• Cert++
  • Practice
  • Certle
  • Review
  • Tracks
  • Checklist
  • Guides
  • Upgrade
Cert++
  1. Home
  3. Platform Identity and Access Management Architect

Platform Identity and Access Management Architect

Checklist progress

0/174Learned

Platform Identity and Access Management Architect

Study Checklist

  • Platform Administrator
  • Platform App Builder
  • Platform Foundations
  • Platform Developer
  • Platform Administrator II
  • Agentforce Sales Consultant
  • Agentforce Service Consultant
  • Platform Data Architect
  • Platform Development Lifecycle and Deployment Architect
  • Platform Identity and Access Management Architect
  • Platform Integration Architect
  • Platform Sharing and Visibility Architect
  • Heroku Architect
  • B2C Solution Architect
  • Experience Cloud Consultant
  • Agentforce Field Service and Operations Consultant
  • Agentforce Nonprofit Consultant
  • Data 360 Consultant
  • Omnistudio Consultant
  • CRM Analytics and Einstein Discovery Consultant
  • Platform User Experience Designer
  • Platform Strategy Designer
  • B2C Commerce Developer
  • JavaScript Developer
  • Omnistudio Developer
  • Platform Developer II
  • Marketing Cloud Engagement Administrator
  • Marketing Cloud Engagement Specialist
  • Marketing Cloud Engagement Consultant
  • Agentforce Sales Foundations
  • Business Analyst
  • Marketing Cloud Engagement Developer
  • Marketing Cloud Engagement Foundations
  • Agentforce Specialist
  • Agentforce Life Sciences Consultant
  • B2B Commerce Administrator AP
  • B2B Commerce Developer AP
  • Agentforce Consumer Goods AP
  • Agentforce Financial Services AP
  • Agentforce Health AP
  • Agentforce Manufacturing AP
  • MuleSoft Integration Foundations
  • MuleSoft Developer
  • MuleSoft Developer II
  • MuleSoft Platform Integration Architect
  • MuleSoft Platform Architect
  • Tableau Desktop Foundations
  • Tableau Data Analyst
  • Tableau Consultant
  • Tableau Server Administrator
  • Tableau Architect

