Overview

The AutoElevate + Salesforce integration creates and updates Salesforce Cases when elevation activity happens on your managed computers. It is built for organizations that run their service desk in Salesforce instead of a traditional PSA. Each elevation request opens a Case on the matching client Account, and approvals, denials and other events update that Case automatically, so every elevation is tracked in your Salesforce workflow without manual ticket entry.

The integration is outbound only. AutoElevate sends ticket data to Salesforce for visibility and tracking; approvals and denials are still made in AutoElevate.

How the Integration Works

AutoElevate signs in to your Salesforce org with the OAuth 2.0 Client Credentials flow. This is a server-to-server connection: there is no login screen, no consent prompt and no redirect. Because no person signs in, Salesforce requires a Run As user. Every Case is created as that user, and that user's permissions are the integration's permissions.

What Gets Created in Salesforce

• Elevation request → new Case. The Subject is <app> - UAC Authorization Requested, and the Status is the value you map to New. The Description includes the application details, security check results and a link back to the request in the Admin Portal.
• The Case uses the Status, Priority, Origin, Record Type and Queue you configure, and is attached to the Salesforce Account linked to the AutoElevate company.
• If the computer is linked to a Salesforce Asset, the Case is associated with that Asset.
• The Ticket Number shown on the request in the Admin Portal is the Salesforce Case Number (for example, 00001028).
• There is no Owner setting. The Case owner is the Queue you choose, or the Run As user when no Queue is set. An active Case assignment rule in your org changes this (see Known Limitations).

Priority can be set separately for Elevation Request tickets and Elevated Session tickets.

Elevated Session Cases

An elevated session request also creates a Case:

• The Subject is Elevated Session on <computer> requested by <user>, and the Status is your New mapping.
• The Priority is the Elevated Session priority from Ticket Defaults. If that field is blank, no Priority is sent.
• The Description includes the Admin Portal link, the user's explanation (if one was given), the company, the computer, the logged-in user and the privilege level. It does not include an application or security check section.
• Approve or deny changes the Status to the matching mapping and adds an internal Case Comment.
• If the request is withdrawn, expires or is canceled, a Case Comment is added and the Status does not change. AutoElevate does not close the Case in these cases.

How Cases Are Updated

• Approve or deny: the Case Status changes to the value you mapped for that outcome, and an internal Case Comment is added showing who approved or denied the request.
• Approved, but the application failed to launch: the Case Status changes to your Client Follow-Up Needed mapping.
• Other events (for example, virus scan results, application launched or canceled, and session expired) add Case Comments only. They do not change the Status.
• Time entries are written when a request is approved or denied. Each one is a single internal Case Comment, for example "<app> was APPROVED by <name> for this instance only." The Time Entry Duration (Minutes) field in PSA Integration has no effect for Salesforce. No hours or duration are sent.

Field Length Limits

Salesforce enforces hard field limits. AutoElevate shortens text that is too long rather than failing to create the Case:

• Subject: 255 characters
• Description: 32,000 characters
• Case Comment: 4,000 characters

Before You Begin

In AutoElevate:

• An Admin Portal user with permission to edit tenant-level settings. By default, only the Administrator role has this permission. Without it, the setup button does not appear, and opening the setup page directly redirects to the Dashboard.
• The integration is configured at the tenant level only. Salesforce is not offered on the company-level ticketing screen.
• If another ticketing system is already configured, it must be removed first (see Open the Setup Screen).

In Salesforce:

• A Salesforce admin login for the target org.
• My Domain enabled (on by default since Winter '23).
• The username of the user the integration will run as. This is the Salesforce username, which is often not the same as the person's email address. A dedicated integration user is strongly recommended (see Run As User Permissions).
• An External Client App. Since the Spring '26 release, Salesforce does not let you create new Connected Apps. If your org already has a Connected App for AutoElevate, you can use it (see Using an Existing Connected App).

Part 1 produces the three values the Admin Portal asks for:

• Login URL — the org's My Domain URL, for example https://MyDomainName.my.salesforce.com
• Consumer Key (Client ID) — starts with 3MVG9 and is about 85 characters long
• Consumer Secret (Client Secret)

Part 1: Salesforce Setup

Step 1: Create the App (External Client App)

1. Go to Setup → Apps → External Client Apps → External Client App Manager and click New External Client App.
2. Under Basics, enter a Name (for example, AutoElevateIntegration), your admin email as the Contact Email, and set Distribution State to Local.
3. Expand API (Enable OAuth Settings) and check Enable OAuth.
4. For Callback URL, enter https://localhost/callback. The form requires a value, but this connection never uses it.
5. Under Selected OAuth Scopes, add Manage user data via APIs (api). This one scope is enough. Full access (full) also works but grants far more access than the integration needs.
6. Under Flow Enablement, check Enable Client Credentials Flow and leave every other flow unchecked. Accept the security warning.
7. Click Save.

