dd></div>
  <div><dt>Deliverability</dt><dd>To update the email delivery configuration to allow relay processing.</dd></div>
</dl>

Opensense also needs read and edit access on the **User** object, specifically write permission on the native **Email Signature** field. This is how Opensense pushes the Plain Text Block to each user's Salesforce signature, so that only the Opensense-managed signature is in use.

:::note[The only write access]
**Write access** on the **User Email Signature field** is the only place in the Opensense integration where data is written to your Salesforce org. All other access is **read-only**.
:::


### Directory sync permissions

To sync sender data, Opensense needs read access on the **User** object, and field-level read access on these fields:

- First Name, Last Name, Email
- Title, Department, Company Name
- Phone, Mobile Phone

:::note[Active users only, by default]
This access is **read-only**. By default, Opensense syncs active users only. Your Opensense admin can turn on inactive user sync in domain settings, if needed.
:::


## What's next

- [Finding Salesforce field API names to query in Opensense](https://help.opensense.com/docs/how-to-find-fields-you-would-like-to-query)
- [Assigning Opensense tags with Salesforce Flow Builder](https://help.opensense.com/docs/salesforce-workflow)
- [Setting up your email signature in Salesforce](https://help.opensense.com/docs/how-do-you-setup-your-salesforce-email-signature)

For further help, contact Opensense Support at [help@opensense.com](mailto:help@opensense.com).