Azure-docs: Azure Salesforce Provisioning not syncing SF Profiles to AD Roles

[henslecd]

We have Salesforce Provisioning set up in Azure. When selecting a "Role" in Azure, only the standard SF Profiles are in the list to be selected. The custom SF profiles are not in the list.

There is another thread that says that Azure doesn't consume SF Profiles, only SF Roles. That is not true. The Roles in Azure are 1:1 with the standard SF Profiles. Unfortunately the custom SF profiles are not being synchronized.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 624be0a5-9ab6-ec59-e7a2-74585cb0571e
• Version Independent ID: a00a09c8-f0c5-2bfe-75aa-6183346af405
• Content: Tutorial: Configure Salesforce for automatic user provisioning with Azure Active Directory
• Content Source: articles/active-directory/saas-apps/salesforce-provisioning-tutorial.md
• Service: active-directory
• GitHub Login: @jeevansd
• Microsoft Alias: jeedes

[Karishma-Tiwari-MSFT]

@henslecd Thanks for your question. Please provide us with the link to the documentation you are referring to so we can better assist.

[henslecd]

Here you go. https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/salesforce-provisioning-tutorial

[Karishma-Tiwari-MSFT]

@henslecd Thanks for sharing the document. I have updated the issue with doc details.
We are currently investigating and will update you shortly.

[henslecd]

Any updates on this?

[aognenoff]

Following. I am seeing the same issue - only standard, internal profiles are being imported. Can provisioning not be used for external Salesforce users?

[sweetcaoz]

I am following this as well, We just have the same problem with a Salesforce Production is not taking custom Profiles however this is working on Salesforce Sandbox. Is there any update on this? our Salesforce Provisioning is stuck

[DJackson625]

I'm having the same issue using Remedyforce. any updates on this?

[fabienturcotte]

@jeevansd: in post https://github.com/MicrosoftDocs/azure-docs/issues/13103 you mention the custom profiles are being read when the provisioning is enabled. What if there are new profiles being created in Salesforce after enabling the provisioning?

We are having this issue where we've been using the provisioning for a while now and have now created a few new Salesforce profiles. However, when going back to Azure to be able to assign Groups to these Profiles, we cannot find these newly created Salesforce profiles.

[salomonzapata]

Having same issue in a production environment. @jeevansd was this issue ever resolved or workaround provided in order to have newly created salesforce profiles appear in Azure?

[DJackson625]

Never resolved. I’m still having a problem.

Dexter Jackson
VP, Information Technology Services
RXR Realty
625 RXR Plaza
Uniondale, New York 11556
T: 516.506.6603
[email protected]
www.rxrrealty.com
Confidentiality Notice: The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient, you should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.
From: juliancasablanca [e-mail]
Sent: Monday, March 4, 2019 4:40 PM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Jackson, Dexter [e-mail]; Comment [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

Having same issue in a production environment. @jeevansdhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_jeevansd&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=ttRMGiYQI03MCPiueNEubcUd8He44iTvNGMjIQ8nnNs&s=6nEJW8sqymd4E0ERKxSU8MciXEWOts5JbKb2mmiSh98&e= was this issue ever resolved or workaround provided in order to have newly created salesforce profiles appear in Azure?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_MicrosoftDocs_azure-2Ddocs_issues_22223-23issuecomment-2D469432137&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=ttRMGiYQI03MCPiueNEubcUd8He44iTvNGMjIQ8nnNs&s=R-OBf-vU5XjySgcb-tew9GsvW1hi2tyHDkJK8UiiJDo&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AtaLTfCSYF5LqPdVR0deTiIdSCQSpdwEks5vTZKagaJpZM4Z8Wt-5F&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=ttRMGiYQI03MCPiueNEubcUd8He44iTvNGMjIQ8nnNs&s=EJGpLfq3smPwUIHYlAxGjhjGMb0YEbc2AunwWADDAbw&e=.

