Why do I receive permissions and field access errors during the primary sync

Maintenance log and emailed errors regarding insufficient permissions during the sync batch point to the Salesforce Sync User missing the necessary permissions. Examples include "secure query included inaccessible field" and "System.QueryException: No such column."

We recommend that the primary sync runs against a user who has the standard Salesforce system administrator profile.  This ensures the running user has all the permissions needed for the sync to run successfully.

If you need the sync to run against a user with a different profile, please ensure they have one of our permission sets. We provide permission sets that cover all the objects within our package.

However, Salesforce also has permissions that could cause issues if they are not enabled. E.g. "View Setup and Configuration" and "Manage Packaged Licenses."

While we can't troubleshoot every missing system or general user permission our customers may make on a custom profile, we do offer this list of objects and fields that the user running the primary sync will require:

SELECT CreatedDate, Id FROM AsyncApexJob
SELECT Id FROM ApexClass
SELECT Name, TableEnumOrId FROM ApexTrigger
SELECT id FROM User
SELECT id FROM CronTrigger
SELECT OrganizationType, IsSandbox FROM Organization
SELECT Id, DeveloperName FROM CustomNotificationType
SELECT Id FROM PermissionSetAssignment
SELECT Id FROM PermissionSet
SELECT Id FROM RecordType

The sync user will also need access to:

• Create and edit Salesforce Campaigns (and their members) if you enable the Salesforce Campaign sync.
• Edit access to any contact and lead fields mapped in the Campaign Monitor to Salesforce direction.
• Edit access to Contact and Lead Email Opt fields if you enable the Email Opt Out sync.

All users should have one of our permission sets, and the Salesforce sync user must have the admin full permission set. More on permission sets.

We are unable to troubleshoot custom profiles for you. Please test in a sandbox thoroughly before use.

Note: Unlike an external app, our integration runs entirely from within Salesforce and only calls out to Campaign Monitor, not the other way round. The sync user is the one that manages the timing and configuration of this process. More on security.