Next, configure the Policies tab. Saving the Settings tab alone does not produce a working app; this is where most failed setups go wrong.

8. Open the app, select the Policies tab and click Edit.
9. Under OAuth Policies → Plugin Policies → Permitted Users, select All users can self-authorize. If your org requires Admin approved users are pre-authorized, you must also assign the Run As user to the app through a profile or permission set, or the connection is rejected.
10. Under OAuth Policies → OAuth Flows and External Client App Enhancements, check Enable Client Credentials Flow, then enter the integration user's username in the Run As (Username) field below it. This is a free-text username field, not a name lookup. If Salesforce shows "Enter a valid execution user for the OAuth client credentials flow.", the value is not a Salesforce username. Copy the user's Username from Setup → Users. It looks like an email address, but it is often not the user's email.
11. Under App Authorization → IP Relaxation, select Relax IP restrictions.
12. Click Save.

Using an Existing Connected App

If your org already has a Connected App for AutoElevate, you can use it. Check that its OAuth settings match Step 1. Then open it from Setup → App Manager and select Manage → Edit Policies to set Run As (a user lookup here, not a typed username), Permitted Users and IP Relaxation.

Step 2: Retrieve the Consumer Key and Secret

• External Client App: open the app, select the Settings tab and go to OAuth Settings → App Settings → Consumer Key and Secret. The values open in a new window, and Salesforce may ask you to verify your identity.
• Connected App: click Manage Consumer Details. Salesforce asks you to sign in again.

Treat the Consumer Secret like a password. It grants API access to your org as the Run As user.

Step 3: Confirm the Login URL

Go to Setup, search Quick Find for My Domain and copy the Current My Domain URL. It has the format https://MyDomainName.my.salesforce.com. Enter it with no trailing path; do not paste the URL of a Setup page.

Run As User Permissions

The Run As user needs:

• An active user with API Enabled
• Read, Create and Edit on Case, and Create on Case Comment
• Read on Account (used to link companies)
• Read on Asset (only needed for computer linking)
• Access to the Case Record Type and Queue you choose in the Admin Portal
• Assignment to the app through a profile or permission set, only if Permitted Users is set to Admin approved users are pre-authorized

Field-level security also matters. The Run As user needs Edit access (not only Read) to the Case fields AutoElevate writes: Subject, Description, Status, Priority, Origin, Account, Asset, Record Type and Owner. If one of them is read-only or hidden for the Run As user, Case creation fails whenever AutoElevate sends that field. Priority and Origin are sent only when set in Ticket Defaults; Asset is sent only when the computer is linked.

IP restrictions are two separate checks: the app-level IP Relaxation setting (Step 1) and the Run As user's profile Login IP Ranges. If the profile has Login IP Ranges, the connection fails from outside them regardless of the app setting.

Optional: Queues, Record Types and Accounts

None of these are required. A new org may have none, and the matching dropdowns in the Admin Portal will be empty. That is normal.

• Case Queue — created under Setup → Queues with Supported Object set to Case. A queue that does not support Case makes every Case creation fail. Queues must be enabled for Case.
• Case Record Type — created under Setup → Object Manager → Case → Record Types.
• Accounts — one per client company you want to link. The Account Name must match the AutoElevate company name. Capital letters and spaces at the start or end are ignored; spaces inside the name must match. This is how companies are linked; see Linking Companies and Computers.

Known-Good Configuration

If the org will not authenticate, compare your app against these settings:

• Callback URL: https://localhost/callback
• Selected OAuth Scopes: Manage user data via APIs (api) only
• Flow Enablement: Client Credentials Flow only, every other flow unchecked
• Permitted Users: All users can self-authorize
• Run As (Username): the integration user's username, set on the Policies tab
• IP Relaxation: Relax IP restrictions
• Distribution State: Local; App Status: Enabled

Part 2: AutoElevate Admin Portal Setup

Open the Setup Screen

1. In the AutoElevate Admin Portal, go to Settings.
2. In the General Info table, find the Ticketing System row and click Start Setup (or Edit if a setup already exists). The Ticketing System Setup page opens.
3. For Type, select Salesforce (Beta).

The setup has four panels: 1. Host Info, 2. Record Type & Queue (Optional), 3. Statuses and 4. Ticket Defaults (Optional). Save stays unavailable until all four panels show a check mark.

Panel 1: Host Info

1. Enter the Login URL, Consumer Key (Client ID) and Consumer Secret (Client Secret) from Part 1.
2. Click Save Credentials.

AutoElevate signs in to Salesforce before storing anything, then reads five lists from your org: Statuses, Priorities, Origins, Queues and Record Types. If the credentials or permissions are wrong, an error appears at this step and nothing is stored (see Troubleshooting). On success, the panel shows a check mark and Panel 2 opens.

