# Provisioning

The Salesforce connector supports provisioning, allowing you to create and manage accounts and entitlements in Salesforce directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

> [!NOTE]
>
> The Generator default is Disabled.

## Default Create Account Attributes

| Attribute | Description |
| --- | --- |
| Alias | (Required) The eight-character alias. By default, it generates a value based on the `lastname` and `firstname` in the field's inline script. It takes the first seven characters from the last name and prefixes it with the first character of the first name. |
| IsActive | Indicates the active status of the account. Defaults to `true`, meaning the account is active. |
| Username | Defaults to the account's username. |
| Email | Defaults to the account's email address. |
| FirstName | Defaults to the account's first name. |
| Lastname | Defaults to the account's last name. |
| CommunityNickname | Nickname defaults to account's full name. |
| TimeZoneSidKey | The user's timezone, it uses a display name defined by Salesforce. Only a few timezones are defined in the policy drop down and this will need to be customized for each deployment. Defaults to `America/Los_Angeles`. |
| LocaleSidKey | The user's locale. Defaults to `UTF-8`. |
| Email EncodingKey | The email encoding key. There are several selections to choose from in from the web interface. The encoding keys are customizable. Defaults to `UTF-8`. |
| LanguageLocaleKey | The language locale key. There are several selections to choose from in from the web interface. The locale keys are customizable. Defaults to `en_US`. |
| Federation Identifier | A Federation ID is an identifier that is unique within a Salesforce organization. |
| UserType | Used for defining Portal or Partner Users. Portal and Partner Users must be assigned to a Salesforce account using the **Account Name** provisioning policy attribute. If not configured, then the default `STANDARD` user will be created. Example values: `PORTAL`, `PARTNER`. |
| AccountName | A Salesforce account name to assign to a new portal or partner user. If left blank, the system creates a new Salesforce account and assigns it to the new portal or partner user. |
| PermissionSetLicense | For the Salesforce source, the `PermissionSetLicense` is added as an entitlement while provisioning an account. For existing sources, you must add the `PermissionSetLicense` object (String type) to the account schema. The Attribute Request priority is: Add PermissionSetLicense Object, Add/Remove PermissionSet, Remove PermissionSetLicense. Through the certification process, the `PermissionSetLicense` object cannot be removed until the associated Permission sets are removed. |
| ManagedPackage | The Salesforce source supports `ManagedPackage` entitlement. The source aggregates the `ManagedPackage` object (schema type: String; description: Managed Package assigned to a user). New Salesforce sources, by default, have `ManagedPackage` as an entitlement attribute while provisioning an account. For existing sources, you must manually add the `ManagedPackage` attribute to the schema. |

## Creating Portal and Partner Users

Configure your provisioning policy to create a new portal or partner user then associate them with an existing or new Salesforce account.

To create Portal Users and Partner Users:

1. Add the **UserType** attribute into your Create Profile provisioning policy. Supported values are `STANDARD`, `PARTNER` and `PORTAL`. The default value is `STANDARD`.
2. Add the **AccountName** attribute to the provisioning policy if you want to assign it to an existing Salesforce account.

   If the **AccountName** is not provided or not configured, a new account will be created and assigned to the new Portal or Partner User.

   > **Note**
   >
   > Enabling and disabling Portal and Partner users is not supported.