Accounts in applications
Entra ID to Salesforce integration: Salesforce users from Microsoft Entra ID, with profile and permissions
With an integration between Microsoft Entra ID and Salesforce, every colleague in the right Entra group automatically gets a Salesforce user with profile, permission sets, role and manager, and that user is deactivated as soon as the Entra ID account is disabled. KoppelHet derives profile and permission sets from the groups, freezes a user when deactivation gets stuck in Salesforce and sets language and time zone right per country.
What the integration does
Anyone who manages all accounts in Entra ID and signs in to Salesforce with single sign-on often still sets profile, permission sets and per-country settings for each user by hand.
- IT adds a colleague to the Entra group that matches their team in Salesforce, for example inside sales Germany.
- KoppelHet picks up the change and derives the profile, permission sets and role from the groups.
- The Salesforce user is created with the language, locale and time zone of the colleague's country, and with the manager from Entra ID.
- The colleague signs in through single sign-on; Salesforce recognises them through the link with their Entra account.
- When IT disables the account or the group membership ends, the user is deactivated, or frozen first if Salesforce still refuses deactivation.
What to watch for with Microsoft Entra ID and Salesforce
- The Entra ID sign-in name is the obvious choice for the Salesforce username. That username must be unique across all Salesforce environments in the world, including other companies' ones. If the address already exists in another environment, such as an old trial org, creation fails; KoppelHet then uses an agreed variant and runs single sign-on through a separate field.
- A Salesforce user has one profile, while a colleague in Entra ID can be in several groups. KoppelHet derives the profile from groups with a fixed priority and adds the rest as permission sets, so a colleague in two teams still has one profile.
- Salesforce requires a language, locale and time zone per user. KoppelHet fills them from the user's country in Entra ID, in the format Salesforce expects, so a colleague in London sees dates and amounts the British way.
- KoppelHet signs in to Salesforce with a connected app and a separate integration user, independent of a personal admin account. A new administrator password therefore does not stop the integration.
- A changed email address must first be approved in Salesforce before it takes effect. KoppelHet keeps the username the same and reports the address change once, so the administrator knows what is pending.
- The manager in Entra ID does not always have a Salesforce licence. Salesforce can only point to an existing user as manager. KoppelHet walks up the Entra ID manager chain to someone who is in Salesforce.
- A disabled Entra account does not mean Salesforce can deactivate the user straight away: if they are still a default owner or in an approval step, Salesforce refuses. KoppelHet then freezes the user immediately, so access is closed anyway.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does single sign-on through Microsoft keep working?
Yes. Single sign-on and provisioning are separate. KoppelHet fills the field Salesforce uses for single sign-on, so sign-in through Entra ID stays as it is.
Why Entra ID as the source and not the HR system?
If IT already keeps accounts and groups accurate in Entra ID, that is the shortest route. If job and department are only right in the HR system, that can be the source; see for example AFAS or Workday to Salesforce.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Entra ID is read through Microsoft Graph with a delta query on users and group membership, using an app registration with read-only permissions (User.Read.All, GroupMember.Read.All).
- Salesforce is written through the REST API on the User object with a connected app (OAuth 2.0) and an integration user with Manage Users. FederationIdentifier (at most 512 characters) holds the value Entra ID sends in the SAML assertion. Extra permissions through PermissionSetAssignment; on departure IsActive = false, or UserLogin.IsFrozen = true when deactivation is refused.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Salesforce | Notes |
|---|---|---|
userPrincipalName | Username en FederationIdentifier | |
givenName | FirstName | |
surname | LastName | |
mail | Email | |
mailNickname (ingekort) | Alias | At most 8 characters |
employeeId | EmployeeNumber | |
jobTitle en department | Title en Department | |
Groepslidmaatschap | ProfileId, permission sets en UserRoleId | One profile through a fixed priority order, permission sets per group |
usageLocation en preferredLanguage | LocaleSidKey, LanguageLocaleKey en TimeZoneSidKey | |
manager | ManagerId | |
accountEnabled | IsActive |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID