Share via

Mapping Multiple Entra ID Roles to Salesforce Profiles

Bianca Micu 0 Reputation points
2024-09-02T11:30:51.8466667+00:00

I am currently setting up Single Sign-On (SSO) and user provisioning between Microsoft Entra ID (formerly Azure AD) and our Salesforce instance. One of our goals is to map the roles in Entra ID to profiles in Salesforce. I am using out-of-the-box Entra ID application for Salesforce instances. However, we have encountered a challenge: Salesforce only allows each user to have one profile, but users in Entra ID can have multiple roles. We want to implement Azure Privileged Identity Management (PIM) so that users can temporarily have elevated access. This means users might have an additional role in Entra ID without replacing their existing role.

I initially used the default value for the ProfileName attribute, which was set to SingleAppRoleAssignments(appRoleAssignments). However, when a user is assigned multiple roles, this setup fails, producing an error indicating that multiple roles cannot be mapped to the Salesforce profile field. I also tested using only the appRoleAssignments value, which generates a comma-separated list of Entra ID roles. In this case, Salesforce only assigns the first role from the list to the user's profile, ignoring the rest.

How can we effectively manage the mapping of multiple roles from Entra ID to Salesforce? Specifically, how can we ensure that the temporary roles granted via Azure PIM (which result in additional roles in Entra ID) do not conflict with the one-profile limitation in Salesforce? Has anyone successfully implemented a similar setup? If so, which Salesforce user fields or attributes did you map the multiple roles from Entra ID to?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,379 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Akhilesh 8,875 Reputation points Microsoft Vendor
    2024-09-05T20:51:10.52+00:00

    Hi @Bianca Micu

    Thank you for reaching us!

    I understand that you are trying to be mapping multiple roles from Entra ID to Salesforce profile.

    To Provisioning a role to a SCIM app I suggest you go through the below article which has explained about single & multiple roles.

    Provisioning a role to a SCIM app.

    Hope this helps. Do let us know if you any further queries by responding in the comments section.

    Thanks,

    Akhilesh.

    If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.