We a requirement where we are required to override Salesforce Role and profile if an Access Request is raised.
Connector used: Salesforce - SaaS
Say, User currently holds ISC R1 and later user wants to change it to ISC R2
ISC R1 - Salesforce R1, and P1
ISC R2 - Salesforce R2, and P2
Ideally, this should have been taken care by connector but unfortunately it is not working.
I would like to know if anyone has implemented any such functionality. I tried raising the Role Remove request in Access Request Decision workflow but it seems to be throwing error.
Hello Ashish. The error may be coming from the profile side rather than the Salesforce role itself. Salesforce always needs a user to have a profile, so when R1 comes off and it tries to remove P1 with nothing to replace it, that removal can fail.
The cleaner way to look at this is as a replacement rather than a straight swap. Since R2 already carries Salesforce R2 and P2, I would provision R2 first and then remove R1, so the user is never left without a valid profile in between.
For removing R1, it helps to know how it was assigned. If it came through an access request, you can simply revoke it. If it came from role membership criteria, it will not revoke directly, so you would adjust the criteria until the identity no longer matches and let identity processing take it off.
For the profile handling itself, a cloud Before Provisioning Rule is a good fit. It lets you adjust the provisioning plan before it reaches Salesforce, so you can catch the P1 removal and set or keep P2 in its place. There is a very similar Salesforce case with a sample approach here.
Have it swap the profile only when there is no valid ProfileId Add already in the plan. That way it cleans up the P1 removal without overwriting the P2 that R2 is bringing in.
I would trigger it after R2/P2 is successfully provisioned, then use Manage Access → Remove Access to submit the R1 removal automatically.
Configure R1 with Require Approval for Removal and the required reviewer, so the user does not need to submit a second request, but the one-level removal approval is still enforced.