Insufficient permissions: secure query included inaccessible field

We recommend that the primary sync runs against a user who has the standard Salesforce system administrator profile.  This ensures the running user has all the permissions needed for the sync to run successfully.  If you need the sync to run against a user with a different profile please ensure they have one of our permission sets. We provide permission sets that cover all the objects within our package.

However, Salesforce also has permissions that could cause issues if they are not enabled. E.g. "View Setup and Configuration". Below is a list of objects and fields that the user running the primary sync will require:

SELECT CreatedDate, Id FROM AsyncApexJob
SELECT Id FROM ApexClass
SELECT Name, TableEnumOrId FROM ApexTrigger
SELECT id FROM User
SELECT id FROM CronTrigger
SELECT OrganizationType, IsSandbox FROM Organization
SELECT Id, DeveloperName FROM CustomNotificationType
SELECT Id FROM PermissionSetAssignment
SELECT Id FROM PermissionSet
SELECT Id FROM RecordType

The sync user will also need access to create and edit Salesforce Campaigns (and their members) if you enable the Salesforce Campaign sync.

All users should have one of our permission sets, and the Salesforce sync user must have the admin full permission set. More on permission sets.

Note: Unlike an external app, our integration runs entirely from within Salesforce and only calls out to Campaign Monitor, not the other way round. The sync user is the one that manages the timing and configuration of those calls out. More on security.