阿里云上的Salesforce关于“Use Any API Client”权限行为变更及准备工作

描述

为配合 2025 年 9 月推出的 Connectd App 安全措施的变更（参见 Salesforce on Alibaba Cloud 针对 Connected Apps 安全措施的变更通知）， 阿里云上的 Salesforce 将调整 "Use Any API Client" 用户权限的行为：拥有该权限的用户将不再能够自行授权 Uninstalled Connected Apps。

此变更不会影响该权限的其他现有功能，例如对 API 的无限制访问。

准备工作

步骤 1：确认是否启用了 API 访问控制

1. 进入 Setup（设置） > API Access Control（API 访问控制） 页面。

2. 检查是否勾选了以下选项：

• For admin-approved users, limit API access to only allowlisted connected apps（对管理员批准的用户，限制API访问为仅允许已授权列表中的 connected apps）

  • 如果已勾选，请继续执行后续步骤。

  • 如果未勾选，无需任何操作。

注意：如果您此前未启用 API 访问控制功能，则该设置页面不可见，也无需采取任何行动。

步骤 2：识别 "Use Any API Client" 权限的使用情况

建议您与您的安全团队一起审计当前用户权限，确认哪些用户被分配了该权限，并评估其必要性：

• 若用户必须继续自行授权并使用 Uninstalled Connected App：

  请参阅下方“管理员特殊场景处理”部分。

• 若无需此权限：

  可手动移除，或等待系统自动禁用自主授权功能

• 若该权限分配给了 Integration 用户或 API-only 用户：

  无需操作。本次变更不影响此类用户的正常使用（详见下文说明）。

• 若未分配该权限：

  无需任何操作。

步骤 3：安装或阻止 Connected Apps

按最小权限原则审核、安装并授权终端用户需访问的 Connected Apps，同时阻止不可信应用（必要时卸载）。

常见问题

1、如何查询 "Use Any API Client" 权限的分配

方法 1：手动检查

在 Setup 中逐一查看所有 Profiles 和 Permission Sets。

方法 2：使用 SOQL 查询

• 查询分配了该权限的 Users

SELECT AssigneeId, Assignee.Id, Assignee.Username

FROM PermissionSetAssignment

WHERE PermissionSet.PermissionsUseAnyApiClient = true

• 查询包含该权限的 Profiles

SELECT Id, Name

FROM Profile

WHERE PermissionsUseAnyApiClient = true

• 查询包含该权限的 Permission Sets

SELECT Id, Name

FROM PermissionSet

WHERE PermissionsUseAnyApiClient = true

方法 3：使用“用户访问与权限助手”（User Access and Permission Assistant）工具分析用户权限

详情可参考：Analyze User Permissions

2、关于默认权限集的说明

命名空间前缀为 "force" 的默认权限集（如ApexGuruStandardPermSet、Data Cloud Home Org Integration User等）关联平台集成用户，因其采用更安全的内部认证机制，不受本次变更影响。

3、Integration 用户/API-only 用户权限说明

您无需移除 Integration / API-only 用户的 "Use Any API Client" 权限，本次变更仅限制自行授权Uninstalled Connected Apps的能力，不影响 API 无限制访问等原有功能。但我们建议避免依赖此权限（例如使用 SOAP API 的 login() 调用），最好的方式是预先安装并授权应用。

4、管理员特殊场景处理

某些场景下（如测试第三方应用），管理员可能需要先自行授权一个 Uninstalled Connected App，才能在 Setup > Connected App OAuth Usage 页面中完成安装。

如需通过OAuth自主授权 Uninstalled Connected App，请使用 "Approve Uninstalled Connected Apps" 权限。该权限将绕过 Connected App 使用限制，因此应仅分配给高度可信的管理员或测试人员。普通终端用户应优先选择安装所需应用，再按最小权限原则授权访问。

5、变更生效后的对照表

在已启用“For admin-approved users, limit API access to only allowlisted connected apps（限制API访问为仅允许已授权列表中的connected apps）”设置的情况下，不同权限组合的行为预期如下：

Description

To align with the Connectd App security measures rolled out in September 2025, Salesforce on Alibaba Cloud is changing the behavior of the "Use Any API Client" user permission so that users with this permission are restricted from self-authorizing Uninstalled Connected Apps.

This change does not affect other existing functionalities of this permission, such as unrestricted access to APIs.

What action do I need to take?

1. In Setup, navigate to the API Access Control page. If the setting "For admin-approved users, limit API access to only allowlisted connected apps." is checked, proceed to the next step. If it's not checked, no further action is required. 

Please note: If you have not previously contacted Customer Support to enable API access control in Setup, these settings will not be visible, and no further action is required.

2. Identify Where "Use Any API Client" is used: We recommend that you and your security teams audit your current Salesforce user permissions to identify any instances where the "Use Any API Client" permission has been assigned. If assigned to any end-users, evaluate the reason why the user previously had access. 

• If end-users must continue to self-authorize and use uninstalled connected apps, refer to the section "Admins need to continue to self-authorize and use uninstalled connected apps, what should I do?" Otherwise, if this permission is not required, you can manually remove it from those users. Alternatively, you can wait for Salesforce on Alibaba Cloud to enforce this change, which will automatically remove the ability to self-authorize uninstalled connected apps.

• If assigned to any integration or API-only users, no action is required as part of this change. See "Should I keep the perm assigned to my integration and API-only users?"

• If not assigned - no further action is required.

3. Install or Block Connected Apps: Take steps to review, install, and allowlist connected apps that you want to make accessible for end-users and only grant user access based on the principle of least privilege. Block any connected apps that you do not trust (when blocking connected apps - take action to uninstall, if applicable).

How do I identify where "Use Any API Client" is assigned?

Options you might consider to identify where "Use Any API Client" is used:

• Manually review all Profiles and Permission Sets in Setup to see where "Use Any API Client" is assigned.

• Use Salesforce SOQL queries to determine where it's assigned. See below section for examples.

SOQL Queries to use to identify where "Use Any API Client" is Assigned:

Users with "Use Any API Client" assigned:

SELECT AssigneeId, Assignee.Id, Assignee.Username FROM PermissionSetAssignment

WHERE PermissionSet.PermissionsUseAnyApiClient = true

Profiles with "Use Any API Client" assigned

SELECT Id, Name FROM Profile WHERE PermissionsUseAnyApiClient = true

Permission Sets with "Use Any API Client" assigned

SELECT Id, Name FROM PermissionSet WHERE PermissionsUseAnyApiClient = true

Use the User Access and Permission Assistant to Analyze User Permissions

What should I do for default Permission Sets?

You may see default Salesforce permission sets with the "Use Any API Client" permission under the namespace prefix "force". These are used with the Platform Integration User which should not be impacted by the upcoming change as it utilizes a more secure internal authentication mechanism.

Should I keep the "Use Any API Client" permission assigned to my integration and API-only users?

Removing the "Use Any API Client" permission from integration and API-only users is not required due to this change. The existing functionalities of this permission, including unrestricted access to Salesforce APIs, remain unaffected. The sole modification being made here is the removal of the capability for self-authorization to uninstalled connected apps.

Despite this, we recommend against building new solutions or integrations that rely on the "Use Any API Client" permission, such as those that use the SOAP API login() call. The secure best practice is to first install and allowlist connected apps or external client apps within your Org. Once this is done, you can authorize end-users to log in. This preferred method eliminates the requirement for the "Use Any API Client" permission for integrations to function.

Admins need to continue to self-authorize and use uninstalled connected apps, what should I do?

• To install new connected apps, particularly those from third parties, administrators may need to self-authorize the uninstalled connected app via OAuth. Once an app has an active OAuth session, only then can the app be installed from the Connected App OAuth Usage page in Setup. This process is necessary because direct app creation by administrators prevents them from defining the Client ID and Consumer Secret required by third-party applications.

• "Approve Uninstalled Connected Apps" user permission that is built for this purpose. Where there are legitimate use cases such as Admins or Developers who must first test an app before installing it in the org, they might need to use this permission. But it's critical to be aware that this "Approve Uninstalled Connected Apps" user permission bypasses the Connected App usage restriction. It should only be assigned to highly trusted users, such as administrators and those involved in managing or testing connected app integrations.

• We advise against using the "Approve Uninstalled Connected Apps" user permission for the majority of end-users for purposes of accessing connected apps. Instead, install the required connected apps and external client applications. Once installed, these trusted apps should be allowlisted and their access managed, granting user access based on the principle of least privilege.

When a customer has enabled the Org Preference (Setup --> API Access Control), "For admin-approved users, limit API access to only allowlisted connected apps," what behavior is expected for self-authorizing uninstalled connected apps after this change takes effect?