The Backstory: Your Salesforce data sync starts failing with permission errors, or your team hits an authentication error at login, and nothing on your side has changed. Rather than opening a ticket and waiting for a diagnosis, you install and authorize the Backstory Connected App directly in Salesforce Setup. This clears the OAuth errors and keeps your integration running under Salesforce's new access requirements.
Salesforce Connected App authorization is a one time setup step that tells Salesforce your administrator has approved Backstory to connect to your org. Salesforce recently changed its security policy to block new and re-authenticating users from accessing Connected Apps that an administrator has not explicitly installed and authorized. This is a Salesforce requirement, not a Backstory platform issue, and it applies to every customer with an active Salesforce integration. Existing connections may keep working until their token expires, so all organizations will be affected eventually.
For full details on the change and Salesforce's recommendations, see the Salesforce help article Prepare for Connected App Usage Restrictions Change.
Signs Your Organization Is Affected
You are likely affected by this policy change if any of the following are true:
Your background data sync is failing with permission errors, and your logs show an
OAUTH_APP_ACCESS_DENIEDerror.Users see an error page when they open the Backstory App (formerly PeopleGlass), with a message similar to
OAUTH_APPROVAL_ERROR_GENERIC: An unexpected error has occurred during authentication. Please try again.You have tried to configure the Salesforce integration without success.
Authorize the Backstory Connected App
These steps authorize the Backstory Connected App if you encounter any of the errors above.
Note: Completing these steps requires a Backstory administrator account and a Salesforce System Administrator account.
Log into Backstory Engagement Dashboards as an administrator.
Click the grid icon in the top left corner.
Select Admin Panel.
In the left navigation menu under CRM Sync, click CRMs.
Locate your Salesforce connection, then click Review Settings.
Click Authorize on your Salesforce connection. This attempt may fail with an error, which is expected. It registers the Connected App so your Salesforce administrator can find it in the next step.
In Salesforce, navigate to Setup > Connected Apps OAuth Usage.
Find the Backstory application you need to authorize, then click Install.
Click Manage App Policies.
Click Edit Policies.
In the OAuth Policies section, click the Permitted Users dropdown.
Select Admin approved users are pre-authorized from the list.
Click Save.
On the Connected App page, click Manage Permission Sets or Manage Profiles.
Add the profile or permission set that contains the integration user and any other users who need access.
Click Save.
Return to Backstory and authorize your Salesforce connection again from the CRMs page.
Confirm Data Is Flowing Between Salesforce and Backstory
After re-authorizing, use these checks to confirm that Backstory and Salesforce are exchanging data.
Navigate to the Backstory Admin Panel, then click CRMs under CRM Sync.
Select your Salesforce integration, then click Review Settings.
On the Connection and Package tab, confirm that the connection shows as active.
Open the Permissions tab and check the Last Synced date and time. A recent timestamp indicates that data is flowing.
Open the Sync Log tab and confirm that recent push and pull operations completed successfully.
If any of these checks look wrong after re-authorizing, contact support@backstory.ai.
Frequently Asked Questions
Why is this action suddenly required?
Salesforce released a mandatory security update that requires administrators to explicitly approve all third party Connected Apps. This is not a change Backstory made.
Is the Backstory service down, or is this a bug?
No. The Backstory service is fully operational. The error is a direct result of the new Salesforce security policy.
I cannot find the Backstory app in my Connected Apps OAuth Usage list. What should I do?
This is expected if a connection has not been attempted recently. Trigger a connection attempt from Backstory first, as described in steps 1 and 2 above. The attempt will likely fail, but it makes the app visible so you can authorize it.
As an administrator, do I need to authorize every user one by one?
No. After you set the Permitted Users policy, you can grant access to an entire profile or permission set at once.
Does this Salesforce change affect our other applications?
Yes, it can. The policy applies to all uninstalled Connected Apps in your Salesforce environment, not only Backstory apps.
Need Help?
Contact your Customer Success Manager or support@backstory.ai.