Hello,
I recently completed an audit of all connected apps installed in my org in response to the
recent security change affecting uninstalled connected apps. A majority of my connected apps are currently allowing all users to self-authorize. I'd like to change this and have been looking into enabling API access control.
I was hoping someone could help me understand how the API enabled user permission and API access control interact. I understand by enabling API access control the permitted users setting in all connected apps in my org would change to Admin approved users are pre-authorized. I'd then assign permission sets to manage connected app access. Users who need to make API requests would still need the API enabled user permission.
My questions:
- If I enable API access control, would that ensure users (even with API Enabled permission) can only make API requests through connected apps I’ve explicitly granted them access to?
- Hypothetically, would I get the same end result if I chose not to enable API access control, and instead manually changed the permitted users setting in each connected app to Admin approved users are pre-authorized?
I’m not assigning the new Approve Uninstalled Connected Apps permission to any users.
#Security
- If I enable API access control, would that ensure users (even with API Enabled permission) can only make API requests through connected apps I’ve explicitly granted them access to?
- Yes, with API access control, users will only have access to connected apps you defined. BTW the API Enabled user permission is a prerequisite to be assigned access to connected apps.
- Hypothetically, would I get the same end result if I chose not to enable API access control, and instead manually changed the permitted users setting in each connected app to Admin approved users are pre-authorized?
- This model would be less secure, you wouldn't have the same granular level of control. If all your apps have the 'Admin approved users are pre-authorized' setting, then any user with the API enabled permission can access ANY app. With API Access Control, you can specify the individual connected app each user can access on a case by case basis.
This article might be helpful: https://www.apexhours.com/enabling-api-access-controls/
- If I enable API access control, would that ensure users (even with API Enabled permission) can only make API requests through connected apps I’ve explicitly granted them access to?
