Help using RegexReplace() to edit NameID in Attributes & Claims of Entra ID SSO connection to Salesforce

Question

Help using RegexReplace() to edit NameID in Attributes & Claims of Entra ID SSO connection to Salesforce

Seitel Systems at Inatai 0

Hello Community,

Due to unexpected circumstance we are unable to utilize our UPN's from Entra ID as our usernames in Salesforce. We just need to modify the username in Salesforce to be unique but that brought along problems with getting SSO to work. I think RegexReplace looks like the method that will allow us to get where we want. Though I'm very frustrated that we don't have the "expression" method thats available in provisioning. I've used provisioning to take our UPN and add on ".charm" to the end. That functions correctly but I just can't get the Attributes and claims to match that simple addition. Can someone help me understand the RegexReplace format/syntax or just let me know what "regex pattern" and "replacement pattern" should work for this? I went through Saleforce support but they weren't very familiar with this either.

Carolyne-3676 1,141 Reputation points

2026-03-18T16:57:28.0433333+00:00

To append a suffix (e.g. .charm) to the UPN for the SAML NameID in Entra ID, use the RegexReplace transformation on user.userPrincipalName with: Regex pattern: (?'upn'^.*)$ and Replacement pattern: {upn}.charm — this mirrors what provisioning’s Append() does, but expressed in the SAML claims engine syntax

The main limitation I have seen is that Attributes & Claims don’t support the same expression language as provisioning (no Append()), so RegexReplace is the only supported way to manipulate NameID inline; Salesforce will then match the modified NameID to the unique Username you’ve stored there

Your answer

Carolyne-3676 1,141 Reputation points

2026-03-18T16:57:28.0433333+00:00

To append a suffix (e.g. .charm) to the UPN for the SAML NameID in Entra ID, use the RegexReplace transformation on user.userPrincipalName with: Regex pattern: (?'upn'^.*)$ and Replacement pattern: {upn}.charm — this mirrors what provisioning’s Append() does, but expressed in the SAML claims engine syntax

The main limitation I have seen is that Attributes & Claims don’t support the same expression language as provisioning (no Append()), so RegexReplace is the only supported way to manipulate NameID inline; Salesforce will then match the modified NameID to the unique Username you’ve stored there