vulkro-sf org integration-users
Checks the live org's integration and service accounts for excess privilege, human use and staleness.
vulkro-sf org integration-users --target-org <alias>
vulkro-sf org integration-users -o <alias> --format json
| Finding | Severity | Meaning |
|---|---|---|
SF-INTEG-USER-001 | High | An integration user has API access plus admin-level permissions. |
SF-INTEG-USER-002 | Medium | An integration account had a recent interactive login: a person is using it. |
SF-INTEG-USER-003 | Low | An integration account has not logged in for over 180 days. |
SF-SVC-USER-001 | High | A service account is exempt from MFA and not locked to login IPs. |
SF-SVC-USER-002 | Medium | A service account has no expiry and a session window over 60 minutes. |
SF-SVC-USER-003 | High | A service account holds Modify All Data, View All Data or Author Apex. |
Integration users are found by known integration profile names. Service accounts are found among all active users by username, alias and profile patterns, so review the match before acting.
See also: org effective-perms, org mfa.