Recent incidents connected to malicious use of Salesforce connected apps did not stem from platform vulnerabilities. Attackers used social engineering to persuade employees to authorize applications with access to Salesforce data.
Once access is granted, connected apps can interact with Salesforce through OAuth permissions. That makes authorization governance and user awareness essential parts of platform security.
Audit connected apps
Regularly review every connected app in your Salesforce environment. Remove unused applications, confirm owners, document the business need, and restrict access with permission sets or profiles.
Enable API access control
Block unknown connected apps by default and explicitly whitelist approved applications. Review whether the “Use Any API Client” permission is limited to the right users.
Tighten authorization permissions
Ensure only trusted administrators or designated developers can approve uninstalled connected apps. Apply the principle of least privilege throughout the authorization process.
Educate your teams
Teach employees to recognize unexpected app authorization requests and to verify the business need before granting OAuth access. Pair awareness with a clear escalation path.