Connect to Salesforce Reports and Salesforce Reports Sandbox

Strategy (October 2026) adds support for JWT Bearer authentication and the Salesforce Report API to parse and publish Salesforce Reports.

Create an OAuth Application in Salesforce

  1. Sign in to your Salesforce org.

  2. Click Create apps and New.

  3. Type an application name.

  4. Under Selected OAuth Scopes, add the following scopes:

    • Access chatbot services: chatbot_api

    • Access Connect REST API resources: chatter_api

    • Access content resources: content

    • Access custom permissions: custom_permissions

    • Access the identity URL service: id, profile, email, address, phone

    • Access unique user identifiers: openid

    • Manage Pardot services: pardot_api

    • Manage user data via APIs: api

    • Manage user data via Web browsers: web

    • Perform ANSI SQL queries on Data Cloud data: cdp_query_api

    • Perform requests at any time: refresh_token, offline_access

    • Perform segmentation on Data Cloud data: cdp_segment_api

  5. In Callback URL, add a Callback URL for Web, Library, or Workstation using the following formats:

    • Web redirect URI: https://<servername>/MicroStrategy/servlet/mstrWeb?evt=3172

    • Library redirect URI: https://<servername>/MicroStrategyLibrary/auth/DIOAuthRedirect.jsp

    • Workstation redirect URI: http://127.0.0.1

  6. Under Consumer Key, copy the Consumer Key and Consumer Secret values. You will need these values for future steps.

  7. For the newly created External Client App, contact Salesforce Support or Salesforce Organization Administrator to deselect the Enable Refresh Token Rotation setting.

    If this setting is deselected, Salesforce updates from static refresh tokens to rotatin, one-time refresh tokens. In your Strategy Salesforce Report connector, the refresh token cannot be exchanged and persisted in metadata except during login. As a result, users are unable to publish, republish, or schedule datasets.

Optionally Create a JWT App in Salesforce

Prepare a Key Pair Certificate

  1. Generate an RSA private key using the following:

    Copy 
    openssl genrsa -des3 -passout pass:x -out server.pass.key 2048

  2. Create a key file from the server.pass.key file using the following:

    Copy 
    openssl rsa -passin pass:x -in server.pass.key -out server.key

  3. Request and generate the certificate. After you execute the above command, you will be prompted to provide information.

    Copy 
    openssl req -new -key server.key -out server.csr

  4. Generate the SSL certificate using the following:

    Copy 
    openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt

  5. Rename server.key to server.pem.

Create the Connected App in Salesforce (JWT Enabled)

  1. Go to Setup and search External Client App Manager.

  2. Click New External Client App.

  3. Enter values in the External Client App Name, API Name, Contact Email, and Distribution State fields.

  4. Under OAuth Settings and App Settings, add the following scopes:

    1. Callback URL: Enter a valid URL similar to http://localhost:1717/OauthRedict.

    2. Select OAuth Scopes:

      • Manage user data via APIs (api)

      • Manage user data via Web browsers (web)

      • Full access (full)

      • Access Connect REST API resources (chatter_api)

      • Perform requests at any time (refresh_token, offline_access)

      • Access Analytics REST API resources (wave_api)

      • Access Analytics REST API Charts Geodata resources (eclair_api)

      • Access content resources (content)

      • Access Headless Forgot Password API (forgot_password)

      • Access Headless Registration API (user_registration_api)

      • Access the Salesforce API Platform (sfap_api)

      • Access Interaction API resources (interaction_api)

      • Access all Data Cloud API resources (cdp_api)

      • Access Headless Passwordless Login API (pwdless_login_api)

  5. Under OAuth Settings and Follow Enablement:

    1. Select the check box next to Enable Client Credentials Flow.

    2. Select the check box next to Enable JWT Bearer Flow and upload the server.csr file generated in Prepare a Key Pair Certificate.

  6. Save the app and note the Consumer Key and Secret from OAuth Settings > App Settings.

  7. Edit the newly saved app and go to Policies.

  8. Under OAuth Policies, choose Admin approved users are pre-authorized in Permitted Users field and save the app.

  9. Under App Policies, select the profiles you want to use the JWT workflow.

Authorize Users to Use the JWT App

  1. Create a new user or assign an existing user with the profiles you selected above.

    Note the username to be used for database instances.

  2. Edit the profile and select the View All Data and Run Reports settings.

Modify the Report Scope

For the Salesforce report that you want the JWT to view, modify the report in all scopes.

Create a Salesforce Data Source

Prerequisites

You must have the Configure security settings and Create and edit database instances and connections privileges.

Create a New Authentication Service in Workstation

For more information on creating identity and access management (IAM) objects, see Manage OAuth Enterprise Security with Identity and Access Management (IAM) Objects.

  1. Open the Workstation window.

  2. In the Navigation pane, click , next to Enterprise Security.

  3. Choose Gateway Authorization and click Next.

  4. Type a Display Name.

  5. Expand the Select an identity provider drop-down list, choose Salesforce.

  6. In Strategy Configuration, enter the Client ID and Client Secret you copied in Create an OAuth Application in Salesforce.

  7. Click Save.

Connect to Salesforce in Mosaic Studio

  1. Create a Mosaic model or right-click an existing Mosaic model and choose Edit.
  2. In the Sources tab, click Add API Source.

  3. Click Salesforce Reports or Salesforce Reports Sandbox.

  4. Type a Name for the data source.

  5. To create a new database connection:

    JWT Bearer and Salesforce Report API to parse and publish Salesforce reports is available starting in Strategy (October 2026). If you are using a version prior to Strategy (October), only OAuth authentication and the Export CSV API are available to parse and publish Salesforce reports.

    • If you choose OAuth as the Connection Method, you can set the Report API:

      1. If Report API is set to True, the Salesforce Report API will be used to parse and publish your Salesforce reports. The Report API has some limitations. For more information, see Salesforce Requirements and Limitations.

      2. If Report API is set to False, Export CSV API will be used to parse and publish your Salesforce reports.

      3. Expand the Authentication Service drop-down list and choose the authentication service you created in Create a New Authentication Service in Workstation.

    • If you choose JWT Bearer as the Connection Method, enter a Username, Password, and upload a Private Key.

  6. If the connection is successful, click Save.

Import Data

  1. Click your Salesforce source and enter your Salesforce login.

  2. Select the files you want to import.

    Starting in Strategy (October 2026), you can use the Salesforce Report API at the table-level. If a table fails with the default Export CSV API method, you can switch that table to use the Salesforce Report API. To change the import method, right-click the table and click Import Method.

  3. Click a file name to view the sample data.

  4. Click Add.

  5. Click Proceed.

  6. View and choose suggestions, view object logical relationships, or automatically create attributes and metrics.

  7. Click Save, Save as, or Publish.

  8. If you Saveor Save as your Mosaic model:

    1. Type a Name and Description.

    2. Choose a Save in folder location.

    3. Optionally, select the check box next to Certify Mosaic Model.