---
schema_version: "1"
id: 39ddb8542bdd54fc9021ae398a55af0d95351a6f3dec51b6eee84773a2d75c3e
title: Configure Salesforce Identity for Enablement
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/mth_configure_mytrailhead_identity.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.mth_configure_mytrailhead_identity.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: aa32f58a92f34b58d3257f232e71ad56a295f5b88dc528da45052f3d6741a508
description: To set up Salesforce Identity for Enablement for your enablement site, first create a connected app in Salesforce. The connected app handles data sharing between your enablement site and Salesforce using OpenID Connect and OAuth 2.0—protocols that authenticate users and authorize access to data in your org. Finally, enter your connected app details on your enablement site.
products:
  - Sales Cloud
  - Sales Enablement
release: "264"
---
# Configure Salesforce Identity for Enablement

To set up Salesforce Identity for Enablement for your enablement site, first create a connected app in Salesforce. The connected app handles data sharing between your enablement site and Salesforce using OpenID Connect and OAuth 2.0—protocols that authenticate users and authorize access to data in your org. Finally, enter your connected app details on your enablement site.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d18685e63">User Roles and
              Permissions</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Roles and Permissions" class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">
              <strong>Enablement Site User Roles</strong>
            </td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="User Roles and Permissions" class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">This topic supports these enablement site roles:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">Salesforce Admins</td>

          </tr>
          <tr class="">
            <td data-label="User Roles and Permissions" class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">
              <strong>Required System Permissions</strong>
            </td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="User Roles and Permissions" class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">To read, create, update, delete, install, or
              uninstall connected apps:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">
              <p>View Setup and Configuration</p>
              <p>AND</p>
              <p>Customize
                Application</p>
              <p>AND</p>
              <p style="margin-bottom:0;">Modify All Data OR Manage Connected
                Apps</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Roles and Permissions" class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">To configure the authentication provider:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d18685e63 ">Manage Site Settings</td>

          </tr>
        </tbody>
      </table>

Before you get started, review these important considerations.

- Make sure that you set up your enablement site before you create the connected app, which requires the URL that you created for your enablement site's subdomain.
- Create the connected app in production, not a sandbox.
- After you activate Salesforce Identity for Enablement, you can’t change your authentication provider to Trailblazer.me (TBID).
- Determine whether your enablement site supports only internal users from your Salesforce org or supports only external users who are Experience Cloud site members. With Salesforce Identity for Enablement, it’s difficult to make your enablement site available to both internal and external users, so we recommend that you choose one. This choice affects the authentication page URL that you enter in step [9.c](#mth_configure_mytrailhead_identity__sifm_setup_login_url).

1. From Setup, in the Quick Find box, enter Apps, and then select **App Manager**.
2. Click **New Connected App**.
3. In the Basic Information section, enter the app’s name and contact info.
    
     
    | Field | Value to Enter |
    | --- | --- |
    | Connected App Name | An internal name for the app, such as Enablement Site Authentication. |
    | API Name | A unique programmatic name for the app in your org. You can accept the default suggested name or enter your own. |
    | Contact Email | The email address that Salesforce uses for contact about the app, if necessary. |
    | Description | A brief description of what the app is for. |
4. In the API (Enable OAuth Settings) section, specify the connected app’s authorization details.
    1. Enable **Enable OAuth Settings**.
    2. For Callback URL, enter your enablement site URL—including the https:// protocol—and add /auth/mytrailhead/callback.
        
        For example, the callback URL for the Pure Aloe enablement site is https://purealoe.my.trailhead.com/auth/mytrailhead/callback.
        
        ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/images/icon_important.png)
        
        Important If you enter the callback URL incorrectly and then complete Salesforce Identity for Enablement setup, your users can’t log in to your enablement site.
    3. For Selected OAuth Scopes, add only these scopes to the list of selected scopes:
        
        - Access the identity URL service (id, profile, email, address, phone)
        - Access unique user identifiers (openid)
        - Perform requests at any time (refresh\_token, offline\_access)
    4. Enable **Require Secret for Web Server Flow**.
    5. Disable **Require Secret for Refresh Token Flow** and **Introspect All Tokens**.
    6. Review all the details that you entered, and save your changes.
        
