> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Salesforce for Email Reply Management

> Connect Salesforce to allGood for Email Reply Management, and grant the exact permissions Mary needs to write reply-classification results back to your CRM.

This guide walks you through connecting Salesforce to allGood for [Email Reply Management](/use-cases/erm/overview) and granting the dedicated allGood user the permissions Mary needs.

For ERM, Mary looks a reply's sender up in Salesforce by email, then writes the result of her classification back to the matching **Contact** or **Lead** — flipping opt-out fields on `Unsubscribe`, recording rationale, and adding senders to campaigns. Because Mary acts on records she doesn't *own*, the permission setup below is stricter than a read-only sync, and getting it right is what makes the difference between Mary finding a record and Mary silently finding nothing.

<Note>
  Already have Salesforce connected for another Mary use-case? You still need to
  confirm the [object permissions](#grant-object-permissions) and [field-level
  security](#field-level-security-fls) below — the ERM write-backs require `View
      All` / `Modify All` on **Contact** and **Lead**, which a read-only profile
  won't have.
</Note>

## Prerequisites

Before setting up the Salesforce integration for ERM, ensure you have:

* **Salesforce Account** with Enterprise access or API quota purchased
* **Admin access** to your Salesforce instance to create users and profiles
* **Access to email** for the dedicated Salesforce user account verification
* **allGood account** with integration permissions

## Step-by-Step Setup

<Steps>
  <Step id="create-allgood-profile" title="Create allGood Profile in Salesforce">
    1. **Log in to Salesforce** with an admin account
    2. Click the **gear icon** (top right) → **Setup**
    3. In left navigation: **Administration** → **Users** → **Profiles**
    4. Click **New Profile**
    5. Set **Existing Profile** to **Read only**
    6. Set **Profile Name** to **allGood User**
    7. Click **Save**
  </Step>

  <Step id="grant-object-permissions" title="Grant Object Permissions">
    Grant these on the **allGood User** profile (Setup → **Users** → **Profiles** → **allGood User** → **Edit**):

    | Object              | Read | Create | Edit | View All | Modify All |
    | :------------------ | :--: | :----: | :--: | :------: | :--------: |
    | **Contact**         |   ✅  |    ✅   |   ✅  |     ✅    |      ✅     |
    | **Lead**            |   ✅  |    ✅   |   ✅  |     ✅    |      ✅     |
    | **Campaign**        |   ✅  |        |   ✅  |     ✅    |            |
    | **Campaign Member** |   ✅  |    ✅   |   ✅  |          |            |

    <Warning>
      **`View All` and `Modify All` on Contact and Lead are required, not optional.** The allGood user does not *own* the records it looks up by email. With only `Read`/`Edit`, Salesforce's sharing model hides records the user doesn't own, so Mary's lookup finds nothing, or the update fails on records it can't access. `View All` lets Mary find any matching record; `Modify All` lets her write to records she doesn't own.
    </Warning>

    To set them:

    1. Go to Setup → **Users** → **Profiles**, click **Edit** next to **allGood User**.
    2. Under **Standard Object Permissions**, set the checkboxes exactly as in the table above:
       * **Contact** and **Lead** → **Read, Create, Edit, View All, Modify All**
       * **Campaign** → **Read, Edit, View All**
       * **Campaign Member** → **Read, Create, Edit**
    3. Leave **Delete** unchecked on every object — the integration never deletes records.
    4. Scroll to the top and click **Save**.

    <Frame caption="Enable the standard object permissions for each of the above object types.">
      <img src="https://mintcdn.com/allgoodtechnologyinc/ehJX4q8SzeGZVVYO/images/CleanShot2026-02-17at17.54.21@2x.png?fit=max&auto=format&n=ehJX4q8SzeGZVVYO&q=85&s=3d283e67157b487e576e3ebb6d94fc78" alt="Enable SFDC object permissions" width="1348" height="376" data-path="images/CleanShot2026-02-17at17.54.21@2x.png" />
    </Frame>
  </Step>

  <Step id="field-level-security-fls" title="Field-Level Security (FLS)">
    Object-level permissions do **not** cover individual fields — field access is controlled separately by Field-Level Security (FLS). Grant the allGood User profile **Read + Edit** on the fields Mary writes:

    1. Go to Setup → **Object Manager** → **Contact** → **Fields & Relationships** → **Email Opt Out**.
    2. Click **Set Field-Level Security**.
    3. For the **allGood User** profile, check **Visible** and leave **Read-Only** unchecked, then **Save**.
    4. Repeat for **Lead**: Object Manager → **Lead** → **Fields & Relationships** → **Email Opt Out** → **Set Field-Level Security** → **Visible** (not Read-Only) → **Save**.
    5. Do the same for any other fields you configure Mary to write, plus **Company** on **Lead** (Salesforce requires it when creating new Leads).

    <Note>
      Standard required fields (**Email**, **Last Name**) are always visible and need no FLS change.
    </Note>
  </Step>

  <Step id="create-dedicated-user" title="Create Dedicated User Account">
    1. In left navigation: **Administration** → **Users** → **Users**
    2. Click **New User**
    3. Fill required fields:
       * **License**: Select **Salesforce**
       * **Profile**: Select **allGood User**
       * **Email**: Use accessible team email address that somehow indicates "allGood"
       * Make sure the `Marketing User` box is checked.
    4. Click **Save**
    5. **Copy the Username** and store it securely
  </Step>

  <Step id="verify-user-account" title="Verify User Account">
    1. Check the email inbox used for the new user
    2. Open the Salesforce verification email
    3. Follow the verification link and **set a password**
    4. **Store the password** securely.
  </Step>

  <Step id="connect-integration" title="Connect Integration in allGood">
    1. **Log into allGood** and navigate to **Settings** → **Integrations**. Click **Install** next to "Salesforce".

