EBS Analysis: Configure Salesforce for Single sign-on in Microsoft Entra ID – Microsoft Entra ID

Configuring Salesforce Single Sign-On with Microsoft Entra ID

In modern enterprises, the proliferation of cloud applications has created a complex identity landscape. Users juggle multiple credentials, while IT teams struggle to enforce consistent security policies across disparate systems. Salesforce, as a cornerstone customer relationship management platform, is often accessed by thousands of employees, partners, and contractors. Integrating Salesforce with Microsoft Entra ID offers a strategic solution: it centralizes identity, enables single sign‑on (SSO), and leverages the robust conditional access and multi‑factor authentication (MFA) capabilities of the Microsoft identity platform. This article provides a detailed, consulting‑grade overview of how to configure SSO between Salesforce and Entra ID, the underlying architecture, security considerations, operational implications, and practical steps for successful deployment.

Architecture and Capabilities

The integration relies on the SAML 2.0 protocol, with Entra ID acting as the identity provider (IdP) and Salesforce as the service provider (SP). Salesforce supports SP‑initiated SSO, meaning the user begins the login flow at the Salesforce application, which then redirects to Entra ID for authentication. Entra ID can also be configured to support automated user provisioning via the System for Cross‑domain Identity Management (SCIM) protocol, as well as just‑in‑time (JIT) provisioning for ad‑hoc user creation.

Key capabilities include:

• Centralized access control: Administrators define who can access Salesforce directly from the Entra ID portal, assigning roles and groups.
• Seamless SSO: Users authenticate once with their Entra ID credentials and are automatically signed in to Salesforce without additional prompts.
• Automated provisioning: User accounts can be created, updated, and deactivated in Salesforce based on changes in the source system (e.g., HRIS) via SCIM.
• JIT provisioning: If a user does not exist in Salesforce, a new record is created on first login, reducing manual effort.
• Advanced claims: Starting June 2026, Entra ID includes Authentication Method References (amr) and Authentication Context References (acr) in SAML and OpenID Connect tokens, providing insight into how a user authenticated.
• Phishing‑resistant MFA: Conditional Access policies can enforce phishing‑ resistant authentication methods for privileged accounts, such as FIDO2 security keys.

How the Technology Works

The SSO flow begins when a user attempts to access Salesforce. If the organization has configured SSO, the user is redirected to the Entra ID authentication endpoint. Entra ID validates the user’s credentials, applies any Conditional Access policies (e.g., requiring MFA or compliant device), and then issues a SAML assertion. This assertion contains attributes such as the user’s email, name, and, optionally, custom claims that Salesforce expects for JIT provisioning.

Salesforce receives the SAML assertion, verifies its signature using the federation metadata previously exchanged, and maps the incoming identity to a local user record. If the user does not exist and JIT is enabled, Salesforce creates a new user with the provided attributes. The session is then established, and the user is presented with the Salesforce home page.

The exchange of federation metadata is a critical step. Entra ID provides an XML document that Salesforce uses to validate tokens and determine the signing algorithm. Conversely, Salesforce can provide its own metadata to Entra ID, though for SP‑initiated SSO the primary direction is from Entra ID to Salesforce.

Implementation Considerations

Before initiating the configuration, ensure the following prerequisites are met:

1. A Microsoft Entra tenant with an active subscription and at least one user account possessing a Cloud Application Administrator role.
2. A Salesforce organization with Single Sign‑On settings enabled. This may require contacting Salesforce support for certain editions.
3. Network connectivity between the organization’s users and the Entra ID endpoints, as well as between Salesforce and the Entra ID federation endpoint.

The configuration process can be divided into four phases:

1. Add Salesforce to Entra ID

Using the Microsoft Entra admin center, navigate to Enterprise applications and select New application. Choose Add from gallery, search for Salesforce, and add the pre‑configured application. This creates an enterprise application object that will hold the SSO settings.

2. Configure SAML SSO

Open the newly created Salesforce enterprise application, select Single sign‑on, and choose SAML. In the Basic SAML Configuration section, enter the following values (replace placeholders with your actual Salesforce domain):

• Identifier: (or for a developer edition).
• Reply URL: Same as the identifier.
• Sign‑on URL: Same as the identifier.

These URLs must match the values configured in Salesforce. After entering them, download the Federation Metadata XML file from the SAML Signing Certificate section; this file will be uploaded to Salesforce.

3. Configure Salesforce

Log in to the Salesforce Setup menu, navigate to Identity → Single Sign‑On Settings, and enable SAML Enabled. Create a new SAML configuration by uploading the downloaded metadata XML. Salesforce will automatically populate the issuer, entity ID, and other fields based on the metadata.

For JIT provisioning, ensure the User Provisioning Enabled checkbox is selected and set the SAML Identity Type to Assertion contains the Federation ID. If you prefer to use the Salesforce username, deselect the provisioning box and choose the corresponding identity type. When JIT is active, you must include the required SAML attributes (e.g., nameID, email, firstName, lastName) in the token attributes configuration within Entra ID.

4. Configure My Domain and Authentication Service

In Salesforce, go to Company Settings → My Domain. Under Authentication Configuration, select the SAML SSO configuration you created and ensure that both Login Page and AzureSSO are checked as authentication services. This directs users to the Entra ID login page when they click the Salesforce tile in the My Apps portal or when they navigate directly to the Salesforce sign‑on URL.

Security and Governance

The primary security benefit of integrating Salesforce with Entra ID is the ability to enforce enterprise‑grade authentication policies. By leveraging Conditional Access, administrators can require MFA, compliant devices, or location‑based restrictions for all Salesforce sign‑ins. For privileged accounts, such as system administrators, it is advisable to enforce phishing‑resistant MFA (e.g., FIDO2) to meet the highest security standards.

Entra ID also supports the forwarding of amr and acr claims to Salesforce, providing an audit trail of the authentication methods used. This is particularly useful for compliance reporting and for detecting anomalous sign‑in patterns. If your organization uses an external MFA provider, Entra ID can forward the AMR signals to Salesforce, ensuring a consistent authentication context across the ecosystem.

After validating the SSO configuration, disable local credential access for Salesforce. This ensures that all sign‑ins are routed through Entra ID, where Conditional Access, MFA, and other security controls are applied. Disabling local credentials also simplifies password management and reduces the risk of credential‑based attacks.

For organizations that have adopted Microsoft Defender for Cloud Apps, integrating Salesforce provides additional visibility. Defender can collect sign‑in events, trigger alerts for suspicious activity, and enforce session controls to prevent data exfiltration in real time.

Operational Implications

Operating an SSO integration requires ongoing attention to provisioning, deprovisioning, and account lifecycle management. Entra ID can automate user provisioning to Salesforce using SCIM, which synchronizes user attributes and group memberships. This reduces manual effort and ensures that when an employee leaves the organization, their Salesforce access is promptly revoked.

The account discovery feature allows administrators to generate a report of existing Salesforce users, identify which have matching Entra ID accounts, and detect users that are local to Salesforce only. This report is valuable for onboarding, as it helps align the identity landscape and prevents orphaned accounts.

Monitoring is another critical operational aspect. Entra ID provides sign‑in logs that can be analyzed for failed authentication attempts, unusual locations, or policy violations. These logs, combined with Defender for Cloud Apps, enable proactive detection of potential security incidents.

Common Pitfalls

Several issues frequently arise during the configuration of SSO between Salesforce and Entra ID:

• Incorrect URLs: Mismatched identifier, reply URL, or sign‑on URL between Entra ID and Salesforce will cause authentication failures. Verify that the values entered in both systems are identical.
• Missing SAML attributes: JIT provisioning requires specific attributes such as nameID, email, firstName, and lastName. Omitting these will result in user creation errors.
• Metadata mismatch: Uploading an outdated or incorrect federation metadata XML can lead to signature validation failures. Always download the metadata from Entra ID after configuring the SAML settings.
• Mobile app configuration: The Salesforce mobile app must be configured to use the custom domain and the SAML SSO endpoint. Failure to enable the custom domain in the app will prevent SSO from functioning on mobile devices.
• Over‑reliance on JIT: While JIT simplifies onboarding, it does not enforce role‑based access control. Complement JIT with automated provisioning to assign appropriate permissions.

Why this matters to enterprise IT

For enterprise IT leaders, the integration of Salesforce with Entra ID is more than a technical convenience; it is a strategic imperative. Centralizing identity reduces the attack surface by eliminating multiple sets of credentials, thereby lowering the risk of credential stuffing and password fatigue. It also simplifies compliance with regulations such as GDPR, HIPAA, and SOX, as access can be governed by consistent policies and audited through a single identity platform.

Moreover, SSO accelerates user productivity by removing friction from the login process. Employees can access Salesforce with a single click from the My Apps portal, reducing help‑desk tickets related to password resets. Automated provisioning ensures that new hires are granted appropriate access immediately, while deprovisioning prevents lingering access after departure.

From a governance perspective, Entra ID provides a unified view of who has access to which SaaS applications, enabling IT to enforce least‑privilege principles and respond swiftly to access‑related incidents.

EBS consulting perspective

At Escape Business Solutions, we view SSO integration as a cornerstone of a modern identity strategy. Our consultants begin by conducting a comprehensive identity assessment, mapping existing user populations, authentication methods, and compliance requirements. We then design a phased rollout that aligns with the organization’s risk appetite and operational constraints.

Our approach emphasizes the following pillars:

• Identity governance: Establishing clear policies for role‑based access, just‑in‑time elevation, and periodic access reviews.
• Security hardening: Implementing Conditional Access policies that enforce MFA, device compliance, and location‑based restrictions, with a focus on phishing‑resistant methods for privileged accounts.
• Lifecycle management: Integrating with HR systems to automate provisioning and deprovisioning, ensuring that access follows the employee lifecycle.
• Monitoring and response: Leveraging Entra ID logs and Defender for Cloud Apps to create a detection and response framework for identity‑related threats.

By partnering with EBS, organizations can accelerate their digital transformation, reduce identity‑related risk, and achieve a measurable improvement in operational efficiency.

Practical next steps

1. Inventory current Salesforce usage: Identify all user accounts, profiles, and permission sets that require access.
2. Define pilot group: Select a small, cross‑functional team to test SSO and validate configuration.
3. Configure Entra ID: Add the Salesforce enterprise application, set up SAML SSO, and download the federation metadata.
4. Configure Salesforce: Upload the metadata, enable SAML, configure JIT or SCIM provisioning, and set up My Domain.
5. Test SSO: Use the test user account to verify the end‑to‑end flow, including mobile app access.
6. Gather feedback: Collect user experience insights and adjust token attributes or Conditional Access policies as needed.
7. Roll out organization‑wide: Expand the pilot, disable local credentials, and enforce security policies.
8. Establish monitoring: Enable sign‑in logging, integrate with Defender for Cloud Apps, and define alert thresholds.

Following these steps will provide a resilient, secure, and user‑friendly Salesforce access experience that aligns with enterprise identity goals.

For organizations seeking to implement or optimize their Salesforce‑Entra ID integration, Escape Business Solutions offers end‑to‑end consulting services, from architecture design to operational support. Our team of certified identity specialists can guide you through each phase, ensuring that your investment delivers both security and business value. Reach out to discuss how we can partner with you to achieve a seamless, secure, and future‑proof identity ecosystem.

EBS Consulting Advice

If your organization is evaluating Configure Salesforce for Single sign-on in Microsoft Entra ID – Microsoft Entra ID, do not treat the technology decision in isolation. Start with the business outcome, current architecture, security and identity controls, operational constraints, migration dependencies and governance requirements. A practical assessment should identify the current-state gaps, prioritize the risks and define an implementation roadmap with measurable outcomes.

EBS can help assess the environment, develop the architecture and modernization roadmap, and translate the technical options into an actionable business plan. Relevant EBS services: Microsoft Azure consulting Escape Cloud Microsoft Solution Assessments.

Have a technology challenge? Email info@escapebusinesssolutions.com to describe your situation. We welcome questions, consulting discussions and requests for a proposal.