When new users are provisioned in SFDC from the standard UI, there is a checkbox for "Generate new password and notify user immediately". This sends an email to the new user with all his/her info. When using Federated (SAML) SSO, we don't want to do this. What is the best practice for notifying the new user in this case? Specifically, how can we let the new user know what the SSO URL is? I can create a workflow to send an email when a new user is added, but is there a better way?

Regards, Hamayoun

1 Answer 1


Best practice is to

  1. Turn on My Domain This creates a user-friendly URL which is the same for all users in the org: https://<mydomain>.my.salesforce.com . One of the advantages of MyDomain is that you can turn off non-SSO logins which leads to
  2. Turn off 'native' SFDC login (aka Login Page authentication service) under Login Page Settings in My Domain. When your users go to https://<mydomain>.my.salesforce.com , they'll be redirected to your SAML identity provider.

Note that anyone can still login with their SFDC username/password from https://login.salesforce.com but they no longer see the login page by default. Turning off login.salesforce.com is also possible via MyDomain.

As far as how to notify the user, workflow-triggered email is a good way to go. The User object is usually not a good trigger point. To be productive in SF you typically need more than just a user account but perhaps your org is simple enough so you can trigger from User.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .