Salesforce Agentforce
The Salesforce connector brings your org's Agentforce agents into MITRITY. It discovers the agents, imports setup-audit activity as MITRITY audit events and reads org security posture. It works through a connected app that authenticates with the OAuth2 JWT-bearer flow. It never writes to your org.
For the connector model, read SaaS-Embedded Agent Governance first. This page covers what is specific to Salesforce.
What it discovers
- Agentforce agents configured in the org. They are added to your Agents inventory with state
discovered.
Requirements
| Requirement | Detail |
|---|---|
| Edition | Any org for Discover, Posture and basic Observe. Richer telemetry (EventLogFile) needs the Event Monitoring add-on: see below. |
| Role | A System Administrator, to create the connected app and pre-authorize the integration user. |
| MITRITY plan | Pro or Enterprise; Owner role, or Manager role with access scope all. |
Step 1 — Generate a key pair
In the JWT-bearer flow, the connector signs a token with a private key, and Salesforce verifies it with the matching certificate. Generate a self-signed pair:
openssl req -x509 -sha256 -nodes -days 730 \
-newkey rsa:2048 -keyout mitrity.key -out mitrity.crt
mitrity.key: the private key that MITRITY stores, encrypted. Never upload it to Salesforce.mitrity.crt: the certificate you upload to the connected app in Step 2.
Step 2 — Create a connected app for JWT-bearer
- Go to Salesforce Setup → App Manager → New Connected App.
- Enable OAuth Settings. Set a placeholder callback URL: the JWT-bearer flow does not use it.
- Check Use digital signatures and upload
mitrity.crt. - Add read-only OAuth scopes: at minimum Manage user data via APIs (
api), and also Perform requests at any time (refresh_token,offline_access). - Save, then open the app and copy the Consumer Key. This is the connector's Client ID.
Step 3 — Pre-authorize an integration user
- On the connected app, open Manage → Edit Policies and set Permitted Users to Admin approved users are pre-authorized.
- Assign the connected app to a profile or permission set held by a dedicated integration user. Read-only is sufficient for the connector.
- Note the Username of that integration user. You enter it in MITRITY.
Step 4 — Connect in MITRITY
In Settings → Platforms → Connect a platform, choose Salesforce and provide:
| Field | Value |
|---|---|
| Account / Organization | Your Salesforce org ID or My Domain host, e.g. acme.my.salesforce.com |
| Connected-app private key (PEM) | The contents of mitrity.key from Step 1 |
| Client ID | The Consumer Key from Step 2 |
| Username | The integration user's username, e.g. integration@acme.com |
| Login URL | https://login.salesforce.com (or https://test.salesforce.com for a sandbox) |
Save, then click Sync now. At sync time, the connector signs a JWT with your private key and exchanges it for an access token and the org's instance_url. Then it runs Discover → Observe → Posture.
Observe — SetupAuditTrail vs Event Monitoring
By default, the connector imports activity from SetupAuditTrail, which every org has. Salesforce's richer EventLogFile telemetry is part of the paid Event Monitoring add-on. If your org does not have it, the connector degrades to SetupAuditTrail rather than failing.
Imported events carry source = salesforce and are marked as observed: recorded, not gated. They flow to the audit log and Insights. They are not forwarded to SIEM destinations.
Posture
The connector reads proxies for the org's security configuration and records them as findings (OK / Warning / Unknown). A control it cannot read is recorded as Unknown, never OK. See Posture & Security.
Governing a discovered agent
Assign a policy to a discovered agent to move it to governed (governance mode Constrained), or suppress it. Agentforce agents are observed, not enforced in-band, in this release: see read-only by design.