we've just installed Salesforce Identity Connect so that our users can connect to Salesforce using their Microsoft AD credentials.
In the future, we are going to have 2 types of users :
- type 1 users, Salesforce platform users (with the "Salesforce Platform" license and a custom profile)
- type 2 users, standalone Identity users, who are going to use the platform solely for Identity Connect purposes (for instance, using their AD credentials to log in to Gmail) with the "Identity" license and the standard profile "Identity User".
To make things simple, we have 2 AD groups :
- SF_USERS containing type 1 users
- IDENTITY_USERS containing type 2 users
Put a user in the IDENTITY_USERS group, and it will be created with the proper license (Identity).
Same with SF_USERS.
Everything works perfectly.
But our issue is the following :
put a user in the SF_USERS, wait for the user to create in Salesforce, and some other day, put it into the IDENTITY_USERS group.
Salesforce won't change it's license type from "Salesforce Platform" to Identity.
We got the following error : "User's Profile can't be set to 'Identity User' because it's derived from a license that doesn't require the following permission(s): ChatterInternalUser. Select a different profile.".
This is a pretty classic business need.
Some users may need to work in Salesforce today. But in the future, they may change position in the company, and won't need Salesforce anymore, BUT they will still need to use the Identity functionalities.
Questions are :
- is it considered a license downgrade by Salesforce ?
- is it a bug ?
- how can we achieve this simple need ?
Thanks for reading
Best Answer
So for all of you interested, here is Salesforce's support answer :
TL;DR : not possible to do that.
That really is a shame, and it is a really poor workaround.