Provides instructions for completing the Enable SaaS API Data Loss Prevention for Salesforce Tenants workflow in Cisco Secure Access. You must have full admin access to the Secure Access dashboard.

Secure Access supports SaaS API DLP protection in Salesforce Enterprise Grid deployments for both production and sandbox development for:

files uploaded to your Salesforce Enterprise Grid deployment in the Sales Cloud and Service Cloud.
files exchanged in Salesforce chatter posts.
chatter posts exchanged with your tenant.
core sObjects residing in your tenant.
custom sObjects residing in your tenant.

Note
It may take up to 24 hours after a new custom sObject is created for the system to start scanning that sObject.

To use this feature you must authorize the tenant using the procedure described below. Once the tenant is authorized, for each file, chatter post, core sObject, or custom sObject residing in the tenant, when Secure Access finds data in violation of an enabled SaaS API rule it will enforce the action of that rule.

Before you begin

You must have full admin access to the Secure Access dashboard. See Manage Accounts.
You must have full admin access in a Salesforce Enterprise Grid account.
You must install or update Node.js. The Salesforce CLI requires Node.js to run. We recommend using Node.js 18.x or higher; Node.js 20.x is preferred.
You must install the Salesforce CLI. This is the primary tool for interacting with Salesforce orgs and managing Salesforce DX projects.
You must log in to the Salesforce org you intend to authorize as a tenant.
You must Download the Salesforce quarantine package and install it for your Salesforce tenant. This enables Secure Access to support the quarantine response action for Salesforce files. (If you have already done this to support Cloud Malware Protection for this tenant, you need not do it again.)
You must set the appropriate systems permissions in your Salesforce deployment. (If you have already done this to support Cloud Malware Protection for this tenant, you need not do it again.)

The Salesforce user account to which the quarantine package is deployed and permissions are applied must be the same one that will be used to authorize the Salesforce tenant for SaaS API Data Loss Prevention.

Procedure

Navigate to Admin > Authentication.
Under SaaS API Platforms, click to expand Salesforce.
In the DLP subsection, click Authorize New Tenant to add a Salesforce tenant to your Secure Access environment.
In the Salesforce Authorization dialog, click the Salesforce Quarantine Package link and deploy the Salesforce quarantine package to your Salesforce tenant. This enables Secure Access to support the quarantine response action for Salesforce. (If you have already deployed the package to support Cloud Malware Protection for this tenant, you need not do it again.)
In the Salesforce Authorization dialog, check the checkboxes to verify you meet the prerequisites, then click Next.
Enter the Tenant Name. If the tenant is a Salesforce sandbox, check Salesforce Sandbox. Click Next.
Click Next to be redirected to the Salesforce login page.
Log in to Salesforce with admin credentials to grant access.

You are redirected to Secure Access and a message appears showing the integration was successful. It may be up to 24 hours for the integration to be confirmed and appear as Authorized.
Click Done to complete.
The new tenant will appear on the Authorization page in the list under Salesforce.

If you checked Salesforce Sandbox in Step 6, the tenant name will have [Sandbox] appended to it.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.