        ![The completed connected app basic information and OAuth settings](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/mytrailhead/images/sifm_connected_app_oauth.png)
5. On the New Connected App page, click **Continue**.
6. Edit the connected app’s OAuth access policies and specify which users the app authorizes.
    1. On the connected app’s page in App Manager, click **Manage**.
        
        ![The connected app's page in App Manager, highlighting the Manage button](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/mytrailhead/images/sifm_connected_app_manage_button.png)
    2. Click **Edit Policies**.
    3. In the OAuth Policies section, use the Permitted Users dropdown to select which users your connected app authorizes.
        
        All users may self-authorize
        
        Any user from your org can access your enablement site with their credentials, but they must first consent to the app logging them in.
        
        Admin approved users are pre-authorized
        
        Users assigned to specific profiles or permission sets can access your enablement site with their credentials. They aren’t required to consent to the app’s activity. This option provides the smoothest login experience.
    4. Optionally, use the IP Relaxation, Refresh Token Policy, and Timeout Value options to add extra security measures around the authentication.
    5. Save your changes.
7. If you selected **Admin approved users are pre-authorized** for your app’s OAuth permitted users, select the profiles or permission sets to pre-authorize for access to your enablement site. If you selected **All users may self-authorize**, skip this step.
    1. On the connected app’s page, scroll to the Profiles section, and click **Manage Profiles**. Or, scroll to the Permission Sets section, and click **Manage Permission Sets**.
    2. Select which profiles or permission sets to preauthorize, and save your changes.
8. Locate the connected app’s consumer key and consumer secret.
    
    1. From Setup, in the Quick Find box, enter Apps, and then select **App Manager**.
    2. Scroll to your connected app, and select **View** from the app’s dropdown.
        
        ![App Manager page, showing the Sales Enablement Access connected app and highlighting the View option in the dropdown menu](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/mytrailhead/images/connected_app_select_view.png)
    3. On the connected app’s page, scroll to the API (Enable OAuth Settings) section, and click **Manage Consumer Details**.
        
        You're prompted to verify your identity before you can view the consumer details.
    
    ![Connected app page, showing the Manage Consumer Details button and Callback URL](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/mytrailhead/images/connected_app_secret.png)
    
    1. Copy the consumer key and consumer secret to a handy, secure location. You use these values to complete Salesforce Identity for Enablement setup.
9. Finally, configure your enablement site with the connected app details.
    1. If you aren’t already there, go to [https://trailhead.salesforce.com/subdomain/mytrailhead-id/setup](https://trailhead.salesforce.com/subdomain/mytrailhead-id/setup).
    2. Click **Use Salesforce Identity for Enablement**.
        
        ![Selection page for the myTrailhead authentication provider, showing the benefits of the two choices and highlighting the button Use Salesforce Identity for Sales Enablement](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/mytrailhead/images/myth_id_setup_new_page.png)
    3. On the Identity Setup page, under Step 2, enter these details:
        
        - The URL for your enablement site’s login page.
        - The Consumer Key that you copied from your connected app.
        - The Consumer Secret that you copied from your connected app.
        
        The login page URL isn’t the same as the callback URL that you created for your connected app. Your login page URL depends on whether your enablement site supports internal users from your Salesforce org or external users who are Experience Cloud site members.
        
         
        | Enablement Site Audience | URL to Enter |
        | --- | --- |
        | Internal users | Your org’s My Domain login URL, such as https://purealoe.my.salesforce.com. |
        | External users | Your Experience Cloud site URL, such as https://fixcoffee.com/community. |
        
        ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-mytrailhead-264-0-0-production-enus/0d6bc03d-58c7-47e8-89c9-5e00c98b5485/images/icon_important.png)
        
        Important Take extra care when you enter this information. If you enter it incorrectly and activate Salesforce Identity for Enablement, you’re locked out of your enablement site. To regain access, contact Salesforce Customer Support.
    4. Click **Activate**, and confirm your decision. This action is irreversible.
    5. Log in with your Salesforce or Experience Cloud credentials, depending on which audience your enablement site serves.

All your enabled users can now log in to your enablement site. Next, you can move on to these other admin activities.

