we've just installed Salesforce Identity Connect so that our users can connect to Salesforce using their Microsoft AD credentials.

In the future, we are going to have 2 types of users :

  • type 1 users, Salesforce platform users (with the "Salesforce Platform" license and a custom profile)
  • type 2 users, standalone Identity users, who are going to use the platform solely for Identity Connect purposes (for instance, using their AD credentials to log in to Gmail) with the "Identity" license and the standard profile "Identity User".

To make things simple, we have 2 AD groups :

  • SF_USERS containing type 1 users
  • IDENTITY_USERS containing type 2 users

Put a user in the IDENTITY_USERS group, and it will be created with the proper license (Identity). Same with SF_USERS. Everything works perfectly.

But our issue is the following : put a user in the SF_USERS, wait for the user to create in Salesforce, and some other day, put it into the IDENTITY_USERS group. Salesforce won't change it's license type from "Salesforce Platform" to Identity.

We got the following error : "User's Profile can't be set to 'Identity User' because it's derived from a license that doesn't require the following permission(s): ChatterInternalUser. Select a different profile.".

This is a pretty classic business need. Some users may need to work in Salesforce today. But in the future, they may change position in the company, and won't need Salesforce anymore, BUT they will still need to use the Identity functionalities.

Questions are :

  • is it considered a license downgrade by Salesforce ?
  • is it a bug ?
  • how can we achieve this simple need ?

Thanks for reading

  • More info : I've been into the classic UI, clicked Edit on one of the users, and the Licence picklist contained only "Salesforce" and "Salesforce Platform". I then hacked into the HTML code to add the "Identity" value in the Licence picklist. When I tried to validate, I got the same error message, but in the classic UI. So to me, this is a Salesforce issue, and not related to the Salesforce Identity Connect product itself. Feb 28, 2019 at 17:20

1 Answer 1


So for all of you interested, here is Salesforce's support answer :

As per the case description I understand that you are trying to change a license of a user from a Salesforce Platform user license to Identity license.

This kind of change is not possible for a User, as it would be complex/conflicting for their history of record access.

So as a workaround:

  1. Edit the user's username and append ".old" (or similar convention to prevent username duplication).

  2. Deactivate the user.

  3. Create a new user with the new license type needed.

    • In Identity Connect, you should be able to sync to a new user but might need to adjust the Attribute Mapping as appropriate to ignore the deactivated old user.

TL;DR : not possible to do that.

That really is a shame, and it is a really poor workaround.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .