I'm trying to reconcile the following recommendation with the fact that there currently seems to be no way to selectively configure SAML SSO by Profile:

We don’t recommend enabling SSO for Salesforce admins, in case there’s an outage or other problem with your org’s SSO implementation. Instead, we recommend that admins log in directly to Salesforce using multi-factor authentication (MFA). (source)

While there is a "Is Single Sign-On Enabled" setting for User profiles, this apparently relates to delegated authentication, not SAML SSO.

I'm aware that it's possible to use a URL parameter to enable password login, even when password login is disabled in MyDomain. I'm glad this option exists, but it seems to undermine what Salesforce's upcoming MFA requirement seeks to accomplish.

Researching this topic is a bit of a challenge because there's often not a clear distinction made between SAML SSO, delegated authentication, and SSO with Salesforce's MFA. The only reference I've found that implies SAML SSO can be selectively enforced simply notes the following:

To turn it off for a portion of users is fairly challenging. (source)

I'd like to confirm that there is currently no way to selectively enforce SAML SSO at the profile or user level.

  • 1
    The fairly challenging comment is old (2014), we've deleted it. The linked answer contains enough info to implement, read the Q&A + comments.
    – identigral
    Jan 12 at 23:21
  • No, I read that one. The first answer pertains to all users. The second answer pertains to delegated authentication, which is not the same as SAML SSO. Thank you for suggesting it though. Jan 13 at 2:27
  • Is Single Sign-On User Enabled requires (forces) SSO on a per-profile basis.
    – identigral
    Jan 13 at 2:32
  • Is this also the case for SAML SSO using an IDP? The answer author says that it refers to delegated authentication. This post on delegated authentication makes it clear they are very different: salesforce.stackexchange.com/questions/306018/…. Jan 13 at 2:40
  • I'd also note that when Salesforce looked at my configuration, they were only interested in mydomain -> authentication, which is all or none. If the SFDC login form is disabled in MyDomain, a "single sign-on enabled" setting confers no added granularity/selectivity. I think I may be able to test this in my sandbox to get more clarity. Jan 13 at 2:51

I was able to test how SSO and Delegated Authentication settings interact in a Sandbox for SAML SSO. The following is what I learned:

If "Disable login with Salesforce credentials" is selected in Settings -> Single Sign-on Settings and the "Is Single Sign-on Enabled" permission is selected (Settings -> Users -> Profiles -> System Permissions) for a Profile, the Salesforce login form login is disabled as follows:

  • Appending "?login" or "?login=true" to the Salesforce instance URL will still make Salesforce's password login form visible.
  • Password logins will fail with the standard "Please check your username and password. If you still can't log in..." error message.

Consequently, managing SAML SSO permissions by User Profile or Permission Set requires the following steps:

  1. Deselect "Login Form" in Settings -> MyDomain -> Authentication Configuration.

  2. Select "Disable login with Salesforce credentials" in Settings -> Single Sign-On Settings.

  3. Enable/check "Is Single Sign-On Enabled" in Settings -> Users -> Profiles - System Permissions (System Administrator Profiles should not have this permission selected).

Not the answer you're looking for? Browse other questions tagged or ask your own question.