[fabienturcotte]

A workaround I could think of is to recreate a whole new App in Azure. However it would require significant rework to redo the whole mapping again, point the users to this new app and then restart the user provisioning again.

Seems like a lot of effort for something Microsoft should be fixing.

[henslecd]

We already had all profiles in place when we created the app in Azure. I
think something must have broken recently if it used to work.

On Mon, Mar 4, 2019, 6:00 PM fabienturcotte [e-mail]
wrote:

A workaround I could think of is to recreate a whole new App in Azure.
However it would require significant rework to redo the whole mapping
again, point the users to this new app and then restart the user
provisioning again.

Seems like a lot of effort for something Microsoft should be fixing.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/MicrosoftDocs/azure-docs/issues/22223#issuecomment-469457083,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABfSamSQxtus4_E5cvWcJDIcVuqECf8Eks5vTaWogaJpZM4Z8Wt_
.

[jeevansd]

@henslecd and @sweetcaoz We are working with our engineering team on this to get the details on this issue.

[DJackson625]

As of today this is the synchronization details ( Enterprise applications - All applicationshttps://aad.portal.azure.com/ SalesForce– Provisioning)

Summary
We have synchronized 705 object(s) of type User to User.
Synchronization was last run on Mon Apr 01 2019 17:07:51 GMT-0400 (Eastern Daylight Time)
Most recent full synchronization was completed Mon Apr 01 2019 17:07:51 GMT-0400 (Eastern Daylight Time)
We completed the first full synchronization on Thu Feb 14 2019 18:08:26 GMT-0500 (Eastern Standard Time)
Errors

Which is correct as to the amount of AD users, but for some reason not all of the users are showing in SF which leads me to a problem syncing.

Please advise.

Dexter Jackson
VP, Information Technology Services
RXR Realty
625 RXR Plaza
Uniondale, New York 11556
T: 516.506.6603
[email protected]
www.rxrrealty.com
Confidentiality Notice: The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient, you should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.
From: Jeevan Desarda [e-mail]
Sent: Monday, April 1, 2019 6:40 PM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Jackson, Dexter [e-mail]; Comment [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

@henslecdhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_henslecd&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=4IKTLZhW4ejOBCxEKaKQPmgsWx8LmPQAOXC0cxyrm6I&s=yedDcZTwgCHXoCNa1ByRBlU6YQJtNzBuXHCkPN2zmgA&e= and @sweetcaozhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_sweetcaoz&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=4IKTLZhW4ejOBCxEKaKQPmgsWx8LmPQAOXC0cxyrm6I&s=ML8eIqOknRHaoGMLxUhKIWPMp7-ZnVRN3D5pdCTeBI8&e= We are workign with our engineering team on this to get the details on this issue.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_MicrosoftDocs_azure-2Ddocs_issues_22223-23issuecomment-2D478772954&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=4IKTLZhW4ejOBCxEKaKQPmgsWx8LmPQAOXC0cxyrm6I&s=_NR0gVP-EtmuOHroaSF128CNcm1nOu5tuyVPUllwP2E&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AtaLTULOv50mPHhMQ8u46IerD5k-2DWphqks5vcoq9gaJpZM4Z8Wt-5F&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=4IKTLZhW4ejOBCxEKaKQPmgsWx8LmPQAOXC0cxyrm6I&s=alvjy_DDNYSEG6Iim3N40gIYiCNN0uL7B8tlWHJU20U&e=.

[charltonstanley]

This is also an issue for my organization. Is this functionality actually supported and is currently not working? Or is this more of a feature that will be added in the future?

[1SalesforceUnicorn]

This is also an issue for my organization. Please advise if the syncing of profiles and roles between Azure and Salesforce is currently supported. Has anyone been able to successfully sync a custom attribute? When does Microsoft plan on having a resolution for this matter?

[DJackson625]

I hope this helps. I was able to get up and running using these settings.

