We have a connected app that we will be selling to customers in the form of a managed package.

Once the customers have purchased the managed package, it will be installed into their org. They will then be able to assign our app's permission set to users who they want to have access to our app.

We maintain user records in our own database, and we need to provision users in this database. Is there any way to set up a HTTP callback that gets called when a permission set is assigned to or unassigned from a SFDC user?

If not, what's the best way to handle this? We have a permissions model that references objects not in SFDC, and these permissions must be configured from within our app, so waiting until a user logs in to provision their account isn't really feasible.

2 Answers 2


No, you can't run triggers on the PermissionSetAssignment object. Instead, you're going to have to rely on JIT provisioning, or require that the administrator makes some sort of edit to the user record itself, perhaps a custom field (checkbox) that would fire a trigger that would eventually notify your service (e.g. future method). Alternatively, you might run a scheduler that synchronizes the systems periodically, perhaps once an hour. This should be acceptable for most medium-sized organizations, although the largest orgs (15k+ users) might have a problem with such a small synchronization window.


It looks like it's possible via User Provisioning for Connected Apps: https://developer.salesforce.com/events/webinars/user_provisioning_for_connected_apps

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .