Answer Block

Salesforce in Claude setup takes two admins and a short checklist. A Salesforce admin requests beta access on AgentExchange, turns on the MCP server and creates an External Client App. A Claude organization owner adds the Salesforce connector with that app's credentials. Then each user signs in with their own Salesforce login. Start read-only.

Key Takeaways

• The beta needs a paid Claude plan and the latest Sales Cloud enterprise edition.
• You need two people: a Salesforce System Administrator and a Claude organization Owner.
• Every user signs in as themselves, so Claude gets their exact Salesforce permissions.
• Keep the beta read-only and try it in a sandbox first.

The Dreamforce demos worked. Now your inbox has twelve messages that all say some version of "can we get the Claude thing?"

Good news: setup is a configuration job, not a build. Salesforce says the basic connection takes less than 30 minutes. Less good news: the decisions around it take longer. Here's the whole checklist, in order. If your sales leaders need the "what is it" version first, send them our Claudeforce explainer.

What Do You Need Before You Start?

• A paid Claude plan. Anthropic says the beta is available on all paid Claude plans.
• The right Salesforce edition. Anthropic says your org needs the latest Sales Cloud enterprise edition to be eligible for the beta. Salesforce's hosted MCP servers need Enterprise Edition or above.
• Two people with the right keys. A Salesforce System Administrator (or equivalent) to create the External Client App, and a Claude Primary Owner or Owner to add the connector.
• A sandbox. Salesforce recommends making configuration changes in a sandbox or Developer org before production. Break things there, not in front of the sales team.

Step 1: Request Beta Access on AgentExchange

Request access through the "Sales Cloud in Claude Beta" listing on AgentExchange, the marketplace formerly called AppExchange. Salesforce approves orgs through that sign-up.

Step 2: Turn On the MCP Server

Salesforce's hosted MCP servers are off by default, which is exactly how you want them. In Setup, search for MCP Servers, find the server you need and click Activate. Salesforce in Claude connects through the Headless 360 server.

Then create a permission set for the users who should have access. Salesforce calls this optional but recommended. We'd call it non-negotiable.

Step 3: Create the External Client App

The External Client App is the bouncer at the door: it decides which outside app gets in and who it can bring along. In External Client App Manager:

• Enable OAuth with the `mcp_api` and `refresh_token` scopes.
• Require PKCE.
• Issue JWT-based access tokens for named users.
• Link the app to your permission set so only those users can authenticate.

Salesforce recommends one External Client App per AI tool. One for Claude, another for anything else. You get cleaner audit trails and can switch one tool off without touching the others.

Step 4: Add the Salesforce Connector in Claude

A Claude Primary Owner or Owner goes to Organization settings, then Connectors, then "Salesforce (Beta)," and enters the External Client App's consumer key and secret. Anthropic's setup article walks through each screen. It works in Claude chat and Claude Cowork.

Step 5: Keep the Beta Read-Only

Salesforce's own setup guide says to set tool restrictions that keep the beta read-only. Most AI tools also let you require approval before anything changes data. Turn that on too.

Your users won't feel shortchanged. Daily briefings, meeting prep and pipeline reviews only read, so they work from day one.

Step 6: Roll Out and Let Users Sign In

Each user signs in to the Salesforce connector with their own login. No shared accounts. Salesforce doesn't support service accounts or machine-to-machine logins here, so every action traces back to a named person. Your auditors will like you.

Tips From Our Pack

• Watch API usage. Every MCP call counts against your org's daily API limit.
• Know what the AI did. MCP traffic shows up in Salesforce's API logs with full user attribution. Filter on `API_CLIENT_CATEGORY = SALESFORCE_HOSTED_MCP`.
• Fix access before rollout. The AI inherits each user's permissions. If a profile sees too much today, the AI will too.
• Pilot small. One team, one workflow, two weeks. Then expand.

The Bottom Line

Two admins, six steps, one rule: start read-only and in a sandbox. Expand once your users, and your compliance team, trust what they see.

Frequently Asked Questions

Which Claude Plans Support Salesforce in Claude?

Anthropic says the Salesforce in Claude beta is available on all paid Claude plans. A Claude Primary Owner or Owner adds the Salesforce connector in Organization settings using your External Client App's consumer key and secret. After that, each user signs in to Salesforce with their own login.

Which Salesforce Edition Do I Need?

Anthropic says your org needs the latest Sales Cloud enterprise edition to be eligible for the beta, and Salesforce's hosted MCP servers need Enterprise Edition or above. Salesforce approves beta orgs through the AgentExchange sign-up. Your Salesforce account executive can confirm what your contract covers.

Can I Keep Salesforce in Claude Read-Only?

Yes. Salesforce's setup guide recommends tool restrictions that keep the beta read-only, and most AI tools can require approval before any tool changes data. Read-only routines like daily briefings, meeting prep and pipeline reviews still work, so users get value from day one.

Do Users Share One Salesforce Login?

No. Each user signs in with their own Salesforce credentials, and Claude works with that person's exact permissions. Salesforce doesn't support service accounts or machine-to-machine logins for its hosted MCP servers, so every change is logged under a named user.

Want a Second Set of Hands?

Book a discovery call. We'll answer your setup questions, review your access rules and give you a rough estimate for a pilot.

Get in touch with our pack of HLS Salesforce experts today!