Start with Accounts: Design Identity and Access That Scales

# Start with Accounts: Design Identity and Access That Scales

When external users belong to business organizations, the Account object is the most stable, predictable place to centralize identity, access, and onboarding decisions. The article explains how three practical design choices reduce onboarding complexity and keep authentication and data access consistent as you add more organizations.

Why Account first

• Represent each customer or partner company as a business Account record.
• Ensure every external User resolves through a Contact to the correct Account.
• Associate any organization-scoped records with that Account via lookups.
• Default external access to restrictive and grant privileges through Account- or Contact-based sharing.

Route authentication with Login Discovery

Showing separate login buttons for each SSO is poor UX and does not scale. Login Discovery offers a better flow: ask the user for a simple identifier (for example, email), then use a handler to resolve that identity through User → Contact → Account and read the Account's authentication configuration.

• Account.
• The handler reads the Account-level configuration that identifies which SSO or authentication path to use. That configuration can live on the Account, a related record, or as custom metadata.
• The handler routes the user to the correct identity provider based on that configuration.

This keeps routing logic vendor-agnostic and avoids forcing users to choose the right login path themselves.

Align sharing and onboarding to the Account context

Once Account drives identity routing, you should align data access and onboarding flows to the same context so behavior is predictable and administrable.

• Use Account-based sharing rules and Contact-based sharing where appropriate to grant access to organization data.
• Model organization-scoped records with lookup relationships to Account to make permissioning straightforward.
• Keep onboarding controls (for example, whether self-service registration is allowed, required approvals, or provisioning status) as settings on the Account so you can change behavior per company without reworking authentication logic.

Practical benefits

• Fewer bespoke login paths: new organizations can be onboarded by setting Account-level configuration instead of creating new global exceptions.
• Consistent access model: data access and authentication follow the same resolved Account, reducing surprises and hidden exceptions.
• Scalable onboarding: administrators can apply organization-wide changes by updating Account configuration rather than touching individual user records.

Next steps for implementers

• Inventory external user flows and verify each external User resolves to a Contact and Account.
• Centralize identity provider mapping on Account records or a referenced configuration object.
• Implement Login Discovery to resolve the Account before routing authentication.
• Review sharing rules and data model to ensure organization-scoped records reference Account and that external access defaults to restrictive.

Adopting Account as the single anchor ties identity routing, data access, and onboarding configuration together. That alignment reduces complexity as the number of external organizations grows and keeps the user experience simple and predictable.