Checklist progress

0/174Learned

  • What is the difference between username/password authentication, certificate-based authentication, and federated authentication?
  • When is each authentication type (username/password, certificate-based, federated) most appropriate for a Salesforce deployment?
  • How does SAML-based SSO differ from OAuth-based SSO at the protocol level?
  • What drives the choice between SAML and OAuth for an enterprise integration?
  • What is the difference between SP-initiated SSO and IdP-initiated SSO in SAML?
  • What are the security and UX implications of SP-initiated versus IdP-initiated SSO?
  • When Salesforce is configured as a Service Provider in a SAML SSO flow, what must the Identity Provider include in the SAML assertion for the login to succeed?
  • What is OpenID Connect and how does it extend OAuth 2.0 to add an authentication layer?
  • How does Salesforce support OpenID Connect as both a provider and a consumer?
  • How does certificate-based authentication (mutual TLS) work in Salesforce, and when is it more appropriate than SAML or OAuth for system-to-system calls?
  • What is delegated authentication in Salesforce and how is it configured?
  • What are the key differences between delegated authentication and federated SSO, and in what circumstances would delegated authentication be the better choice?
  • What specific use cases make delegated authentication preferable over SAML SSO?
  • In SP-initiated SAML SSO, what happens when a user navigates directly to Salesforce without an existing IdP session? What is the relay state used for?
  • What does each of the three pillars of identity (authentication, authorization, and accountability) map to in terms of Salesforce platform features?
  • How do Salesforce Login Policies, Session Settings, and MFA configurations collectively address the authentication pillar of an identity solution?
  • How do profiles and permission sets address the authorization pillar of identity in Salesforce?
  • How do Connected App policies interact with profiles and permission sets to control the authorization pillar of identity?
  • Which Salesforce tools provide accountability (audit and monitoring) in an identity solution, and what specific events do they capture?
  • How does Salesforce My Domain work as a prerequisite for SSO and identity federation, and what does enabling My Domain change about authentication flows?
  • What role do digital certificates play in establishing trust in both SAML and OAuth integrations with Salesforce?
  • In a SAML SSO integration, how is trust established between Salesforce (as Service Provider) and an external Identity Provider, and what configuration artifacts are exchanged?
  • How does Salesforce validate the signature on an incoming SAML assertion, and what must be true about the certificate used by the Identity Provider?
  • Where are digital certificates configured for SAML and OAuth integrations in Salesforce?
  • What is the difference between signing and encryption in the context of SAML assertions?
  • When should an architect require encrypted SAML assertions?
  • In an OAuth flow where an external system calls Salesforce APIs, how is trust established via the Connected App consumer key and secret versus a JWT-based assertion?
  • What is SAML Single Logout (SLO), how does it differ from standard SSO logout, and what must be configured in Salesforce to support SLO?
  • What is Just-in-Time (JIT) provisioning in Salesforce and what SAML assertion attributes must be present to create or update a user via JIT?
  • A company wants newly hired employees to automatically receive a Salesforce user account the first time they attempt to log in via SSO. Which provisioning method should be recommended, and what are the required configuration steps?
  • What is the SCIM (System for Cross-domain Identity Management) standard, and how does Salesforce support inbound SCIM for automated user provisioning and deprovisioning from an external IdP?
  • How can custom Apex JIT handlers extend the default JIT provisioning behavior, and what use cases justify this approach?
  • A company needs to provision 50,000 employee users in Salesforce from Active Directory before go-live. What are the trade-offs between manual import, SCIM/Identity Connect, and JIT provisioning?
  • What are the limitations of JIT provisioning compared to pre-provisioning via Identity Connect, and when does pre-provisioning become necessary?
  • What does the Salesforce Login History report capture, and how can it be used to diagnose SSO login failures?
  • A user attempting SAML SSO receives an 'invalid_grant' or assertion validation error. What are the most common root causes and how would you diagnose each?
  • An OAuth refresh token stops working after 90 days. What configuration change causes this behavior, and what are the architectural options to handle long-lived server-to-server integrations?
  • How can the Salesforce SAML Validator tool be used to test an assertion before configuring live SSO, and what specific attributes does it validate?
  • What is the difference between a SAML login error at the SP level versus the IdP level, and how does the Salesforce Event Log File help distinguish between these two failure modes?
  • A SAML SSO login fails because the NotOnOrAfter timestamp in the assertion has passed. What causes this and how do you resolve it?
  • In what scenarios should Salesforce be configured as a SAML Service Provider rather than an Identity Provider, and what determines that distinction?
  • What is the Salesforce Entity ID and Assertion Consumer Service (ACS) URL, and how do they function when Salesforce is acting as an SP?
  • What is the role of the SAML Single Sign-On Settings page in Salesforce when Salesforce is acting as a Service Provider, and what values must be configured there?
  • A company has an enterprise SSO platform (e.g., Okta, Azure AD, Ping) that manages all employee identity. How should Salesforce be configured in relation to this platform?
  • What is the NameID format in a SAML assertion, how does Salesforce use it to match to a user record, and what happens when the NameID format is misconfigured?
  • What are the user account type differences between internal Salesforce users (B2E) and Experience Cloud external users (B2C/B2B), and how do these differences affect provisioning strategy?
  • What is the difference between user registration flows for self-registration on an Experience Cloud site versus enterprise-provisioned SSO, and how are these configured in Salesforce?
  • For a B2C scenario where customers register through an Experience Cloud site, what are the options for authenticating them against an external social or enterprise identity store?
  • A company needs to provision internal employees (B2E) from Active Directory into Salesforce and also support B2C customer registration for Experience Cloud. What provisioning strategy should be recommended for each population?
  • When should SCIM-based user provisioning be recommended over JIT provisioning for a B2E scenario, and what capabilities does SCIM add that JIT lacks?
  • What is an Authentication Provider in Salesforce, and how does it differ from a SAML Single Sign-On Setting when accepting third-party identity?
  • When should an architect recommend using an OpenID Connect (OIDC) Authentication Provider versus a SAML SSO configuration for accepting third-party identity?
  • A company wants employees to log in to Salesforce using their Azure AD credentials. Which Salesforce authentication configuration is most appropriate, and what specific protocol should be used?
  • What is social sign-on in the context of Experience Cloud, and how are social identity providers (Google, Facebook) configured as Authentication Providers?
  • An Experience Cloud site needs to support login via Google, Facebook, and a corporate SAML IdP. What Salesforce features enable this multi-IdP configuration?
  • What is the purpose of the 'User Provisioning' setting on a Salesforce Authentication Provider, and how does it interact with the Registration Handler class?
  • How can a custom Authentication Provider (using Apex) be used to integrate a non-standard identity store that does not support SAML or OpenID Connect?
  • What is the difference between federated identifier and username-based matching in SAML SSO, and when is each matching configuration appropriate?
  • How does the 'User.FederationIdentifier' field work in Salesforce, and how is it used to match a SAML subject to a Salesforce user?
  • What user attributes can be set or updated through JIT provisioning via SAML attributes, and how are profile and permission set assignments handled in JIT?
  • A company needs to map SAML group attributes from the IdP to Salesforce permission sets automatically. What mechanism supports this, and what are its constraints?
  • How does the Login History page in Salesforce help diagnose SSO failures, and what login status codes indicate authentication versus authorization failures?
  • What is the difference between the Login History object and the Event Log Files for auditing SSO events, and when would each be used for compliance reporting versus real-time troubleshooting?
  • What information is available in the Salesforce Event Monitoring logs that is relevant to SSO and identity events, and which specific event types should an architect monitor?
  • An IdP-initiated SSO flow is failing intermittently. What combination of Salesforce tools and IdP-side logs should an architect examine to pinpoint whether the problem is on the IdP side or the SP side?
  • What is the SAML Assertion Validator tool in Salesforce Setup, and what steps would an architect use to test a SAML integration before go-live?

