Salesforce user provisioning failed: profile assignment error for new hire fix

TL;DR

Assign a profile that exists, is active, and matches the user license the hire receives. Check the exact profile name the integration sends against the org profile list, confirm the license type pairing, create the user with the corrected pairing, and verify the hire can sign in with the intended access before fixing the integration mapping for the next hire.

Salesforce user provisioning failed: profile assignment error for new hire

Use this when

• The Salesforce user create returns an error naming the profile, its license, or a required field tied to the profile.
• Manual user creation with a different profile succeeds in the same org.
• Failures cluster on a role whose profile was recently renamed or cloned.

Not for this skill when

• The user exists but lacks access to objects. That is permission configuration after provisioning.
• Salesforce SSO sign-in fails for all users. Repair federation before single-user provisioning.

Steps

1. Capture the Salesforce error from the integration log with its code and message, and note the profile name and user license the job attempted. Open Setup, Profiles, in the org and search for that exact profile name, watching for renamed, cloned, or inactive variants. Verify: the attempted profile existence and state are established
2. Check the pairing rules: each profile is tied to a user license type, and the job must request a license the org still has available in that type. Read the org company information license counts for the relevant type at the same time. Verify: profile, license type, and available count are all listed
3. Inspect required user fields that profiles do not control but creates often miss, such as user role expectations in some orgs, time zone, locale, and email encoding defaults the integration should supply. Compare a successful manual create field by field with the job payload. Verify: payload gaps beyond the profile are identified
4. Correct the integration mapping to the current profile name and license pairing agreed with the Salesforce admin for this role, avoiding profiles that are slated for retirement in the org profile cleanup. Verify: the saved mapping names a current, supported profile
5. Create the hire user through the integration again, confirm the user record is active, the profile and license are as intended, and any permission sets the role needs are layered on top rather than baked into a new profile. Verify: the user shows active with the correct profile and license
6. Have the hire complete first sign-in or SSO access and open the home page and one role-critical object, then record the Salesforce user id on the onboarding ticket for later deprovisioning accuracy. Verify: the hire reaches Salesforce with working role access

Why it happens

Salesforce validates the profile, license, and required user fields as a bundle on create, and reports the first failing element, which is often the profile even when the underlying problem is a license pairing or a renamed profile the integration still references. Org profile cleanups and license true-ups happen outside the provisioning team view, so mappings quietly go stale. Comparing the job payload with a known-good manual create exposes every stale element at once, and keeping profile ownership shared between Salesforce and identity admins prevents silent drift.

Variants and edge cases

Profile exists but license is exhausted

Reclaim licenses from inactive users in the same license type after confirming with the org admin, then retry the create.

Integration sends a profile id from a sandbox

Profile ids differ per org. Store the profile by name lookup at runtime or maintain per-org mapping values, never copy sandbox ids to production.

Federated hire needs a specific profile for SSO mapping

Some SSO configurations map profiles by assertion values. Align the integration role value with the SSO mapping table for the same role.

Compatibility: Applies to Salesforce Lightning orgs with user provisioning via API or identity connectors. Requires Salesforce admin access for Setup checks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_usyJhPuVIcjRruexoe67rQ