I have a question about multiple connected Salesforce orgs via SSO. Is there a way to change the profile access for a user between multiple connected orgs through SSO? I have a scenario where Org1 is the identity provider and connected with Org2 as the Service Provider.

I have a user who is the Admin or Org1, but needs to be setup with Read Only access in Org2. Is there a way to modify his profile to be able to have the view from his Admin role in Org1 to a Read Only view in Org2?

  • Can you describe what you mean by "modify his profile"? Are you asking if it is possible for the user to have two different profiles in each of the orgs that they have access to? – Mark Pond May 19 '15 at 14:52
  • Yes Mark, I need to limit the access by giving them a different profile in Org 2 vs the access they have in Org 1. – CRMconsultant May 19 '15 at 14:57

The User record in each org for each user is independent and has a Profile defined on it directly.

If you have a user who is known in the IdP store as: joe.user@contoso.local, the configuration of the two orgs' User records for Joe might be configured like this:

Org 1 - Sales

Org: Acme Sales
Profile: System Administrator
Username: joe@example.sales
FederationId: joe.user@contoso.local

Org 2 - Service

Org: Acme Service
Profile: Helpdesk Supervisor
Username: joe@example.service
FederationId: joe.user@contoso.local

The one consideration which you'll need to address comes into play with the just-in-time provisioning of users into an org if they don't exist there yet. The just-in-time provisioning SAML response will typically include the Profile which the user should have when they're created.

In the example above, if the SAML response for just-in-time provisioning indicated that Joe should be a System Administrator, and that was sent to the Service org - Joe's user record will be updated and his profile will/can be modified from Helpdesk Supervisor to System Administrator.


We have two distinct AD groups, that map to two separate custom domains:

For example:

SalesforceOrg1ProdSAdmin --> oursite1.my.salesforce.com

SalesforceOrg2ProdROnly --> oursite2.my.salesforce.com

When the user connects to the appropriate URL, it redirects using the appropriate AD settings.

  • Thanks Homer but HOW did you set them up? I have the two different domains, but the user only has a profile setup on 1st domain? How does their profile change once they're enabled? – CRMconsultant May 19 '15 at 14:59
  • So, for your SSO settings, when you log into the URL in 'org1' how does your environment capture the appropriate AD settings and configure the login? In our case, we have an F5 implementation that identifies the combination of the URL with the AD group. I can get more detail about OUR side if it helps, but I'd need more info about your current configuration to fill in gaps. – HomerJ May 19 '15 at 15:12
  • Right now, these are just captured in two dev orgs before we do an integration on the client side (want to practice it before setting up). I used this resource: link – CRMconsultant May 19 '15 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.