Entra Salesforce provisioning uses SOAP API login() v40 - supported OAuth migration path before Summer '27 retirement?

Bert Lisboa 0 Reputation points
2026-10-16T04:20:59.2233333+00:00

We use the Microsoft Entra gallery Salesforce Enterprise Application for automatic user provisioning/deprovisioning.

The integration is currently working correctly. This is not a provisioning failure or troubleshooting request.

We have confirmed from Salesforce Login History/Event Logs that the Microsoft Entra provisioning service authenticates to Salesforce using:

  • SOAP Partner API
  • API version 40
  • SOAP API login()
  • Salesforce integration credentials stored under Enterprise Application → Salesforce → Provisioning → Connectivity

The current Entra configuration provides:

  • Admin Username
  • Admin Password
  • Secret Token
  • Tenant URL

There is currently no OAuth authentication option presented in this connector.

Microsoft's current documentation also specifically describes the Salesforce automatic provisioning integration as connecting Microsoft Entra ID to the Salesforce user account provisioning API v40.

Salesforce has announced the retirement of SOAP API login() for API versions 31.0 through 64.0 in Summer '27.User's image

Question for Microsoft / Entra Provisioning engineering:

What is Microsoft's supported migration path for existing customers using the Salesforce gallery Enterprise Application automatic provisioning connector?

Specifically:

  1. Will the existing Salesforce gallery provisioning connector be updated to authenticate using OAuth before the Salesforce SOAP login() retirement?
  2. If yes, what will the migration path be for existing Enterprise Applications?
  3. If not, what Microsoft-supported provisioning configuration should replace the existing Salesforce gallery connector?
  4. Are there any actions existing customers need to take before Salesforce's SOAP login() retirement?

Again, provisioning is currently functioning correctly. We are trying to establish Microsoft's supported migration path before the authentication mechanism used by the Microsoft connector is retired by Salesforce.

I'm specifically looking for confirmation from someone familiar with the Microsoft Entra provisioning service / Salesforce gallery connector, rather than generic Salesforce OAuth or SCIM configuration guidance.

Please don't paste an article explaining what OAuth is.

Please don't ask me to Test Connection.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Palanikumar Annamalai 0 Reputation points
    2026-10-16T08:04:55.3133333+00:00

    Your concern is valid. Salesforce states that SOAP API login() is unavailable in API 65.0 and later and that versions 31.0–64.0 are scheduled for retirement with the Summer ’27 release. A connector observed using login() v40 is therefore in scope even though provisioning is working today.

    For the Microsoft Entra Salesforce gallery application, the provisioning connector is Microsoft-managed. If Provisioning > Connectivity exposes only the administrator username, password, security token and tenant URL, there is no tenant-side control that changes that connector to OAuth or changes its API version. The SAML/OIDC SSO configuration is separate and does not alter the provisioning service’s authentication method.

    Because the question asks for Microsoft’s supported product roadmap, the authoritative next step is an Entra support case. Include:

    • Enterprise application object ID and tenant ID
    • Evidence from Salesforce Login History showing SOAP Partner API, login(), and API v40
    • The Salesforce retirement notice and Summer ’27 deadline
    • A request for written confirmation of the gallery connector migration plan, any in-place upgrade steps, and the supported fallback if no in-place migration is planned

    In parallel, preserve the current mappings, scoping filters, matching precedence, entitlement/profile handling, disable/delete behavior, and accidental-deletion settings. If Microsoft recommends a replacement connector, validate it in Salesforce sandbox with a small test scope and test create, update, disable, re-enable and entitlement changes before cutover. Do not run two production connectors against the same population; stop the legacy job before widening the replacement scope.

    Salesforce also documents interim controls for SOAP login(), including Use Any API Auth and security-token requirements for broad IP ranges. Those controls can affect continuity before Summer ’27, but they do not convert the Microsoft-managed connector to OAuth.

    So the practical answer today is: there is no native tenant setting that converts the existing Salesforce gallery provisioning connector to OAuth. Microsoft must confirm and deliver the supported connector migration path. Open the support case now and use the remaining time to inventory and test the eventual replacement safely.

    References:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.