How should I set up an Ad Network Integration if the Salesforce Administrator does not have access to the Ad Network?

Some of the Digital Source Tracker Ad Network Integrations (Google Analytics, Bing, and LinkedIn) include a step during the Salesforce configuration where the user is redirected from Salesforce to a login page for the ad network in order to authenticate between the two platforms. By default, this step must be completed by someone who:

1. Is a Salesforce Administrator (or at least has been assigned the Full Circle Digital Source Tracker permission set in the case of Bing and LinkedIn)
2. Has Viewer access to the ad network

This can be an issue if nobody in your organization has both levels of access. However, there are a few available solutions.

Solution #1: Create a Dedicated Integration User for the Ad Network (Recommended for Google Analytics and Bing)

This solution will only work for the Google Analytics and Bing integrations, because LinkedIn requires users to be tied to a real person profile.

1. Contact the administrator for the ad network and ask them to create a new user that has Viewer access for the ad network. Name the user something like "Integration User" so it's clear this user's purpose is for integrations and that it is not tied to any particular person.
2. Have the administrator for the ad network share the login credentials for this user with a Salesforce Administrator using a secure password manager.
3. Instruct the Salesforce Administrator to complete the Salesforce-related steps for configuring the respective ad network here and use the ad network integration user when prompted to log in to the ad network.

This approach is recommended because it ensures that the Ad Network Integration still works regardless of which employees lose access to the ad network. If an ad network user tied to an employee does the authentication, and that employee leaves the company and their user's access is disabled, then the Ad Network Integration will stop working.

Solution #2: Assign Permission Sets to User with Ad Network Access

For the Google Analytics integration:

1. Ask the Salesforce Administrator to create a new permission set:
   • On the Permission Set Overview page for this new permission set, select System Permissions.
   • Click Edit, check the box for Allow users to modify Named Credentials and External Credentials, and then hit Save.
   • Assign the permission set to the Salesforce user with (at least) Viewer access to the Google Analytics Property that will be used for the integration.
2. Ask the Salesforce user with (at least) Viewer access to the Google Analytics Property to complete Steps 5-8 in the Integrate the Daily Aggregate Database With Google Analytics page to authenticate between Salesforce and Google Analytics.
3. Once the integration has been set up and it is confirmed that Google Analytics data is flowing into the Salesforce org, the Salesforce Administrator can remove the permission set from the Salesforce user to whom it was assigned.

For the Bing and LinkedIn integrations:

1. Ask the Salesforce Administrator to assign the Full Circle Digital Source Tracker permission set to the Salesforce user who also has (at least) Viewer access to the ad network. That user can then complete the authentication flow from the OAuth Configuration (FCO_VFConfigAuth) page as documented in the respective ad network configuration page here.

NOTE: If the ad network user that completes these authentication steps has their access removed from the ad network (such as when the associated employee leaves the company), then the integration will stop working and these steps must be repeated with another user who has access. Therefore, Solution #1 is recommended over this approach.