Connect a client for full monitoring

Full monitoring reads a client org every 30 minutes through a connection that can only read. Setting it up adds a few items to the client org. You choose who makes them. All three ways end in the same place.

What gets added to the client org

Item	What it is for
An integration user, on the Salesforce Integration licence	The identity the connection uses. It is for API access only.
The OrgHealth_Connector_Access permission set	API Enabled, View Setup and Configuration, Monitor Login History, View Event Log Files, View Health Check, View Roles, Manage Data Integrations. No Modify All Data, and no Manage Users.
A public group and a sharing rule on Flow interviews	Lets the integration user read failed Flow interviews, and only those
The “Org Health Monitor Connector” app	Holds your consultancy’s public certificate. Your org signs in as the integration user with its private key, so no password exists.
Optionally, your Flow error address	So Flow failures arrive in seconds. See Flow errors only for the two Setup changes.

The client org needs a free Salesforce Integration user licence for the integration user.

Option 1: the client admin’s login (recommended)

The quickest for the client admin, and nothing to copy between orgs.

1. In Add client, choose Connect with Salesforce. The window shows the setup app’s install link and lists every change it will make.
2. The client admin installs the setup app in their org. They do this once per org.
3. The admin reads the list, agrees, and chooses Log in and set up. They log in to their own org in a pop-up and approve.
4. The app checks that the login is for the right org, makes the listed changes, tests the connection and runs the first check. Then it revokes the admin’s login and confirms that it no longer works.

The admin’s login is held only for those minutes, encrypted, and is usable only by the manager running the setup. It never appears in a record or a log. Security details

Option 2: a script

For admins who use the Salesforce CLI. The Add client window shows one command for the client admin to run against their org. The command prints four values to paste back into the window: the My Domain URL, the org ID, the integration username and the consumer key. The window then creates the connection on your side and runs the first check.

Option 3: a Setup checklist

For admins who’d rather click through Setup themselves. The window gives step-by-step instructions with links, and a download of your public certificate. At the end they send you the same four values as the script prints.

If setup stops halfway

If the window closes before the connection is made, the client shows Setup not finished in Manage clients. Finish setup reopens the window where it stopped. Any login left from an unfinished setup is ended automatically after 30 minutes.

Sandboxes

Add each sandbox as its own environment of the same client. A refresh gives a sandbox a new org ID. The next check notices, collects nothing else, and shows that the org has changed. A manager then accepts the new org ID before collection carries on. That way you never see data from the wrong org.