           <Frame caption="Click &#x22;Install&#x22; on the Salesforce integration.">
             <img src="https://mintcdn.com/allgoodtechnologyinc/Ch_ZZInnFMnauFYj/images/integrations/salesforce/add-integration.png?fit=max&auto=format&n=Ch_ZZInnFMnauFYj&q=85&s=8d14d81b7ac8fcd579a0e48f670cdf24" alt="allGood integrations page" width="3083" height="689" data-path="images/integrations/salesforce/add-integration.png" />
           </Frame>
    2. **Select the right SFDC environment** (either production/live, sandbox, or a custom instance login URL)

           <Frame caption="Select the right SFDC environment">
             <img src="https://mintcdn.com/allgoodtechnologyinc/ehJX4q8SzeGZVVYO/images/CleanShot2026-02-17at17.58.01@2x.png?fit=max&auto=format&n=ehJX4q8SzeGZVVYO&q=85&s=4beff7a7fee86c9a096120d132212864" alt="Select the right SFDC environment" className="mx-auto" style={{ width:"63%" }} width="1294" height="790" data-path="images/CleanShot2026-02-17at17.58.01@2x.png" />
           </Frame>
    3. Click **Connect to Salesforce** .

           <Frame caption="Connect to Salesforce">
             <img src="https://mintcdn.com/allgoodtechnologyinc/ehJX4q8SzeGZVVYO/images/CleanShot2026-02-17at17.58.45@2x.png?fit=max&auto=format&n=ehJX4q8SzeGZVVYO&q=85&s=3d043dbbf473e90abc7d3a21131ac074" alt="Connect to Salesforce" className="mx-auto" style={{ width:"51%" }} width="1214" height="808" data-path="images/CleanShot2026-02-17at17.58.45@2x.png" />
           </Frame>
    4. Sign in using the **allGood user credentials** created above
    5. Verify the integration shows as **Active** on your integrations page
  </Step>
</Steps>

## Verification & Testing

If Salesforce shows "Active" status in allGood integrations, Mary was able to connect successfully.

Object-level access and FLS only surface at execution time, so verify the write path end-to-end before going live:

* Send a message against a category whose actions write to Salesforce.
* Confirm the target **Contact**/**Lead** actually updated — including the `Email Opt Out` field for `Unsubscribe`.
* If the record wasn't found or the update was silently skipped, re-check `View All` / `Modify All` on **Contact** and **Lead** and the FLS on the field being written.

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Why does Mary need View All / Modify All when she already has Read / Edit?">
    The allGood user doesn't *own* the Contact and Lead records it looks up by
    email. Salesforce's sharing model hides records a user doesn't own, so with
    only `Read`/`Edit`, Mary's lookup finds nothing (or the update fails on a
    record she can't touch). `View All` lets her find any matching record;
    `Modify All` lets her write to records she doesn't own.
  </Accordion>

  <Accordion title="Do I need to grant Delete on any object?">
    No. The integration never deletes records — leave **Delete** unchecked on
    every object.
  </Accordion>

  <Accordion title="Mary's update runs but the field doesn't change. What's wrong?">
    Almost always Field-Level Security. Object permissions don't cover
    individual fields — confirm the allGood User profile has the field set to
    **Visible** (not Read-Only) under **Set Field-Level Security** for both
    **Contact** and **Lead**.
  </Accordion>

  <Accordion title="Which Salesforce edition do I need?">
    The integration works with Professional, Enterprise, and Unlimited editions.
    Developer and Essentials editions have limited API access.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Error: 'No such column HasOptedOutOfEmail' (or another field)">
    This is a Field-Level Security issue, not a missing field. When the allGood
    User profile can't see a field, Salesforce reports it as if the column
    doesn't exist. Grant **Read + Edit** FLS on the field for the allGood User
    profile (see the [field-level security step](#field-level-security-fls)
    above).
  </Accordion>

  <Accordion title="Mary reports 'no Contact or Lead found' for a person who exists">
    The allGood user likely lacks **View All** on Contact/Lead, so records it
    doesn't own are hidden by your org's sharing model. Enable **View All
    Records** on both Contact and Lead.
  </Accordion>

  <Accordion title="An update fails with 'insufficient access'">
    The user can *read* the record but not *edit* one it doesn't own. Enable
    **Modify All Records** on Contact and Lead (in addition to Edit).
  </Accordion>

  <Accordion title="Adding to a campaign fails with 'insufficient access'">
    Confirm three things: the **Marketing User** flag is enabled on the allGood
    user, the profile has **Edit** on **Campaign**, and it has **Create** on
    **Campaign Member**. All three are required to add a member.
  </Accordion>

  <Accordion title="A field isn't being written">
    The field is missing **Edit** FLS for the allGood User profile. Salesforce
    silently drops fields the user can't edit. Grant Read + Edit FLS on each
    field Mary writes.
  </Accordion>

  <Accordion title="Creating a new Lead fails">
    Salesforce requires **Company** on new Leads. Grant the allGood User profile
    **Read + Edit** FLS on **Company** (Lead), and make sure the record has a
    value for it.
  </Accordion>

  <Accordion title="Why am I getting login errors?">
    Common causes include incorrect credentials, IP restrictions, security token
    issues, and expired passwords.
  </Accordion>

  <Accordion title="Where can I get help?">
    * Review this page for setup steps and common issues - Contact our support
      team for technical assistance
  </Accordion>
</AccordionGroup>