[Salesforce] Question about group vs administrator assignment master Skip to main content
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Ask Search:
Joseph CastleJoseph Castle 

[Salesforce] Question about group vs administrator assignment master

Greetings.  We are using Workday and Okta groups to assign people the Salesforce application.  In the group properties, we define a certain 'default' role, profile, feature license and permission sets for Salesforce.  Our Salesforce Team will then go in on the Salesforce side and update their permission sets, role, etc to match their actual job role.
We have had numerous occasions now where suddenly a user will be reverted back to the default settings for role, profile, etc.  I suspect it is because these are defined by the group.  We have seen the same issue with assigning people Office365 by group assignment.  We give them default license features and if you try to add another one off license (Visio, etc) via the Office365 portal, Okta will eventually revert to the group assignment license features.

I wanted to confirm if this behavior is by design; if we are assigning these settings for Salesforce via group, then any future changes need to be done in Okta versus Salesforce?  Thanks in advance!
Mihai NegoitaMihai Negoita (Okta, Inc.)
Hi Joseph,

Yes, the described behavior is by design. If Salesforce is not the Profile Master and you have used Group Assignments through Okta, then the changes need to be done from the Okta side.   

Joseph CastleJoseph Castle
Hi Mihal,

Is there any way to create a configuration where Okta creates accounts and assigns such roles and permissions....in essense is a "one time" profile master, and then after provisioning the user with such default licenses, etc... any future changes are done through the app (Salesforce, Office365, etc).  Thanks in advance!
Dominic EstradaDominic Estrada
This should definitely be an option.