- To add a link to your enablement site in your Salesforce org, you can [edit the connected app that you just created](https://help.salesforce.com/s/articleView?id=sales.mth_add_link_to_mytrailhead_in_salesforce_org.htm&release=264.0.0&type=5 "If your enablement site’s authentication provider is Salesforce Identity for Enablement, you can give users easy access to your site by adding a link in App Launcher in Salesforce.").
- To enable Experience Cloud site members as users, [connect your enablement site to your Experience Cloud site](https://help.salesforce.com/s/articleView?id=sales.mth_set_up_mytrailhead_in_your_community.htm&release=264.0.0&type=5 "Give your Experience Cloud site members access to your enablement site content.").
- To make sure that your content creators can access Trailmaker, [assign the appropriate permissions for different roles](https://help.salesforce.com/s/articleView?id=sales.mth_create_assign_mytrailhead_perm_sets.htm&release=264.0.0&type=5 "Ensure that your company’s content writers, publishers, and other stakeholders can access the features that are relevant to their specific roles. Create permission sets for the different publishing roles at your company, enable the permissions that correspond to the features they use, and assign the appropriate users.").
- To make sure that learners can access the appropriate published content, [create content collections and assign permissions to learners](https://help.salesforce.com/s/articleView?id=sales.mth_content_permissions.htm&release=264.0.0&type=5 "Ensure that learners can access only the trails and modules that are relevant to their disciplines or job requirements. Create content collections for your different audiences, and then use permission sets to enable access to specific content collections. Only learners with permission to access a particular content collection can view and complete the trails and modules included in the collection.").
- To continue configuring your enablement site's settings, you can [add your logo and color](https://help.salesforce.com/s/articleView?id=sales.mth_customize_mth_with_your_branding.htm&release=264.0.0&type=5 "When you configure your enablement site, you can apply your company’s visual identity, such as logo, primary color, and banner image. You can also customize the links that appear in the footer of each page. And you can designate the pages where your users land when they log out or click the Help icon. These customizations persist across your enablement site.") and [manage content filters](https://help.salesforce.com/s/articleView?id=sales.mth_manage_filters.htm&release=264.0.0&type=5 "Filters help learners find relevant content on your enablement site. Users can apply filters to refine search results or narrow down the visible content on the Modules and Trails index pages. And, Trail Tracker users can create reports based on filters, such as a report that shows all content labeled with a particular filter.").

#### See Also

- [Troubleshoot Login Issues with Salesforce Identity for Enablement](https://help.salesforce.com/s/articleView?id=sales.mth_sifm_troubleshoot.htm&release=264.0.0&type=5 "If you configure your enablement site to use Salesforce Identity for Enablement authentication, users can sometimes encounter issues when they try to log in. Help resolve any issues your users encounter when they visit your site’s login URL and enter the credentials.")
- [Set Up Your Enablement Site's Subdomain and First Content Collection](https://help.salesforce.com/s/articleView?id=sales.mth_set_up_your_mth_subdomain_and_namespace.htm&release=264.0.0&type=5 "Your subdomain is used in the URL where learners access your published trails and modules and where your authorized users log in to the Trailmaker apps. A subdomain name is an extension of your company’s brand. When you create your subdomain, you also create your company’s first content collection—a batch of content that you want to make available to certain learners. Later, you can create more content collections in Salesforce.")
- [Considerations for Selecting an Authentication Provider](https://help.salesforce.com/s/articleView?id=sales.mth_considerations_for_choosing_mytrailhead_identity.htm&release=264.0.0&type=5 "To help you determine which authentication provider is right for your company’s enablement site, review how each provider affects your learning and enablement strategy. We recommend that all new enablement sites choose Salesforce Identity for Enablement.")
- [Enable External Learners for Your Enablement Site](https://help.salesforce.com/s/articleView?id=sales.mth_mytrailhead_and_communities.htm&release=264.0.0&type=5 "Enable learners from outside your company as users for your enablement site by linking an Experience Cloud site. For example, guide partners to content that teaches them how to manage leads and opportunities. Or, guide customers to content that teaches them how to use your products.")
- [_Trailhead:_ Build a Connected App for API Integration](https://trailhead.salesforce.com/content/learn/projects/build-a-connected-app-for-api-integration)