Manage User Provisioning Requests
After you configure user provisioning for a connected app with the User Provisioning wizard, you can manage individual provisioning requests from the User Provisioning Requests tab and from the connected app’s detail page. If you included an approval process, you can set up user provisioning request sharing rules.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
Connected Apps can be created in: Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer Editions Connected Apps can be installed in: All editions |
| User Permissions Needed | |
|---|---|
| To manage user provisioning requests for connected apps: | View Setup and Configuration AND Manage Users |
| To read, create, update, or delete connected apps: | Customize Application AND either Modify All Data OR Manage Connected Apps |
| To update all fields, except Profiles, Permission Sets, and Service Provider SAML Attributes: | Customize Application AND either Modify All Data OR Manage Connected Apps |
| To update Profiles, Permission Sets, and Service Provider SAML Attributes: | Customize Application AND Modify All Data |
| To install and uninstall connected apps: | Customize Application AND either Modify All Data OR Manage Connected Apps |
| To install and uninstall packaged connected apps: | Customize Application AND either Modify All Data OR Manage Connected Apps AND Download AppExchange Packages |
See New connected apps can no longer be created in Spring ‘26 for more details.
User Provisioning Requests Tab
From the User Provisioning Requests tab, you can view details and manage approvals for an individual user provisioning request. Each provisioning request details the status of the request and the status of an approval, if you chose to require approvals when you ran the User Provisioning Wizard.
Click the name of a recent user provisioning request to see these details.
- Operation
- The action for the current request, which can be one of these values:
- Create
- Read
- Update
- Deactivate
- Activate
- Freeze
- Unfreeze
- Reconcile (compares the Salesforce account to the account on the third-party system)
- Linking (changes the current Link State)
- State
- Current state of the user provisioning request. The User Provisioning wizard invokes a
reconciliation process to gather user accounts on the third-party system and compare them to
Salesforce user accounts. State reports the progress of the reconciliation process. Typically,
when it’s created, a user provisioning request state is New. During the collection process,
the state is set to Collecting. When the process finishes, the state is Collected.
If the reconciliation process discovers a difference between accounts, an analyze process is triggered, and the state is set to Analyzing. When the process finishes, the state is set to Analyzed.
If a process commits the request based on the linkage settings, the state is set to Committing, and Salesforce updates the user account properties, accordingly. When the update process finishes, the state is set to Completed.
However, some requests don’t start with the New state. For example, if a custom process initiates a request to reconcile accounts, an entry can start with the Analyzing state.
If the active process fails, the state changes to Failed.
Click the User Provisioning Account value to see these details about the user’s account.
- Status
- The status of the account in the third-party system, which can be one of these values:
- Active
- Deactivated
- Deleted
- Link State
- The state of the current connection between the user account in the Salesforce org and the
associated user account in the third-party system. The link state can be one of these
values:
- Linked—Changes to the account in the Salesforce org are queued for updating the associated user account in the third-party system
- Duplicate—An associated account in the third-party system exists
- Orphaned—No associated account exists in the third-party system
- Ignored—Changes to the account in the Salesforce org have no effect on the associated user account in the third-party system
User Accounts Section of a Connected App’s Detail Page
The User Accounts section in a connected app’s detail page lists all the accounts discovered and linked to the third-party service. Normally, you let Salesforce manage the Link State to the user account on the third-party system. Salesforce can discover and associate user accounts between a Salesforce org and a third-party system during a reconciliation process. The association is based on attributes that you specify in the User Provisioning wizard.
Select Let me manage the account linkage only if you want to control the Link State instead of letting Salesforce do it for you.
User Provisioning Request Sharing Rules
If you’ve added approval processes to your user provisioning configuration, set sharing rules so that another user or manager can see and approve a user provisioning request. From Setup, enter Sharing Settings in the Quick Find box, then select Sharing Settings.
