Assigning profiles and permission sets during SSO
How to keep profiles, roles and permission sets in step with the identity provider at SSO login: a minimum-access profile plus permission set groups, what standard JIT can and can't set, the Custom SAML JIT handler's createUser and updateUser contract, expiring assignments, SCIM entitlements, and validating ID token claims before granting access.
Given a scenario, determine how to best assign roles, profiles, and permission sets to a user during the SSO process, how to keep these assignments up to date.
~6 min read · 11 practice questions ·
What the exam expects
- Design access for SSO users as a minimum-access profile plus permission sets or permission set groups, so the identity provider's groups map to reusable building blocks.
- Say what standard JIT sets (profile, role,
User.fields) and what it can't (permission set assignments), and why manual profile edits are overwritten. - Configure a Custom SAML JIT handler: Execute Handler As, when createUser and updateUser run, the attributes map, encrypted assertions, several identity providers and Experience Cloud users.
- Keep assignments current with updateUser, assignment expiration dates or SCIM entitlements, and validate ID token claims before a registration handler trusts them.
Key terms: standard JIT (Salesforce maps User. attributes onto the user at each SSO login); Custom SAML JIT with Apex handler (a class implementing Auth.SamlJitHandler does all provisioning); permission set group (bundle of permission sets for one persona); ExpirationDate (date a single assignment lapses); SCIM entitlement (profile or permission set exposed to a SCIM client).
Key facts
- Detail
- Minimum Access - Salesforce, or a clone
- Detail
- Every User field uses the
User.prefix
- Detail
- Email, LastName, ProfileId, Username (insert only)
- Detail
- Fields in the assertion are updated
- Detail
- Standard JIT only
- Detail
- User with Manage Users
- Detail
- Repeat SAML login or Existing User Linking URL
- Detail
- Decrypted copy under
Sfdc.SamlAssertionin attributes
- Detail
- Per assignment, creatable and updatable
- Detail
- Exposed as entitlements; all editions
- Detail
- Stored, not validated; use Auth.JWTUtil
Sources for this section (8)
- Permission Set Guidelineshelp.salesforce.com (opens in a new tab)
- JIT Assertion Fieldshelp.salesforce.com (opens in a new tab)
- Understanding JIT Provisioninghelp.salesforce.com (opens in a new tab)
- Enable JIT Provisioninghelp.salesforce.com (opens in a new tab)
- SamlJitHandler Interfacedeveloper.salesforce.com (opens in a new tab)
- PermissionSetAssignmentdeveloper.salesforce.com (opens in a new tab)
- SCIM Reference Sheethelp.salesforce.com (opens in a new tab)
- RegistrationHandler Interfacedeveloper.salesforce.com (opens in a new tab)
- Why did a manually changed profile revert after the user's next SSO login?
- When does Salesforce call updateUser?
- Why does a handler reading `department` get nothing when the IdP sends `Department`?
- Which option keeps permission sets in sync from the IdP in Professional Edition?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams