Salesforce Configuration

1. Create Named Credentials

Why Use Named Credentials?

• Security: Credentials are stored securely in Salesforce, not in code.
• Maintainability: Easily update credentials in one place without code changes.
• Best Practice: Salesforce recommends Named Credentials for all external callouts.

1. Go to Setup → Named Credentials.
2. Click “New Legacy”

AzureDevops Named Credentials

Fill in the fields:

• Label: AzureDevops Named Credentials
• URL: https://dev.azure.com/
• Identity Type: Named Principal
• Authentication Protocol: Password Authentication
• Username: Your Azure DevOps username (e.g., user@domain.com)
• Password: Your Azure DevOps Personal Access Token (PAT)
• Generate Authorization Header: Checked

Click Save

Note: For Azure DevOps, the “username” is your email or username, and the “password” is your Personal Access Token (PAT) generated from Azure DevOps.

You can generate a PAT in Azure DevOps under User Settings → Personal Access Tokens.

Role: Main Azure DevOps REST API endpoint for organization + project operations.

Used for:

Work items (create/update/read)

Projects/teams metadata

Work item types, fields, picklists (process metadata)

VSSPS Named Credentials

Fill in the fields:

• Label: VSSPS Named Credentials
• URL: https://vssps.dev.azure.com/
• Identity Type: Named Principal
• Authentication Protocol: Password Authentication
• Username: Your Azure DevOps username (e.g., user@domain.com)
• Password: Your Azure DevOps Personal Access Token (PAT)
• Generate Authorization Header: Checked

Role: Azure DevOps identity/security (VSSPS) endpoint.

Used for:

Reading users / identities / groups (Graph/Identity-related calls)

Resolving “Assigned To” users and mapping Salesforce users ↔ Azure identities

Organization-level identity lookups that are not served from dev.azure.com

Visualstudio Named Credentials

Fill in the fields:

• Label: Visualstudio Named Credentials
• URL: https://app.vssps.visualstudio.com/
• Identity Type: Named Principal
• Authentication Protocol: Password Authentication
• Username: Your Azure DevOps username (e.g., user@domain.com)
• Password: Your Azure DevOps Personal Access Token (PAT)
• Generate Authorization Header: Checked

Role: Alternative VSSPS identity/profile host used by some Azure DevOps services/tenants.

Used for:

Certain identity/profile/token/authorization-related calls that may be hosted under the visualstudio.com VSSPS domain

Backward compatibility / tenant-specific routing (some APIs still reference *.visualstudio.com)

Salesforce Named Credentials

Purpose:
This Named Credential allows Salesforce to securely authenticate with itself (Salesforce-to-Salesforce) to make automated configuration changes—such as creating or updating fields – without manual intervention. It is required for the integration to programmatically manage Salesforce metadata.

Used When:

• Supporting the two-way integration, where we use a Salesforce object as the Azure Devops Work Item Record and dynamically create fields depending on table settings. This ensures that all data is properly synchronized in reports and other integrations.
  

Why Needed:
Without this Named Credential, every change would require manual updates in Salesforce. Using it ensures that field creation, updates, and metadata synchronization happen automatically, keeping Salesforce and Azure DevOps fully in sync.

Fill in the fields:

• Label: Salesforce Named Credentials
• URL: https://yourInstance.my.salesforce.com
• Identity Type: Named Principal
• Authentication Protocol: Password Authentication
• Username: Your Azure DevOps username (e.g., user@domain.com)
• Password: Your Azure DevOps Personal Access Token (PAT)
• Generate Authorization Header: Checked

2. How to Configure a Salesforce Named Credential for Salesforce-to-Salesforce API Calls

Step 1: Create an External Client App

1. 1. Navigate to Setup → App Manager.
   2. Click New External Client App.
2.   3. Fill in all required fields: External Client App Name, Contact Email, and Distribution State (you can leave the default).
3. 4. Make sure to enable OAuth.
   1. Set the Callback URL to:
      https://example.com/ (this will be updated later).
   2. Under Selected OAuth Scopes, choose:

• Full Access (full)
• Perform requests at any time (refresh_token, offline_access) 

Save the app.

After saving:

• • Click Settings
  • Scroll to OAuth Settings
  • Open Consumer Key and Consumer Secret
  • Copy both values (you’ll need themin the next steps)

⚠️ You will return to this app in Step 3 to update the Callback URL.

Step 2: Create an Authentication Provider

1. Go to Setup → Auth. Providers.
2. Click New.
3. Set Provider Type to Salesforce.
4. Fill in the fields:
   • Name:  Enter an appropriate name
   • URL Suffix: Automatically fill in from the Name field
   • Consumer Key: from Step 1
   • Consumer Secret: from Step 1
   • Authorize Endpoint URL:
     https://yourInstance.my.salesforce.com/services/oauth2/authorize
   • Token Endpoint URL:
     https://yourInstance.my.salesforce.com/services/oauth2/token
   • Default Scopes:
     refresh_token offline_access full
5. Leave all other fields as default unless required.
6. Click Save.

⚠️ After saving, Salesforce will generate a Callback URL.
Copy this URL — it is required for the next step.

Step 3: Update the External Client App (Callback URL)

1. Return to the External Client App created in Step 1.
2. Click Edit Settings.
3. Replace the existing Callback URL with the one copied from the Auth. Provider (Step 2).
4. Save the changes.

Step 4: Create the Named Credential “Salesforce Connect”

1. Go to Setup → Named Credentials.
2. Click New Legacy.
3. Complete the fields:
   • Label: Salesforce Connect
   • Name: Auto-filled or custom
   • URL: Your Salesforce instance URL
     (e.g., https://yourInstance.my.salesforce.com)
   • Identity Type: Named Principal
   • Authentication Protocol: OAuth 2.0
   • Authentication Provider: Select the provider created in Step 2
   • Scope: refresh_token offline_access full
   • Start Authentication Flow on Save: Checked
   • Generate Authorization Header: Checked
   • Allow Merge Fields in HTTP Header: Checked
   • Allow Merge Fields in HTTP Body: Checked

Click Save and complete the authentication flow.