Azure Active Directory/ Enterprise Applications/select app – Salesforce or Remedyforce / Provisioning / Mapping

[cid:[email protected]]

Click on Synchronize Azure Active Directory Users to Salesforce.com

The two attributes I’m using are highlighted
[cid:[email protected]]

[cid:[email protected]]

[cid:[email protected]]

Dexter Jackson
VP, Information Technology Services
RXR Realty
625 RXR Plaza
Uniondale, New York 11556
T: 516.506.6603
[email protected]
www.rxrrealty.com
Confidentiality Notice: The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient, you should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.
From: SalesforeUnicorn [e-mail]
Sent: Thursday, April 11, 2019 1:42 PM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Jackson, Dexter [e-mail]; Comment [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

This is also an issue for my organization. Please advise if the syncing of profiles and roles between Azure and Salesforce is currently supported. Has anyone been able to successfully sync a custom attribute? When does Microsoft plan on having a resolution for this matter?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_MicrosoftDocs_azure-2Ddocs_issues_22223-23issuecomment-2D482221272&d=DwMFaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=oWVlpsmo3pzVE01wibn1bgX-DKXLlDqC3LiWRtNyTQE&s=KjutIPkZNXpmOs2ToTG_o5DXnAj3XV8bsZTN7DGkzP0&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AtaLTaX-5Fs1qlNU5MhIkLTRvo-2DEdYHULbks5vf3PjgaJpZM4Z8Wt-5F&d=DwMFaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=oWVlpsmo3pzVE01wibn1bgX-DKXLlDqC3LiWRtNyTQE&s=vsO_pqOMXdNYA10_dJa-12hDm7UKpUg0oWQ4HxdZ2o4&e=.

[1SalesforceUnicorn]

Thank you so much!

From: DJackson625 [e-mail]
Sent: Thursday, April 11, 2019 11:10 AM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Kimberly Cobb [e-mail]; Comment [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

I hope this helps. I was able to get up and running using these settings.

Azure Active Directory/ Enterprise Applications/select app – Salesforce or Remedyforce / Provisioning / Mapping

[cid:[email protected]]

Click on Synchronize Azure Active Directory Users to Salesforce.com

The two attributes I’m using are highlighted
[cid:[email protected]]

[cid:[email protected]]

[cid:[email protected]]

Dexter Jackson
VP, Information Technology Services
RXR Realty
625 RXR Plaza
Uniondale, New York 11556
T: 516.506.6603
[email protected][e-mail]
www.rxrrealty.comhttp://www.rxrrealty.com
Confidentiality Notice: The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient, you should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.
From: SalesforeUnicorn <[email protected][e-mail]>
Sent: Thursday, April 11, 2019 1:42 PM
To: MicrosoftDocs/azure-docs <[email protected][e-mail]>
Cc: Jackson, Dexter <[email protected][e-mail]>; Comment <[email protected][e-mail]>
Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

This is also an issue for my organization. Please advise if the syncing of profiles and roles between Azure and Salesforce is currently supported. Has anyone been able to successfully sync a custom attribute? When does Microsoft plan on having a resolution for this matter?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_MicrosoftDocs_azure-2Ddocs_issues_22223-23issuecomment-2D482221272&d=DwMFaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=oWVlpsmo3pzVE01wibn1bgX-DKXLlDqC3LiWRtNyTQE&s=KjutIPkZNXpmOs2ToTG_o5DXnAj3XV8bsZTN7DGkzP0&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AtaLTaX-5Fs1qlNU5MhIkLTRvo-2DEdYHULbks5vf3PjgaJpZM4Z8Wt-5F&d=DwMFaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=oWVlpsmo3pzVE01wibn1bgX-DKXLlDqC3LiWRtNyTQE&s=vsO_pqOMXdNYA10_dJa-12hDm7UKpUg0oWQ4HxdZ2o4&e=.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHubhttps://github.com/MicrosoftDocs/azure-docs/issues/22223#issuecomment-482234353, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AvPN5d1o9ehmCgC4CtLKgdMSTkLKkkE3ks5vf3pzgaJpZM4Z8Wt_.

