UAE Pass with Salesforce for real estate: where it fits and where it does not

What does UAE Pass give a real estate business?

It gives you a verified person and, for some accounts, a signature. It does not give you a company, proof of ownership or an effective sale.

What you can probably ship first: a document checklist with expiry reminders, and an agent that knows which contact is verified. Sign-in and prefill on enquiries is the obvious first pick, but UAE Pass's own rules may reject it. Ask before you build. If it works, we expect fewer unverified enquiries and less ID chasing on WhatsApp (our expectation, not a measured result).

Today the ID copy probably sits in a broker's WhatsApp. UAE Pass gets identity checks out of there, but not your AML file, which you still must keep.

We have implemented this style of integration and architecture for clients, and every claim here is checked against UAE Pass's public documentation and the UAE laws cited below. Scope note: it is engineering guidance, not legal advice, and it is Dubai-centric. It does not cover Abu Dhabi (DARI, Tawtheeq) or other emirates. Article numbers for Decree-Law 46/2021 come from TDRA's unofficial English translation; the Arabic text prevails.

UAE Pass offers authentication, digital signature and eSeal, and data and document sharing (for private organisations only), per its documentation. Its account levels decide what you learn about a person.

Visitors (passport or GCC ID) come back without an Emirates ID number. Whether they can sign is unconfirmed, so treat non-residents as SOP1 until UAE Pass says otherwise.

Three things it cannot do:

• Stand in for a company. UAE Pass authenticates individuals. Its documentation says that "authorization of individuals to represent an organization is to be managed by the Service Provider post authentication." It has a corporate account linking page, where the provider maps UUIDs to corporate profiles, and eSeal lets an authorised user seal on behalf of an entity. We found no native power-of-attorney or delegation feature.
• Prove title. Login shows identity, not ownership. The title deed at the Dubai Land Department (DLD) does that.
• Make a sale effective. In Dubai, registration does that, and DLD already runs a Digital Sale service on the Dubai Now app that uses UAE Pass for the signature.

How do you connect UAE Pass to Salesforce?

Two routes exist: a partner app, or a direct OpenID Connect connection that you configure. We found no native Salesforce connector and no AppExchange listing for UAE Pass or Emirates ID, though you should check the AppExchange by hand. Our view: start with a direct Auth Provider build if you already run Experience Cloud, and consider a partner package only if you need signing inside DocuSign, and test it first.

The only worked example we read in full is a LinkedIn tutorial from 28 March 2024 that calls itself "for demo purpose only". The same author posted about verifying customers in Salesforce with UAE Pass in August 2025, which we could not assess. It stores no UUID, checks no account level, matches no existing customer and does not use PKCE.

How to match people

UAE Pass's guidelines say to link accounts on the UUID (which you must store) or the verified Emirates ID. They do not recommend verified email alone, although they allow it in some specific cases. They also say not to link an unverified local account to a verified UAE Pass account (SOP2 or SOP3), or a verified local account to an unverified one (SOP1), though the guideline heading calls this "less recommended". They set build rules too:

• Keep the login flow separate from local login.
• Make data filled in from UAE Pass non-editable in the new-user registration flow.
• Do not prompt a new UAE Pass user to create a username and password (the registration flow).
• UAE Pass recommends you do not start authentication on the user's behalf.
• UAE Pass says the service provider should log the user out of UAE Pass on logout.

So put the UUID in an external-ID field on the Contact or Person Account. Person Accounts fit an individual buyer, and a corporate buyer still needs an Account with a Contact. If you searched for an "Emirates ID verification API": UAE Pass returns the number only at SOP2 and SOP3.

If you are a broker acting on a sale, Resolution 134/2025 (Articles 9 and 25) applies to customer due diligence and record keeping generally, and on our reading Circular 5/2022 adds an obtain-and-record duty for ID documents in the cases it triggers. Keep ID copies for at least five years in a restricted compliance store that agents cannot read. Avoiding the raw number applies to CRM matching fields, not to your AML file.

Onboarding with UAE Pass

Private companies are supported: you apply through the developer portal with a valid UAE trade licence and sign a Service Provider Agreement. One guideline matters for a broker: "UAE Pass usage for limited scope must be avoided". UAE Pass says it is for authentication, so the whole service must be implemented on your channel. Its example is using UAE Pass only to update an email or mobile number. A "Continue with UAE Pass" button that only prefills an enquiry form may be read the same way, so ask the onboarding team before you design around it. We found no published answer on broker eligibility, fees, timeline, data hosting, attribute approval or eSeal for brokers.

What should the Experience Cloud site do?

Put everything that depends on identity behind the UAE Pass login on your Experience Cloud site, and show anonymous visitors only what a guest may see.

Guests are limited by design: the guest default is private, access is read-only through guest sharing rules, and guests cannot upload files. So document uploads, viewing passes and anything tied to a person wait for login.

Consent needs its own record. The UAE PDPL (Federal Decree-Law 45 of 2021) requires consent to be specific, clear and provable (Articles 1 and 6). Store the wording, the time and the channel on a consent record, such as a custom Consent__c object.

How should an Agentforce agent use the verified identity?

The agent checks who is verified and drafts. A person approves anything with legal or financial weight.

Agentforce supports verified users on the Messaging channel. You upload a JSON Web Key set in User Verification Setup, activate user verification on the channel, and pass a signed JWT with the identity token, signed with RS256 or RS512 (Trailhead, Salesforce). A handoff to a person goes through Omni-Channel escalation. Our trusted agent identity page covers the wider pattern, and AI agents in the UAE the local setting.

