JuanB.86576 (Customer) asked a question.
Salesforce Provisioning
Has anyone else experience where Salesforce User's Profiles, Roles and permissions change constantly?
I ask this question as it makes it challenging to set up constant Okta Group along with the user Salesforce profile and roles.
Do you recommend to use Salesforce as a master?
However I want to create the user in Okta then provision the user to Salesforce, then the Salesforce Admin changes the new user permission that can be automatically be reflected back to Okta
I am looking to do the same thing. I want to create a "base" provisioned account from Okta, but allow the salesforce admin to make changes to permission sets and or role or profile without it being updated from the group. Even if I set the profile or role to on create only, it changes on the next sync back to the Okta Group settings. I wonder if this is a bug in Okta's group permissions for apps?
This post from a while back implies someone was able to set it to create only, and not update (see last reply from @miqxq (miqxq) ): https://support.okta.com/help/s/question/0D50Z00008G7VLb/okta-to-sales-force-provisioning