The Consumer Secret is stored encrypted and is never shown again. To change the credentials later, open 1. Host Info, click Edit Credentials, type the Consumer Secret again (and any other value that changed), and click Save Credentials. AutoElevate signs in with the new values first. If Salesforce refuses them, the old credentials stay in use. The Save button at the bottom of the page does not save credentials.

Panel 2: Record Type & Queue (Optional)

Choose a Case Record Type and/or Queue for new Cases, or leave them blank to use the Salesforce defaults. Empty dropdowns are expected if your org has none. To clear a saved value later, see Known Limitations. Click Next.

Panel 3: Statuses

Map each AutoElevate outcome to a Case Status. The values are read live from your org's Case object. All seven are required, and Next stays unavailable until every one is set.

After you save, a mapping can be changed but not cleared.

Panel 4: Ticket Defaults (Optional)

Set the Origin applied to every Case, and a default Priority for Elevation Request tickets and for Elevated Session tickets. Fields left blank are not sent, so Salesforce applies its own defaults. Click Next, then click Save.

Customize the Case Subject and Comment Text

You can change the Case Subject and the text of the approve/deny Case Comment with AutoElevate's ticket templates. These are general ticketing settings, so they are not on the Ticketing System Setup page.

1. In the Admin Portal, go to Settings.
2. Under the Ticketing category, click the PSA Integration row to open Edit "PSA Integration".
3. Fill in the templates you want to change. A blank field uses the default text.

The row has four template fields, plus Time Entry Duration (Minutes):

• Subject Content Template — Windows Elevated Process: the Subject of elevation request Cases.
• Subject Content Template — macOS Elevated User Session: the Subject of elevated session Cases.
• Time Entry Content Template — Windows Elevated Process: the internal Case Comment added when an elevation request is approved or denied.
• Time Entry Content Template — macOS Elevated User Session: the internal Case Comment added when an elevated session request is approved or denied.

Each field lists the variables it supports, such as $COMPUTER_NAME or $COMPANY_NAME. The Subject is cut at 255 characters and the comment at 4,000. The Case Description cannot be customized.

The templates apply to all your companies.

Linking Companies and Computers

Companies

A company links to the Salesforce Account whose Name matches the AutoElevate company name. Capital letters are ignored, and so are spaces at the start or end. Spaces inside the name must match. Saving the setup does not link your existing companies. Link them with the steps below. A company that you create after the setup links automatically if an Account matches.

Reconcile the names first, then link:

1. Go to Companies.
2. Check the company or companies to link.
3. Click the + button above the list and choose Ticketing System → Link.
4. Refresh the page. The Linked to Ticketing System? column shows True.

To undo a link, select the company, click + and choose Ticketing System → Remove Link.

Computers

A computer links to the Salesforce Asset whose Name equals the computer's machine name, under the linked Account. Existing computers are not linked when you save the setup. Linking runs when a computer registers, or manually: go to Computers, select the computer and choose Link. The manual action links the computer's company first, then the Asset. Computer linking requires Read access on Asset for the Run As user. An unlinked computer does not stop Case creation.

Verify the Integration

1. Link at least one company (see Linking Companies and Computers).
2. Trigger an elevation request on a computer that belongs to a linked company.
3. Open the request in the Admin Portal. The Ticket Number field shows the Salesforce Case Number. Case creation happens in the background, so allow a few seconds and refresh.
4. In Salesforce, confirm the Case has your configured Status, Priority and Origin, is attached to the correct Account, and has a Description with the application details, security checks and a link to the Admin Portal.
5. Approve the request. The Case Status changes to your Approved mapping.
6. Deny a second request. The Case Status changes to your Denied mapping.
7. Confirm the Case has AutoElevate Case Comments, such as the virus scan result and who approved or denied the request.

Best Practices

• Use a dedicated integration user as the Run As user instead of a person's login, so every Case is clearly attributed to the integration.
• Scope the Run As user with a permission set rather than a broad profile, and grant only the permissions listed in Run As User Permissions.
• Grant only the api scope. Avoid Full access (full).
• Standardize company names so each AutoElevate company matches its Salesforce Account Name before you link your companies.
• Keep status mappings in sync. If you rename or remove a Case Status in Salesforce, update the mapping in the Admin Portal (see Known Limitations).
• Enter the Consumer Secret only in the Admin Portal. Never send it by email, chat or support ticket.

Troubleshooting

"This login URL does not serve the app-to-app login flow…"

The Login URL is login.salesforce.com or test.salesforce.com. Replace it with your org's My Domain URL (see Step 3).

