Provision Quip with Salesforce: FAQ and Best Practices

What permission sets do users need to access Quip from Salesforce?

Users need the Quip User permission set at minimum to access Quip functionality within Salesforce. Users who will create or manage Quip Document Components also need the Quip Admin permission set. Assign these from Salesforce Setup under Permission Sets.

Do all Salesforce users automatically get access to Quip?

No. Even if Quip is provisioned at the org level, individual users must be assigned the appropriate Quip permission set and must complete the Salesforce-to-Quip connection setup before they can access Quip content from within Salesforce records.

What is the Salesforce-Quip connection and why do users need to complete it?

The Salesforce-Quip connection is a one-time OAuth authorization that links a user's Salesforce identity to their Quip account. Users are prompted to complete this when they first interact with a Quip Document Component on a Salesforce record. Without it, they cannot view or edit embedded Quip documents.

Example: A new sales hire opens an Opportunity and sees a Quip document component. They are prompted to connect their accounts — they click Connect, authenticate through Quip, and from that point forward, all Quip document components in Salesforce work seamlessly for them.

How do I configure domain settings so users auto-join the correct Quip site?

Add your corporate email domain (for example, yourcompany.com) as a trusted domain in the Quip Admin Console under Settings > Accounts & Access > Domain Settings. With the correct domain added and auto-join enabled, users who sign up with a matching email are automatically directed to your Quip site. See Domain Settings for Quip for full instructions.

Should we use SSO or direct Quip login?

For organizations using Salesforce as their identity provider, configuring SSO through Salesforce is strongly recommended. SSO ensures users do not need a separate Quip password, aligns with your existing security policies, and makes offboarding simpler — deactivating a user in Salesforce automatically blocks their Quip SSO access. See Configure Salesforce and Quip for SSO for setup steps.

Can we use SCIM to automatically provision Quip users?

Yes. Quip supports SCIM 2.0 provisioning, which allows your identity provider to automatically create and deactivate Quip accounts based on user directory changes. See How to Integrate SCIM with Quip for configuration steps.

What is the recommended order for provisioning steps?

1. Configure domain settings and trusted domains in the Quip Admin Console
2. Configure SSO (if applicable)
3. Set up SCIM provisioning (if applicable)
4. Assign Quip permission sets to users in Salesforce
5. Have users complete the Salesforce-Quip connection
6. Configure Quip Document Components on Salesforce record pages