Overview
Salesforce has recently tightened security around Connected Apps. This means users will no longer be able to self-authorize an app that is not installed on the org.
- Existing connections → No impact (your current integrations will continue working).
- New app connections → Admin must pre-authorize the Connected App before users can authenticate.
If the app is not pre-authorized, users will see a generic login failure like this:
However, the URL will include an error message like:
?error=invalid_client&error_description=app+must+be+installed+into+org&display=touch
To proceed with the steps below, users will need the new Approve Uninstalled Connected Apps permission - it is automatically assigned to the System Administrator standard profile, but Custom profiles aren’t automatically updated.
Steps for Salesforce Admins to Pre-Authorize Connected Apps
1. Go to Setup
- From Salesforce, click the gear icon (⚙️) → Setup.
2. Search for “Connected Apps”
- In Quick Find, type Connected Apps and select Connected Apps OAuth Usage.
- Important Note: Two Cirrus Insight apps are highlighted in the screenshot below (Cirrus Insight & Cirrus Insight - Services). Cirrus Insight is used by the sidebar; Cirrus Insight - Services is used by automated sync. A legacy Cirrus Insight 2019 app may also appear in older orgs.
-
- If you see the App in question, and it is installed, your user could still be blocked. Click its Manage App Policies link to review the Policy.
- Under Permitted Users, if Admin approved users are pre-authorized is selected, you can proceed to Step 3 to grant access through permissions.
- If you see the App in question, and it is NOT installed, you can review the User Count by clicking the number to see who has authorized already. You can then select the Install button to install it.
- A new tab will open what asks Install connected app? - click the Install button.
-
-
- This will take you to the policy you’ve now created. The Default value for Permitted Users is All Users may self-authorize - if you want to keep that, your user will now be able to authorize.
- If you want to require users to be pre-authorized, you can use the Edit Policies button to adjust and you will see a warning that all existing authorizations will be revoked. Then proceed to Step 3 to grant access through permissions.
- If you do not see the App in question, a user with the Use Any API Client permission must first attempt to Authenticate to get the App on the Oauth Usage list. Then you can revert to the step above to install the App.
3. Manage Profiles or Permission Sets
- If leveraging the Admin approved users are pre-authorized setting, you will need to grant permissions for the App. Either manage profiles for the app by editing each profile’s Connected App Access list, or manage permission sets for the app by editing each permission set’s Assigned Connected App list.
- This explicitly grants OAuth access to the Connected App.
Using Cirrus Insight with a Salesforce sandbox
Connected app installs and policies are set per Salesforce org. Each sandbox needs the Cirrus Insight connected apps installed and allowed separately. Installing them in production doesn't carry over. The steps in this article apply to sandboxes the same way.
- If an app doesn't appear under Setup > Connected Apps OAuth Usage, have a Salesforce admin with the Approve Uninstalled Connected Apps permission (or Use Any API Client, if API Access Control is enabled) sign in to Cirrus Insight once against the sandbox, then click Install.
- If Permitted Users is set to Admin approved users are pre-authorized, add the test user's profile or permission set under Manage App Policies. Otherwise that user will see a connection failure even with API Enabled.
- If the connection fails, check the browser address bar for these errors: app must be installed into org, OAUTH_APP_BLOCKED, OAUTH_APP_ACCESS_DENIED, OAUTH_APPROVAL_ERROR_GENERIC. Salesforce Login History may also show "Failed: Not approved for access."
To connect the sidebar or sync to a sandbox, see How Do I Connect Sidebar to a Salesforce Sandbox?
Key Takeaways
- Salesforce now enforces admin pre-authorization for all new Connected Apps.
- Existing connections to Uninstalled Apps will continue to work. New Connections to Uninstalled Apps will fail the same as attempts for New Connected Apps.
- Admins must proactively configure OAuth permissions for new apps before users can log in.
Frequently asked questions
Why can't my users log in to Cirrus Insight with Salesforce?
Salesforce now requires an admin to pre-authorize new Connected Apps, so users can no longer self-authorize an app that isn't installed in the org. Until an admin installs and allows the Cirrus Insight apps, users see a generic login failure.
What does the Salesforce error "app must be installed into org" mean for Cirrus Insight?
It means the Cirrus Insight Connected App hasn't been installed or pre-authorized in your Salesforce org. A Salesforce admin needs to install it from Setup > Connected Apps OAuth Usage.
Which Salesforce Connected Apps does Cirrus Insight use?
Two: "Cirrus Insight," used by the sidebar, and "Cirrus Insight - Services," used by automated sync. Older orgs may also show a legacy Cirrus Insight 2019 app.
How do I pre-authorize Cirrus Insight in Salesforce?
In Setup, open Connected Apps OAuth Usage, find the Cirrus Insight app and click Install. If Permitted Users is set to "Admin approved users are pre-authorized," add the right profiles or permission sets to the app.
Will existing Cirrus Insight connections stop working?
No. Existing connections keep working; the pre-authorization requirement applies to new connections.
Do I need to install the Cirrus Insight Connected Apps in a Salesforce sandbox separately?
Yes. Connected app installs and policies are set per org, so each sandbox needs the Cirrus Insight apps installed and allowed on its own.