Our team is trying Salesforce and we have a sandbox and a production Salesforce.
To use SSO (Okta) are we able to use same SSO login to both environments? Because email address to my knowledge has to be unique across environments. Or can we only use say our email attribute in one or the other (Sandbox or Production)? My understanding is Sandbox only allows you an email login that is unique across both environments. And if that’s the case, what’s the usual workaround ? Don’t want to reinvent the wheel.

2 Answers 2


If you are using the federation id for your SAML assertion, you can use the same value in the sandbox that you would be using in production in this field on the User record in Salesforce.

If you are using the Username in Salesforce for the SAML assertion, that field itself is a unique field value and can't contain a duplicate value in another sandbox or another production instance.

Your SSO configuration will dictate whether the SSO flow is sent to a My Domain associated with a sandbox vs a production org. Both of the SSO configurations could be set up to use the Federation Id field on the User to identify the appropriate user and log them in.

  • Your answer is not technically correct. You may have the same user name in one production org and one sandbox. You may not have the same user name in two different production orgs or two different sandboxes.
    – sfdcfox
    Commented Nov 13, 2018 at 2:04

At the risk of repeating myself, the user name is allowed once per login domain. Trailhead, Production/Developer, Trials, etc all exist in one login domain, while Sandbox orgs reside in a separate login domain. Federation ID values, which is used to log in with SSO, must be unique per each organization. This means you can have the same Federation ID in all your Sandboxes and Production Orgs.

You can also have the same unique user name in one Sandbox and one Production Org. So, as long as you're only doing this for one of each, SSO can be pretty easily setup with identical configuration for both orgs. If you need more sandboxes, then the user name will need to be unique across all Sandboxes. This is why the default refresh process for Sandboxes add the ".sbname" at the end of the user names, so that this won't be an issue.

  • Thanks so we can use [email protected] to login to both the Production Salesforce as well as the MY sandbox Salesforce, but the sandbox target/mapped account needs to be slightly different than the production one? Like with an appended domain name? And sorry I’m blindly asking here ironically I don’t even have my access setup yet to test in either system. Commented Nov 13, 2018 at 5:02
  • @BeKindPlzRewind No, it can be exactly the same. The only difference from the SSO configuration standpoint is that there will be different endpoint URLs to connect to. The entire configuration only takes a few minutes, and you don't need to do any custom mapping in most cases.
    – sfdcfox
    Commented Nov 13, 2018 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .