The most common task on this page is tightening an existing Connected App's OAuth policy. These steps configure who can use an app, how IP rules apply, and how long its refresh token lives.
- Open the page
From Setup, type Connected Apps in the Quick Find box and select Manage Connected Apps. The list shows every app installed in or created within the org.
- Edit the app's policies
Click Edit next to the target app, then Edit Policies. This opens the OAuth policy section where the access controls live.
- Restrict who can authorize it
Set Permitted Users to Admin approved users are pre-authorized for anything beyond a personal tool, then assign only the profiles or permission sets that genuinely need the app.
- Set IP and refresh token rules
Choose the IP Relaxation option the integration can tolerate, then pick a Refresh Token Policy. Idle expiry is a sensible default for most apps.
- Save and verify usage
Save the policies, then open Connected Apps OAuth Usage to confirm the app's active sessions still look correct and revoke anything unexpected.
All users may self-authorize (any user can grant access) or Admin approved users are pre-authorized (only assigned profiles or permission sets, no consent prompt).
Enforce IP restrictions; Enforce but relax for refresh tokens; Relax for activated devices; or Relax IP restrictions entirely.
Valid until revoked; immediately expire; expire if not used for a set period; or expire after a fixed period.
Optional. When enabled with an HTTPS logout URL, signs the user out of the connected app when they log out of Salesforce.
- All users may self-authorize is the default. Leaving it on means any API-enabled user can grant an app access to their data without admin involvement.
- The Manage Connected Apps page sets policy, but revoking live sessions happens on the separate Connected Apps OAuth Usage page.
- A refresh token policy of valid until revoked combined with broad scopes is the highest-risk pattern; prefer an expiry for sensitive integrations.
- Relaxing IP restrictions weakens a real control. Only loosen it for apps, like mobile clients, that genuinely cannot work behind fixed ranges.