# Assigning profiles and permission sets during SSO

*Platform Identity and Access Management Architect Study Guide · Access Management Best Practices · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/access-management-best-practices/assigning-profiles-and-permission-sets-during-sso*

How to keep profiles, roles and permission sets in step with the identity provider at SSO login: a minimum-access profile plus permission set groups, what standard JIT can and can't set, the Custom SAML JIT handler's createUser and updateUser contract, expiring assignments, SCIM entitlements, and validating ID token claims before granting access.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Access Management Best Practices
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, determine how to best assign roles, profiles, and permission sets to a user during the SSO process, how to keep these assignments up to date.

## What the exam expects

- Design access for SSO users as a minimum-access profile plus permission sets or permission set groups, so the identity provider's groups map to reusable building blocks.
- Say what standard JIT sets (profile, role, `User.` fields) and what it can't (permission set assignments), and why manual profile edits are overwritten.
- Configure a Custom SAML JIT handler: Execute Handler As, when createUser and updateUser run, the attributes map, encrypted assertions, several identity providers and Experience Cloud users.
- Keep assignments current with updateUser, assignment expiration dates or SCIM entitlements, and validate ID token claims before a registration handler trusts them.

Key terms: **standard JIT** (Salesforce maps `User.` attributes onto the user at each SSO login); **Custom SAML JIT with Apex handler** (a class implementing `Auth.SamlJitHandler` does all provisioning); **permission set group** (bundle of permission sets for one persona); **ExpirationDate** (date a single assignment lapses); **SCIM entitlement** (profile or permission set exposed to a SCIM client).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Recommended base profile | Minimum Access - Salesforce, or a clone | [Permission Set Guidelines](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5) |
| Standard JIT attribute names | Every User field uses the `User.` prefix | [JIT Assertion Fields](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&language=en_US&type=5) |
| Standard JIT required fields | Email, LastName, ProfileId, Username (insert only) | [JIT Assertion Fields](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&language=en_US&type=5) |
| Existing user at standard JIT login | Fields in the assertion are updated | [Understanding JIT Provisioning](https://help.salesforce.com/s/articleView?id=000385744&language=en_US&type=1) |
| Professional Edition | Standard JIT only | [Enable JIT Provisioning](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5) |
| Execute Handler As | User with Manage Users | [Enable JIT Provisioning](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5) |
| updateUser triggers | Repeat SAML login or Existing User Linking URL | [SamlJitHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_SamlJitHandler.htm) |
| Encrypted assertion | Decrypted copy under `Sfdc.SamlAssertion` in attributes | [SamlJitHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_SamlJitHandler.htm) |
| ExpirationDate | Per assignment, creatable and updatable | [PermissionSetAssignment](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_permissionsetassignment.htm) |
| SCIM permission sets | Exposed as entitlements; all editions | [SCIM Reference Sheet](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&language=en_US&type=5) |
| ID token in registration handlers | Stored, not validated; use Auth.JWTUtil | [RegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm) |

## Check yourself

- Why did a manually changed profile revert after the user's next SSO login?
- When does Salesforce call updateUser?
- Why does a handler reading `department` get nothing when the IdP sends `Department`?
- Which option keeps permission sets in sync from the IdP in Professional Edition?

## Sources

- [SamlJitHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_SamlJitHandler.htm)
- [Enable Just-in-Time Provisioning](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_enable_jit.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Salesforce](https://help.salesforce.com/s/articleView?id=sf.sso_jit_requirements.htm&language=en_US&type=5)
- [Understanding Just-in-Time (JIT) Provisioning for SAML Single Sign-On (SSO)](https://help.salesforce.com/s/articleView?id=000385744&language=en_US&type=1)
- [Guidelines for Creating Permission Sets and Permission Set Groups](https://help.salesforce.com/s/articleView?id=platform.perm_sets_best_practices.htm&type=5)
- [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&type=5)
- [PermissionSetAssignment](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_permissionsetassignment.htm)
- [SCIM and REST API Reference Sheet](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_rest_api.htm&language=en_US&type=5)
- [RegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm)
- [Create an Authentication Provider Registration Handler](https://help.salesforce.com/s/articleView?id=xcloud.sso_create_registration_handler.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams