Hi,

I'm looking for advise on how to use Salesforce's Identity Connect product, and whether it is even a useful product when a large portion of your company does not use Salesforce. Details as follows, any help appreciated!

Business Requirements

When our Salesforce users leave the company, and IT disable their AD login, their Salesforce login is also automatically deactivated.

On paper, Identity Connect seems the perfect solution to this requirement.

Problem

We have 190 Salesforce users in our company, but around 800 employees in total. Therefore if we setup Identity Connect to look at our whole Active Directory, we’d need to add over 600 users to the Ignore list, which results in a lot of manual admin overhead as non-Salesforce users join and leave the company, and if a person on the Ignore list is given a Salesforce login manually then Identity Connect won’t do the automatic deactivation of their licence.

Solution attempted

Initially I tried setting Identity Connect up filtered on one particular AD group – the idea being we could have a “Salesforce Users” AD group containing the 190 users, and when they are removed from the AD group or deactivated in AD they lose their Salesforce login. On testing this, deactivating users in the AD group did successfully disable the users in Salesforce as expected, however removing them from the AD group did not do this. Instead the link was cut between AD and Salesforce for that user, without the user being deactivated in Salesforce. This means if someone leaves the company and IT remove them from “Salesforce Users” before deactivating them, then their Salesforce login will remain active and it will probably be a while before anyone realises. Also if someone is added to the “Salesforce Users” group accidentally and then later removed, a Salesforce login they don’t need would be created for them and would just remain active, again it would probably be a while before anyone noticed. I raised this issue with Salesforce Support and I was told there was no workaround for the problem.

Solution attempted

I then had the idea that if we gave everyone without a Salesforce login in the company a Chatter Free login, and purchased Identity Connect licences for the whole company, we could work around the problem. As we could using Profile mappings to map AD groups to paid-for Profiles, and default everyone else to a Chatter Free Profile. This would mean Identity Connect is aware of everyone in the company, so if someone got moved out of AD group mapped to a paid-for Profile, they would just move to a free licence, and when they were deactivated in AD, Identity Connect would still be aware of the user and so would still disable their login. However it turns out you cannot move users between paid-for and free Profiles, a new login needs to be created to do this. Again I was told by Salesforce Support that there is no workaround for this problem.

Does anyone have any ideas on how we can make Identity Connect useful for our business requirements given less than a quarter of our company has Salesforce logins?