Salesforce + Microsoft Entra ID Integration — SSO, Provisioning & Secure Access
Salesforce + Microsoft Entra ID Integration is an implementation service that connects Salesforce to Microsoft Entra ID using the Microsoft-documented Salesforce gallery application: SAML 2.0 single sign-on, automated user and group provisioning over SCIM, group-based mapping to Salesforce profiles and permission sets, Conditional Access enforcement where Microsoft Entra ID P1 or P2 licensing is in place, and audit-ready sign-in and provisioning logs. It is intended for organizations that run Salesforce alongside Microsoft 365 and want Salesforce access managed from Entra ID instead of by hand.
What this engagement is
This service integrates Salesforce with Microsoft Entra ID, formerly Azure AD, so user access is managed through Entra ID instead of manual Salesforce administration. IT Partner configures the Microsoft-published Salesforce enterprise application from the Entra ID gallery — a current, Microsoft-documented integration path — to enable SAML 2.0 single sign-on, automated user provisioning and deprovisioning over SCIM, and group-based assignment of Salesforce profiles and permission sets. Where Microsoft Entra ID P1 or P2 licensing is available, Conditional Access policies extend MFA and device-based controls to Salesforce sign-in. Entra ID sign-in and provisioning logs provide the audit trail, and alerting for provisioning or sync failures can be configured through Azure Monitor. The result: new hires receive Salesforce access through group membership, departures lose it automatically, and Salesforce stops being an identity island. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
Success criteria
What you receive
How the work unfolds
Confirm business goals, Salesforce edition and API availability, Microsoft Entra ID licensing, number of users, identity source, domains, current Salesforce login methods, provisioning expectations, compliance requirements, and target cutover approach. Acceptance gate: agreed scope, assumptions, required access, and implementation plan are approved by the client.
Validate administrator access to Microsoft Entra ID and Salesforce, confirm test accounts and pilot groups, review current Salesforce profiles, permission sets, roles, and any existing SSO or provisioning configuration. Acceptance gate: required access is available and a pilot group is identified.
Configure SAML 2.0 authentication for Salesforce through the Entra ID gallery application. Validate sign-in with pilot users, confirm certificate and metadata configuration, and document the rollback approach before production cutover.
Configure automatic user and group synchronization over SCIM where the Salesforce edition provides the required API access. Configure provisioning scope, attribute mappings, matching rules, and deprovisioning behavior, and pilot synchronization before enabling broad production scope.
Map Entra ID groups to Salesforce profiles, permission sets, roles, or permission set groups. Confirm the business-approved mapping before production rollout.
Configure Conditional Access for MFA and device trust where Microsoft Entra ID P1 or P2 licensing is in place. Apply policies first to pilot users or report-only mode, then move to enforcement after client approval.
Configure alerts for provisioning and sync failures via Azure Monitor. Confirm alert recipients, notification channel, severity thresholds, and operational ownership for post-go-live triage. Continuous monitoring is not included by default and is available as an optional extra-cost add-on.
Run agreed test scenarios for SSO, provisioning, updates, deprovisioning, group-based access assignment, Conditional Access behavior, and monitoring alerts. Complete production cutover after client approval and provide handover notes covering configuration, support contacts, and known limitations.
Prerequisites
Who does what
IT Partner
- Lead discovery workshops to confirm requirements, current-state configuration, Salesforce edition and API constraints, Entra ID licensing, and the target operating model.
- Configure the Salesforce enterprise application in Microsoft Entra ID: SAML metadata, certificates, claims, attribute mappings, provisioning scope, and group-based assignment rules within the agreed scope.
- Configure automated user provisioning and deprovisioning, including matching rules and deprovisioning behavior approved by the client.
- Map Entra ID groups to Salesforce profiles, permission sets, and permission set groups per the approved access model.
- Configure Conditional Access policy enforcement for MFA and device compliance or device trust, subject to Microsoft Entra ID P1/P2 licensing.
- Confirm audit trails — Entra ID sign-in and provisioning logs — are available for the client's compliance processes.
- Configure monitoring with alerts for provisioning and sync failures via Azure Monitor.
- Prepare the pilot plan, cutover approach, and rollback considerations for client review; support pilot testing and production rollout, including troubleshooting of authentication, provisioning, and access-mapping issues.
- Provide handover notes and a configuration summary for the completed integration, including key settings and operational considerations.
Your team
- Provide Microsoft Entra ID and Salesforce administrator access, or make authorized administrators available to perform required configuration under IT Partner guidance.
- Confirm Salesforce edition, Microsoft Entra ID licensing, and that required features — API access for provisioning, Conditional Access — are licensed for the in-scope users.
- Identify business and technical stakeholders for Salesforce administration, identity and security, compliance, help desk, and affected business units.
