Minimum permissions for a Salesforce Integration license user to create Users and assign permission sets

Question

I am setting up a new Salesforce Integration user (one of the 5 free licenses) to act as the running user for our corporate onboarding/offboarding systems

• Username [email protected]
• Profile: Salesforce API Only System Integrations
• Permission Set License: Salesforce API Integration
• Permission Set Group: OnboardOffboard containing these permissions
  • Api Only
  • Assign Permission Set
  • Manage Internal User
  • View All Users

When I use the REST Describe API, I discover that User.ProfileId and User.UserRoleId are not available to [email protected]. Hence, new Users can't be created because ProfileId is a required field.

What am I missing?

Answer 1

• The Object Reference doc for User is silent on what permission is needed for field ProfileId. It does say

To create or update a User record, you must have the Manage Internal Users permission. and I have granted that permission.

• The Object Reference doc for Profile states that you need View Setup and Configuration to see various CRUD and FLS permissions but that is not what I'm doing here

• The Permission Set License Salesforce API Integration does allow permissions Manage Internal Users and Assign Permission Sets to Users so that can't be the issue.

For reasons unknown to me, User.ProfileId and User.UserRoleId became visible by assigning permission Manage Users that in turn grants:

• Reset User Passwords and Unlock Users
• View All Users
• Manage Profiles and Permission Sets
• Assign Permission Sets
• Manage Roles
• Manage IP Addresses
• Manage Sharing
• View Setup and Configuration
• View Roles and Role Hierarchy
• Manage Internal Users
• Manage Password Policies
• Manage Login Access Policies
• Manage Multi-Factor Authentication in User Interface

I then starting backing out those permissions to see which one was required for exposing User.ProfileId

Remove Permission	Is User.ProfileId viz?	Is User.UserRoleId Viz?
Manage Users	YES	YES
Manage Profiles and PS	YES	YES
View Setup and Configuration	NO	YES
View Roles and Role Hierarchy	NO (see above)	NO

I then added back View Setup and Configuration (which automatically sets View Roles and Role Hierarchy) and deleted all the other permissions granted by Manage Users and concluded that the minimum permissions for the creation of users and assignment of PS/PSG by an integration user are:

• Api Only
• Assign Permission Set
• Manage Internal User
• View All Users (for doing audits)
• View Setup and Configuration
• View Roles and Role Hierarchy

If you also need to assign the user to a Public Group, you'll need these permissions:

• Manage Users - putting me right back where I started