[dustinlcraig]

@DJackson625

Could you please clarify the attributes that you had highlighted? I can't see the picture and I'm having a similar issue.

Thanks!

[DJackson625]

Azure Active Directory admin/Enterprise Applications/salesforce/provisioning/mappings/
Click on the field “Synchronize Azure Active Directory Users to salesforce.com”

Enabled should be set to yes
Source object
User
Source object scope
All records
Target Object Actions
*place check marks on the following:
Create
Update
Delete

Attribute Mappings Saleforce.com Attribute Matching
userPrincipalName UserName 1
SingelAppRoleAssignment ProfileName

Click save

Dexter Jackson
VP, Information Technology Services
RXR Realty
625 RXR Plaza
Uniondale, New York 11556
T: 516.506.6603
[email protected]
www.rxrrealty.com
Confidentiality Notice: The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient, you should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.
From: dustinlcraig [e-mail]
Sent: Monday, April 22, 2019 3:56 PM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Jackson, Dexter [e-mail]; Mention [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

@DJackson625https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_DJackson625&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=qJQnoqh_SoWUOzMQCWY8_HvXz11otza5YrvmXhB3NAA&s=EHO8QDd3bZELeeKw2rP25_umMPS0W2A4GSEwZZHjYJ0&e=

Could you please clarify the attributes that you had highlighted? I can't see the picture and I'm having a similar issue.

Thanks!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_MicrosoftDocs_azure-2Ddocs_issues_22223-23issuecomment-2D485531103&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=qJQnoqh_SoWUOzMQCWY8_HvXz11otza5YrvmXhB3NAA&s=jbRu9TwpZRiyMd-S3Hj2cmeNgEhsBPJ6CLmU59IOSQA&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_ALLIWTM4XE4SGVUHD5IW4J3PRYJ37ANCNFSM4GPRNN7Q&d=DwMCaQ&c=rGIfYmk-1z7cfZPhPNJ2NA&r=xFXf11WonGCmJqods-1nHd6KZb07-uu4YYY6mxqhn1k&m=qJQnoqh_SoWUOzMQCWY8_HvXz11otza5YrvmXhB3NAA&s=A3L79dZ87TwuS9HYZamu96AAreFtf8JiMBSztiuuKCE&e=.

[Archehandoro]

Unfortunately, for us, using the mappings as @DJackson625 suggested doesn't import the custom profiles/roles from Salesforce into Azure AD.

Did anyone got lucky adding other mappings?

Edit: Ok, I have managed to do it! The trick is to change the mapping type on SingleAppRoleAssignment from "Expression" to "Direct", then select the source attribute to "appRoleAssignments", leave the Target attribute on "ProfileName", and click on "Yes" under the Match objects using this attribute box and then click Ok. Save the changes on the Attribute Mapping, wait for the sync, et voila!

Hope this helps to more people.

[CloudwizSolutions]

Working with a client on this, and following the additional suggestions by @Archehandoro, we got the SF profiles to sync to Azure Roles - great!

A totally unexpected behavior is that Azure AD also created 1181 +NEW+ Chatter Free users in the SF Org - one for every account in AD. 😵 I deactivated all of the new users, with XL Connector, but this was a bit of a hairball in a production Org. Any thoughts as to how to preclude this from happening? I honestly didn't expect that a sync would create new users in SF unless specified.

[Archehandoro]

Working with a client on this, and following the additional suggestions by @Archehandoro, we got the SF profiles to sync to Azure Roles - great!

A totally unexpected behavior is that Azure AD also created 1181 +NEW+ Chatter Free users in the SF Org - one for every account in AD. I deactivated all of the new users, with XL Connector, but this was a bit of a hairball in a production Org. Any thoughts as to how to preclude this from happening? I honestly didn't expect that a sync would create new users in SF unless specified.

Sorry to hear that! Yeah, by syncing if the user to be provisioned isn't on SF then the account gets created. If the account exists, and something has changed, it gets updated. I should have specified that better in my previous comment.

Within the "Users and groups" of the Salesforce app in Azure AD, did you add all the org?

[syswpit]

How can get custom profiles if I use SAML SSO and no provisioning?
Under users and groups I have to choose a profile but only a couple of profiles are shown. No custom profiles.

I'd rather have Salesforce manage this because everyone is already setup there.

[Archehandoro]

How can get custom profiles if I use SAML SSO and no provisioning?
Under users and groups I have to choose a profile but only a couple of profiles are shown. No custom profiles.

I'd rather have Salesforce manage this because everyone is already setup there.

I believe if you don't use provisioning custom profiles aren't needed. You are only matching objects in Azure AD to Salesforce users. By doing this you need to manage users profiles directly in Salesforce.

[syswpit]

How can get custom profiles if I use SAML SSO and no provisioning?
Under users and groups I have to choose a profile but only a couple of profiles are shown. No custom profiles.
I'd rather have Salesforce manage this because everyone is already setup there.

I believe if you don't use provisioning custom profiles aren't needed. You are only matching objects in Azure AD to Salesforce users. By doing this you need to manage users profiles directly in Salesforce.

Yes, I want to manage user profiles directly in Salesforce. However, I'm forced to select a role (so a Salesforce profile) in Azure AD when using SSO.
How do I get around this?

[fabienturcotte]

Hi, Then, the role you put your users in on the Azure AD side becomes irrelevant. It will only be used to grant access to the application. The Group you create can be associated with Standard User or other - it won't matter, as you don't use JIT or other attributes in the SAML response.Hope this helps, Sent from my Samsung Galaxy smartphone.
-------- Original message --------From: syswpit [e-mail] Date: 2019-07-15 07:48 (GMT-05:00) To: MicrosoftDocs/azure-docs [e-mail] Cc: fabienturcotte [e-mail], Comment [e-mail] Subject: Re: [MicrosoftDocs/azure-docs] Azure Salesforce Provisioning not syncing SF Profiles to AD Roles (#22223)

How can get custom profiles if I use SAML SSO and no provisioning?
Under users and groups I have to choose a profile but only a couple of profiles are shown. No custom profiles.
I'd rather have Salesforce manage this because everyone is already setup there.

I believe if you don't use provisioning custom profiles aren't needed. You are only matching objects in Azure AD to Salesforce users. By doing this you need to manage users profiles directly in Salesforce.

Yes, I want to manage user profiles directly in Salesforce. However, I'm forced to select a role (so a Salesforce profile) in Azure AD when using SSO.
How do I get around this?

—You are receiving this because you commented.Reply to this email directly, view it on GitHub, or mute the thread.
[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/MicrosoftDocs/azure-docs/issues/22223?email_source=notifications\u0026email_token=ALHXNJT6PBRRNIUOO7WKBS3P7RPXFA5CNFSM4GPRNN72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZ5OIQI#issuecomment-511370305",
"url": "https://github.com/MicrosoftDocs/azure-docs/issues/22223?email_source=notifications\u0026email_token=ALHXNJT6PBRRNIUOO7WKBS3P7RPXFA5CNFSM4GPRNN72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZ5OIQI#issuecomment-511370305",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]

[syswpit]

Hi, Then, the role you put your users in on the Azure AD side becomes irrelevant. It will only be used to grant access to the application. The Group you create can be associated with Standard User or other - it won't matter, as you don't use JIT or other attributes in the SAML response.Hope this helps,

Are you saying that if I select Standard User for everyone in AD, the Administrators will still be Administrators in Salesforce?

[jeevansd]

@chetansriv and @v-nagta for visibility.

[stromvirvel]

Are you saying that if I select Standard User for everyone in AD, the Administrators will still be Administrators in Salesforce?

@syswpit I can confirm, that's the case.

[jeevansd]

For this issue please raise the support ticket with Microsoft and they can able to help you. I am closing this thread now.

[jeevansd]

please-close