- Provide the list of in-scope users, groups, profiles, permission sets, roles, and any required business rules for user lifecycle automation.
- Approve the Entra ID group-to-Salesforce access mapping, including profile, permission set, and role assignments.
- Supply test accounts and participate in user acceptance testing for SSO, provisioning, deprovisioning, access assignment, Conditional Access behavior, and monitoring notifications.
- Communicate planned sign-in or access changes to affected users and internal support teams.
- Approve production cutover timing, pilot expansion, and any enforcement of Conditional Access policies.
- Own business decisions on access entitlement, compliance interpretation, user lifecycle rules, and Salesforce license assignment policy.
- Maintain client-owned credentials, licenses, subscriptions, and internal approval processes required for the integration.
What's not included
Limitations & technical notes
Frequently asked questions
What is included in the Salesforce + Microsoft Entra ID Integration service?
IT Partner connects Salesforce to Microsoft Entra ID using the Microsoft-published Salesforce gallery application: SAML 2.0 single sign-on, automated user and group provisioning over SCIM where the Salesforce edition supports it, group-based mapping to Salesforce profiles and permission sets, Conditional Access enforcement where Entra ID P1/P2 licensing is in place, audit-ready logs, and sync-failure alerting. 24/7 support, continuous monitoring, and ongoing maintenance are optional paid add-ons.
Is this a supported, Microsoft-documented integration?
Yes. Salesforce is available as a gallery enterprise application in Microsoft Entra ID, and both single sign-on (SAML) and automated user provisioning (SCIM) for Salesforce are Microsoft-documented capabilities. IT Partner implements that standard path rather than custom identity middleware, which keeps the integration supportable as both platforms evolve.
Does the service enable single sign-on for Salesforce?
Yes. IT Partner configures SAML 2.0 single sign-on between Microsoft Entra ID and Salesforce, so users authenticate to Salesforce with their Entra ID identity instead of separate Salesforce credentials. Sign-in is validated with pilot users, and a rollback approach is documented before production cutover.
Does the service automate Salesforce user provisioning and deprovisioning?
Yes. Provisioning is configured so Salesforce users are created, updated, and deactivated from Microsoft Entra ID. New hires receive Salesforce access through group membership, and departures are deprovisioned automatically — reducing manual Salesforce administration and the security risk of orphaned accounts.
What Salesforce edition do we need for automated provisioning?
Automated SCIM provisioning requires a Salesforce edition with the necessary API access; this is confirmed during discovery along with your Entra ID licensing. SAML single sign-on itself has broad Salesforce edition support, so SSO can typically proceed even where provisioning needs an edition or licensing change.
Can Microsoft Entra ID groups control Salesforce roles and permissions?
Yes. IT Partner maps Entra ID groups to Salesforce profiles, permission sets, or permission set groups, so Salesforce access is governed by group membership. Changing a user's access becomes a group-membership change in Entra ID rather than a manual edit in Salesforce.
Can Conditional Access policies be applied to Salesforce?
Yes, where Microsoft Entra ID P1 or P2 licensing is in place. Conditional Access can require MFA, compliant or trusted devices, and other controls at Salesforce sign-in. Policies are rolled out in report-only or pilot mode first, with break-glass accounts and exclusions agreed before enforcement.
How does this integration support compliance and auditing?
Sign-in and provisioning activity is recorded in Microsoft Entra ID logs, giving your compliance team an audit trail of who accessed Salesforce and how accounts were created, changed, and deactivated. The integration supports audit evidence gathering, but certification against any specific framework remains the client's responsibility.
How are provisioning or sync failures detected?
IT Partner configures alerts for provisioning and sync failures via Azure Monitor, with agreed recipients and severity thresholds, so failures surface to your team instead of being discovered through user tickets. Continuous monitoring by IT Partner is not included by default and is available as an optional paid add-on.
How long does the integration take, and how is it priced?
The service is billed hourly at the published rate, with total effort scoped per project. A standard engagement is planned at five days; the final timeline depends on user count, the access model, provisioning complexity, Conditional Access requirements, and approval cycles.
What is not included in this service?
License costs are not included — Microsoft Entra ID, Microsoft 365, and Salesforce licenses are purchased by the client. Also excluded unless separately scoped: identity data cleanup, HRIS integration, identity governance deployment, tenant-wide Conditional Access redesign, and Salesforce security-model remediation beyond the integration scope. 24/7 support, continuous monitoring, and ongoing maintenance are optional paid add-ons.
What happens after the integration is completed?
Salesforce authentication, provisioning, access assignment, Conditional Access policies where licensed, and sync-failure alerts operate through the configured Microsoft Entra ID integration, and you receive handover notes and a configuration summary. Ongoing monitoring, maintenance, and 24/7 support are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.