---
schema_version: "1"
id: 39bcee328170d85c7905e12717317df1f62638de28f1e933f985263e55060535
title: Configure User Provisioning for Connected Apps
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_user_provisioning_configure.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning_configure.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 332da48aa792ea21052d9405cf8f5080a8b9c7ba779a07b2203f3ebb420c304d
description: Configure a connected app to save time when provisioning users for third-party apps. Salesforce provides a wizard that guides you through the user provisioning settings for each connected app.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Configure User Provisioning for Connected Apps

Configure a connected app to save time when provisioning users for third-party apps. Salesforce provides a wizard that guides you through the user provisioning settings for each connected app.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic
            and Lightning Experience</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
              <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
              <strong>Developer</strong> Editions
            </p>
            <p style="margin-bottom:0;">Connected Apps can be installed in: All
              editions</p>
          </td>

        </tr>
      </tbody>
    </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d39699e95">User Permissions Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">To configure user provisioning for connected apps:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">View Setup and Configuration AND Manage Users AND Customize Application</td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">To read, create, update, or delete connected apps:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">
            <p>Customize Application AND either</p>
            <p style="margin-bottom:0;">Modify All Data OR Manage Connected
              Apps</p>
          </td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">To update all fields except Profiles, Permission Sets, and Service Provider SAML
            Attributes:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">
            <p>Customize Application AND either</p>
            <p style="margin-bottom:0;">Modify All Data OR Manage Connected
              Apps</p>
          </td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">To update Profiles, Permission Sets, and Service Provider SAML
            Attributes:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">Customize Application AND Modify All Data</td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">To install and uninstall connected apps:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">
            <p>Customize Application AND either</p>
            <p style="margin-bottom:0;">Modify All Data OR Manage Connected
              Apps</p>
          </td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">To install and uninstall packaged connected apps:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39699e95 ">
            <p>Customize Application AND either</p>
            <p>Modify All Data OR Manage Connected
              Apps</p>
            <p style="margin-bottom:0;">AND Download AppExchange Packages</p>
          </td>

        </tr>
      </tbody>
    </table>

Salesforce provides a step-by-step wizard to guide you through the user provisioning process for each connected app.

Before you use the wizard, you must have the following.

A connected app for the third-party service to provision

Any connected app can support user provisioning, including a “bookmark” connected app, which is a connected app that hasn’t been configured beyond its basic settings. See [Configure Basic Connected App Settings](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_basics.htm&release=264.0.0&type=5 "For all connected apps, define the basics, which include the app’s name, logo, and contact information.").

Named credentials

Named credentials identify the third-party system and its authentication settings. Calls to the third-party system, such as creating, editing, or deleting accounts, use the third-party authentication settings in the named credential. For the named credential, you specify a Named Principal. The Named Principal can be an account on the third-party system or an OAuth authorization for an existing Auth Provider in your org. The User Provisioning Wizard prompts for this named credential.

A flow to manage provisioning requests to the third-party service or app

Salesforce provides preconfigured flows to simplify your user-provisioning setup process. From AppExchange, install the [Salesforce Identity User Provisioning Connectors](https://appexchange.salesforce.com/listingDetail?listingId=a0N3A00000EeLdWUAV) package and the [Salesforce Identity User Provisioning Utils](https://appexchange.salesforce.com/listingDetail?listingId=a0N3A00000EeLdbUAF) packages. You associate one of these flows with the connected app using the User Provisioning Wizard.

Optionally, you can create your own flow. For more information, see [Create Your Own User Provisioning Flow](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning_configure.htm&release=264.0.0&type=5).

## Run the User Provisioning Wizard

If user provisioning is enabled for your org, use these steps to start the User Provisioning wizard for your connected app.

1. From Setup, enter Connected Apps in the Quick Find box, then select **Manage Connected Apps**.
2. Click the name of the connected app.
3. On the connected app detail page, click **Edit Policies**.
4. Under User Provisioning Settings, select **Enable User Provisioning**.
5. Click **Save**.
6. Under User Provisioning Settings, click **Launch User Provisioning Wizard**.
    
    ![User Provisioning Wizard button](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/identity_userprovisioning_button.png)
    
    After you provision users for your connected app, you can update a user’s account information from the connected app detail page. All users provisioned for the app appear under User Accounts.
    
    You can also rerun the wizard to collect and analyze the accounts on the third-party system, change the provisioning configuration, and process all accounts.

## Create Your Own User Provisioning Flow

If the packaged flows don’t support the third-party system that you want to provision, or if you want to customize the user provisioning process, you can create your own flow. Creating a flow requires you to be familiar with Flow Builder and Apex triggers.

Use the `UserProvisioningPlugin` legacy Apex action and the UserProvisioningRequest and UserProvAccount standard objects to create a flow of type User Provisioning. Include these items in the flow.

- Legacy Apex action using the `UserProvisioningPlugin` class with these input and output variables:
    - Input: User, UserProvisioningRequest, UserProvAccount
    - Output: ExternalUserId, ExternalUsername, ExternalFirstName, ExternalLastName, ExternalEmail, Details, Status
- At least one legacy Apex action with these input and output parameters:
    - Input: userProvisioningRequestId, userId, namedCredDevName, reconFilter, reconOffset
    - Output: ExternalUserId, ExternalUsername, ExternalFirstName, ExternalLastName, ExternalEmail, Details, Status, reconState, nextReconOffset
- A “Look Up User” Get Records element to modify during user account linking between Salesforce users and users on the third-party system

#### See Also

- [User Provisioning for Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_user_provisioning.htm&release=264.0.0&type=5 "You can use a connected app to link your users with a third-party app. User provisioning for a connected app simplifies account creation and links your Salesforce users’ accounts to their third-party accounts. After the accounts are linked, you can configure the App Launcher to display the connected app as a tile. With a single click, users get instant access to the third-party app.")
- [Create a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create.htm&release=264.0.0&type=5 "When you create a connected app, make sure that you understand how it’s going to be used so you can configure the appropriate settings. For example, if you’re creating a connected app to integrate an external application with your Salesforce API, configure the connected app with OAuth authorization settings. Or if you’re creating a connected app to act as a service provider in a SAML single sign-on (SSO) flow, configure SAML settings.")
- [_Named Credentials_](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&type=5&language=en_US)
- [_Flow Builder_](https://help.salesforce.com/s/articleView?id=platform.flow.htm&type=5&language=en_US)
- [_Apex Developer Guide_](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode)