Walkthrough
Choose which Salesforce orgs a workspace can connect
A Team workspace administrator can list the Salesforce orgs that members may connect. Access is controlled for the whole workspace, not approved separately for each member.
Before you begin
This control is available in a Team workspace and can be changed by a workspace administrator. Each person still connects with their own Salesforce user, and Salesforce permissions continue to control the objects, fields, and records they can use.
Step 1: Choose the filtering mode
From the canvas, open the account and workspace menu, select Settings, and open the Workspace tab. Expand Salesforce org access. In the Org filtering dropdown, choose:
- No org filtering lets members connect any Salesforce org.
- Allowlist production orgs requires production orgs to be listed, while sandboxes, Developer Edition orgs, and scratch orgs remain available. Choose this when only production connections need to be restricted.
- Allowlist every Salesforce org requires every production and non-production org to be listed.
Step 2: Add an allowed org
After choosing an allowlist mode, select Add Salesforce org under Allowed Salesforce orgs. Enter a recognizable name and the org's Current My Domain URL. Find it in Salesforce Setup under Company Settings → My Domain. Select Add org to save the entry.
Required format: enter only the HTTPS base URL, such
as https://acme.my.salesforce.com or
https://acme--uat.sandbox.my.salesforce.com. Do not enter
login.salesforce.com, test.salesforce.com, a
Lightning record URL, or a URL containing a path or query string.
The first successful connection through that entry associates the URL with Salesforce's permanent ID for that org, so later checks identify the org itself rather than relying only on its name. The entry then applies to all current and future workspace members.
Step 3: Connect Salesforce
A member opens Salesforce connections and chooses Connect to Production, Connect to Sandbox, or enters an org’s Current My Domain URL. Salesforce identifies the actual org during authorization. Org Loom then checks that org against the workspace policy before saving or activating the connection. A disallowed connection is discarded and the member sees an explanation.
Remove an org
Select Remove beside the entry under Allowed Salesforce orgs to stop the workspace from using that org. The next attempt to use an active connection to that org is blocked, including reading records, uploading, saving canvases, and live collaboration. Work already written to Salesforce is not undone.