"Login URL must be a Salesforce host…"

The Login URL is not a *.salesforce.com or *.salesforce.mil address. Enter the My Domain URL exactly as shown in Salesforce Setup.

invalid_client or invalid_grant

This text comes directly from Salesforce. Common causes: the Consumer Key or Secret is wrong, the Client Credentials flow is not enabled on the Policies tab, no Run As user is set, IP restrictions are blocking the connection (app IP Relaxation or the user's profile Login IP Ranges), or the app changes have not taken effect yet. Wait up to 10 minutes after changing the app, then compare it against the Known-Good Configuration.

"timeout of 15000ms exceeded" or ENOTFOUND

The Login URL host is wrong, or Salesforce could not be reached. Check the Login URL and try again.

Error fetching statuses, priorities or origins

The message asks you to verify API access to the Case object. The Run As user cannot read the Case picklists. Grant Read on Case to the Run As user.

A new Consumer Secret does not take effect

The secret was changed and only the Save button at the bottom of the page was clicked, so the new value was discarded and the old secret stays in use. Open 1. Host Info, click Edit Credentials, type the secret again and click Save Credentials. If the old secret was already revoked in Salesforce, new requests show no Ticket Number until you do this.

"queues is invalid."

The Run As user cannot read one of your org's queues, and setup stops at Panel 1. Your credentials are saved, but the remaining panels do not load. Give the Run As user access to all Case queues, then click Save Credentials again.

Queue or Record Type dropdowns are empty

Your org has no Case queues or Record Types. This is normal. Leave the fields blank, or create them in Salesforce (see Optional: Queues, Record Types and Accounts).

Type options are greyed out

Another ticketing system is already configured. Remove it first (see Open the Setup Screen). If its row has no Edit button, ask AutoElevate Support to remove it.

Redirected to the Dashboard, or "You are not authorized to perform this action."

Your Admin Portal user does not have permission to edit tenant-level settings. Ask an administrator for that permission.

Company stays Linked = False

Saving the setup does not link existing companies. If you have not run Ticketing System → Link yet, run it. If you have, no Salesforce Account has a Name that matches the company name. Rename one side so they match, then run Ticketing System → Link again.

No Case is created for a request

Check that the company is linked (existing companies must be linked manually after setup) and that your tenant's ticketing type is Salesforce. If both are correct, Salesforce may be rejecting the Case. Common causes are a Queue that is not enabled for Case, a Record Type the Run As user has not been granted, or a Case field that is read-only or hidden for the Run As user by field-level security. Contact AutoElevate Support if the cause is not clear; Support can see the Case creation errors. The elevation request itself still works when a Case cannot be created.

Long subjects or comments are cut off

This is expected. AutoElevate shortens text to the Salesforce field limits instead of losing the Case (see Field Length Limits).

Known Limitations

• Technician Mode ticketing is not available for Salesforce.
• User (Contact) and Location linking are not supported. Only companies (Accounts) and computers (Assets) are linked.
• Time tracking is not supported. Time entries are added as Case Comments.
• Time Entry Duration (Minutes) in the PSA Integration settings has no effect for Salesforce. Only the comment text is written.
• Cleared fields stay saved. After you save the setup, clearing the Record Type, Queue or Origin and clicking Save keeps the old value. To remove one, delete the setup and set it up again. A cleared Priority does clear.
• Renamed Case Statuses are not detected. If a mapped Status is renamed in Salesforce (for example, Closed to Resolved), AutoElevate keeps sending the old name and no error is shown. Update the mapping in the Admin Portal whenever you change Case Statuses.
• Addigy-managed Macs: if you approve an elevated session request for a Mac managed through Addigy that already has an active session, the request shows as Approved in AutoElevate, but the Case keeps its New Status and no comment is added.
• Case assignment rules run on AutoElevate Cases. If your org has an active Case assignment rule, Salesforce runs it when AutoElevate creates a Case and again each time AutoElevate changes the Case Status. The rule decides the owner: the user or queue of the matching rule entry, or the Default Case Owner (Setup → Support Settings) when no entry matches. Because the rule runs again on each Status change, it can also move a Case that a technician already owns. Case Comments do not run the rule.

Security Notes

• AutoElevate verifies the credentials with Salesforce before storing them. If sign-in fails, nothing is saved.
• The Consumer Secret is encrypted at rest and is never displayed again after it is saved.
• AutoElevate only connects to Salesforce hosts. A Login URL that is not a Salesforce address is refused.
• The integration acts with the Run As user's permissions. Keep that user limited to the permissions in Run As User Permissions, and review them if you change what the integration should access.
• The Consumer Secret grants API access to your org. If it is ever exposed, generate a new one in Salesforce and enter it with Edit Credentials → Save Credentials in the Admin Portal.

Related Articles

• ServiceNow Ticketing System Integration Setup
• FreshService Ticketing System Integration Setup
• Freshdesk Ticketing System Integration Setup
• Technician Mode Ticketing