Salesforce says an agent session with an authenticated user runs in that user's context, while an unauthenticated session runs as the agent user. Where an agent uses the agent user record, Salesforce recommends filters and variables to limit access. So an action must filter on the verified contact from the read-only context, never on a value the person typed. Salesforce also recommends confirming identity before an agent takes a private action (Salesforce Help). There is no platform setting that makes an action private, so build the check into each action.

What the agent must never do:

• Log into Dubai REST, Dubai Now or Ejari with a user's UAE Pass and transact. Signing needs the same logged-in user, so the agent would be acting as the client.
• File Trakheesi permits or generate adverts without the owner's signed marketing agreement (Contract A).
• Decide rent caps or evictions. The PDPL gives a right to object to automated decisions that have a legal impact on or adversely affect the person (Article 18), with exceptions for contract, law and consent.
• Treat a UAE Pass login as proof of ownership, or mark a notice as sent because an email went out from the CRM.

Agent data masking may be off (Trailhead says it is currently disabled for agents), so keep the Emirates ID number out of any field an agent can read. And do not claim the AI stays in the UAE: Hyperforce residency is confirmed for Sales Cloud and Service Cloud only.

Which real estate use cases fit?

Green means build it. Amber means build it only when the condition is met. Red means do not build it.

Your own engagement letter or NDA can also be signed with UAE Pass inside your own portal, for SOP3 accounts, and for SOP2 accounts if you accept advanced-level signatures. That needs UAE Pass onboarding, and it is not for the property sale contract.

Brokers are covered by the AML rules when they conclude transactions for customers, so here is one worked flow on a resale enquiry:

1. The buyer signs in with UAE Pass. Salesforce logs the UUID, the account level, the time and the consent record, and not the Emirates ID number.
2. The agent drafts the document checklist for that buyer.
3. The broker confirms any identity claim against the ID document at handover, and records the ID in the restricted compliance store.
4. A person signs off the file before anything goes to the trustee centre. The transaction itself runs at DLD.
5. No record says UAE Pass satisfied customer due diligence, because we found no guidance that it does.

What does the law say?

Who signed, whether the signature counts, and whether the sale is effective are three separate questions.

Standard Property Sale Registration goes through a Real Estate Registration Trustee centre, and accepts a passport for a non-resident foreigner. The Digital Sale service on Dubai Now launched in its first phase in October 2025. It is for UAE ID holders only, with both parties taking part, for single-owner freehold apartments, offices and townhouses with no mortgage, and it also needs a UAE bank account. The contract is signed digitally through the Digital ID (UAE Pass), the price goes through escrow, and the process cancels itself after 7 days unsigned.

Two more areas touch a Salesforce build:

• Data. Under the PDPL, biometric data is sensitive (Article 1). Data stays tied to its purpose (Article 5), and transfers abroad follow Articles 22 and 23. Article 28 required the Executive Regulations within six months of the law's issue. We found no published regulations.
• Anti-money laundering. On our reading:
  • Who is covered: Cabinet Resolution 134/2025 (Article 3(2)) lists "real estate brokers and agents, when concluding transactions or settlements on behalf of their customers in relation to the purchase or sale of real estate". A broker may rely on a third party only if it is regulated and supervised, and the broker stays responsible for the checks (Article 20).
  • When goAML fires: Ministry of Economy Circular 5/2022 requires brokers to file a report where a single physical cash transaction, or several together, reach AED 55,000 or more, or where any virtual asset is involved. That is a reporting trigger, not a cash limit.
  • Older circulars stay in force unless replaced (Decree-Law 10/2025, Article 41(3)). A lawyer should confirm.

What a lawyer should confirm

1. Whether any Cabinet resolution under Article 2(2) excludes real estate (read the Arabic text), and whether Law 7/2006 Article 9 registration defeats any e-signature route. Digital Sale suggests the regulator resolved it for that channel only.
2. Whether UAE Pass or its certificate authority is a licensed qualified trust service (Articles 15 and 27), and whether SOP2 "advanced" meets Article 19 and the Executive Regulation.
3. The current consequence of not registering a lease after Law 33/2008, and how RERA and DLD relate.
4. Off-plan: Law 9/2009, Law 8/2007 and Bylaw 85/2006.
5. Whether Circular 5/2022 still applies under Decree-Law 10/2025 Article 41(3) and Resolution 134/2025, which authority supervises brokers for AML, whether UAE Pass can support remote customer due diligence, and how Article 20 reliance applies.
6. How to reconcile PDPL Article 5(7) minimisation with the ID-copy and five-year duties, what ICP says about private-sector handling of Emirates ID data, whether the number is ordinary personal data, and the status of the Executive Regulations.
7. Whether Agentforce processing outside the UAE is a cross-border transfer (PDPL Articles 22 and 23), and how the free-zone regimes apply.
8. Whether an agent acting with a client's UAE Pass credentials would breach the Service Provider Agreement. This post says an agent must never do it.

What to do in the first week

1. 01Pick one green use case, such as the document checklist, and write the flow on one page with the human approval point.
2. 02Write your questions for the UAE Pass onboarding team: eligibility, fees, timeline, attributes, OpenID Connect, PKCE and the limited-scope guideline.
3. 03Add an external-ID field for the UAE Pass UUID, and decide what happens to an existing customer who has only an email on file.
4. 04Decide where ID copies live for your AML file, and who may see them.
5. 05Send the lawyer questions above, and keep the agent switched off until the answers are back.

If you want a second pair of eyes, send us your onboarding flow, step by step. We will mark each step green, amber or red against UAE Pass and the regulator's flows, and reply in writing.