I am currently testing Salesforce account creation through SailPoint Identity Security Cloud (ISC).
I noticed that when I request an Access Profile containing a Salesforce entitlement for an identity that does not yet have a Salesforce account, the request remains stuck at:
Pending → Provisioning
and does not move to Request Completed.
The Salesforce account is also not created, and the entitlement does not appear as access for the identity.
I have already checked the following:
Provisioning is enabled for the Salesforce source.
The source is associated with a VA Cluster.
The Create Account configuration is set up, with the main account attributes mapped.
There is no Service Desk integration associated with the source.
I could not find any specific polling configuration in the Salesforce connector.
This issue occurs specifically when I try to provision access to an identity that does not yet have a Salesforce account. For identities that already have a Salesforce account, the process works as expected.
Has anyone experienced this behavior before? Is there any additional configuration I should check to allow ISC to automatically create the Salesforce account when provisioning an Access Profile?
When looking at your virtual appliance logs at the time of the error, does the request indicate a missing specific attribute, or does it report a connection timeout?
I made some changes to the attribute mappings in the account creation policy and ran a new provisioning test. After these changes, the error changed.
Previously, the request returned:
“User not created. Required Field is missing: ProfileName”
After mapping the new attributes, the request now fails with:
“Disable account will not be created by Salesforce”
IsActive is configured as Static = true, so I’m not sure what could be causing this new error. Do you know if there is another attribute in the account creation policy that could be related to this message?
Hello Isabella. The two errors look like separate issues. The ProfileName error seems to be resolved now, so I would leave that part as it is.
For the current error: Disable account will not be created by Salesforce
Your IsActive = true mapping looks correct. I would check two things before changing the policy again.
First, confirm directly in Salesforce that Abraao does not already have an inactive account. If Exclude Disabled Account is enabled, ISC only aggregates users with IsActive = true, so a disabled account can exist in Salesforce but not appear in ISC. If one exists, I would work with that existing account rather than try to create another one.
Second, check the identity’s lifecycle state under:
Admin → Identity Management → Identity Profiles → select the profile → Lifecycle Management → current state → Settings for Previous Accounts → Disable Accounts
See whether Salesforce is included there. I would only treat this as a check, since lifecycle enable/disable actions run once when the identity enters the state.
If both look fine, the next step would be the Account Activity / VA (ccg) log. Check whether the Salesforce request contains IsActive = false or a separate Disable operation. That should show where the disabled state is coming from.
