AAD federation to Salesforce

Question

I need to implement an AAD federation to Salesforce. At present all my users are in Salesforce.

I found a solution for AAD to Salesforce using the Salesforce enterprise app with SAML. I need this in the other direction as well. The client would like to keep Salesforce as the master accounting. Any other ideas or ways of solving this?

Greetings and thanks Damien

Answer 1

@Damien

Hi Damien,

Thanks for reaching out and apologies for the delayed response.

I'm assuming you're referring to the Azure Active Directory single sign-on (SSO) connection with Salesforce, which allows your users to be automatically logged in to Salesforce with their Azure AD credentials and manage their accounts in one central location - the Azure portal.

Could you briefly explain that when you say I need this in the other direction as well, you mean AAD federation with Salesforce such that Azure AD users get access to Salesforce with their account but must manually maintain and retain Salesforce as the master accounting? If this is the case, you may set the Provisioning mode to Manual, as shown below, so that users' accounts are never auto-provisioned from Azure AD and must establish link and update it manually.

Or do you mean allowing Salesforce users to utilize their accounts to access Azure resources? If this is the case, you can configure federation using SAML/WS-Fed identity providers for guest users as described here In this example, Salesforce functions as the identity provider, but you must verify that Salesforce supports SAML identity federation.

Hope this helps

-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Thanks for the reply. We are evaluating AAD to Salesforce and Salesforce to AAD for different use cases and are not sure on the best strategy.

The first use case that must work is that all our existing users in Salesforce can login to a Sharepoint app using AAD authn.

"Or do you mean allowing Salesforce users to utilize their accounts to access Azure resources? If this is the case, you can configure federation using SAML/WS-Fed identity providers for guest users as described here In this example, Salesforce functions as the identity provider, but you must verify that Salesforce supports SAML identity federation."

This SAML federation would work for this use case, correct? This would mean that we would continue to manage guest users in salesforce but they can use our sharepoint. Authz would be step 2.

Best regards Damien

Answer 3

I am trying the solution with the external identities and AAD with Salesforce as the accounting IDP. At present I can only get this to work for emails from the salesforce domain. The emails in the Salesforce app use many different domains. Can this solution work? Or how can I force that all external identities use the Salesforce IDP and not the other default Configured identity providers?

If I need to support emails from different domains in my Salesforce IDP, have you any solutions for this? All my external users are only in the Salesforce IDP.

Any suggestions?

Regards Damien