Given a scenario, identify the most appropriate OAuth flow

0/12

  • What are the suitable use cases for the OAuth Web Server Flow versus the JWT Bearer Token Flow?
  • In the OAuth 2.0 Web Server Flow, what is the authorization code, how long is it valid, and why must it never be exposed to the end user's browser?
  • A server-side web application needs to access Salesforce APIs on behalf of a logged-in user. Which OAuth flow is most appropriate, and what are the steps in that flow?
  • What are the exact steps of the OAuth 2.0 JWT Bearer Token Flow in Salesforce, including what must be pre-configured, and why does this flow not require user interaction?
  • A headless integration script runs on a server nightly and must access Salesforce without user interaction. Why is the OAuth Web Server Flow inappropriate, and which flow should be used instead?
  • What is the OAuth 2.0 User-Agent Flow, when is it appropriate for single-page applications or mobile apps, and what are its security trade-offs compared to the Web Server Flow?
  • What is the OAuth 2.0 PKCE (Proof Key for Code Exchange) extension, and when should it be required for Salesforce Connected Apps serving mobile or SPA clients?
  • A Smart TV application needs to authenticate to Salesforce but cannot render a browser. Which OAuth flow is designed for input-constrained devices, and how does it work?
  • What is the OAuth 2.0 SAML Bearer Assertion Flow, and in what scenario would it be used to exchange a SAML assertion for a Salesforce OAuth access token?
  • What are the key differences between the OAuth Web Server Flow and the JWT Bearer Token Flow in terms of user involvement and token types returned?
  • What is the OAuth 2.0 Username-Password Flow, why is it considered insecure, and in what limited scenarios might it still be acceptable?
  • What is the OAuth 2.0 Hybrid Flow in Salesforce, and when would an architect choose it over the standard Web Server Flow?

Given a scenario, recommend appropriate Scope and Configuration of the Connected App for Authorization.

0/8

  • How does admin-approved connected app access work in Salesforce, and what is the difference between users self-authorizing and an admin pre-authorizing access for all users?
  • A Connected App must be restricted so only users with a specific profile can authorize it. What configuration options enforce this restriction?
  • A Connected App is being created for a mobile application that requires access to the Salesforce REST API and OpenID Connect user profile claims. Which OAuth scopes are required?
  • What is the purpose of the 'refresh_token' and 'offline_access' OAuth scopes in Salesforce Connected Apps, and when should each be used?
  • What is the purpose of the 'Require Secret for Web Server Flow' and 'Require Secret for Refresh Token Flow' settings on a Connected App, and when should they be enabled?
  • What is the difference between the 'api' and 'full' OAuth scopes in Salesforce Connected Apps, and when should each be used?
  • How do the 'Permitted Users' and 'IP Relaxation' settings on a Connected App affect security, and what is the recommended configuration for an internal enterprise integration versus a public consumer app?
  • What is certificate-based client authentication for a Connected App, and how does configuring a digital certificate on a Connected App replace the consumer secret for server-to-server integrations?

Describe the various implementation concepts of OAuth

0/8

What is an ID token in OpenID Connect and how does it differ from an access token?

Learn this concept
Unseen

How does Salesforce manage access token and refresh token lifetimes?

Learn this concept
Unseen

How can an access token be revoked in Salesforce, and what happens to active sessions and refresh tokens when a Connected App authorization is revoked?

Learn this concept
Unseen

What are the risks of exposing the consumer secret for a Connected App?

Learn this concept
Unseen

What are the security implications of storing OAuth refresh tokens in a mobile app versus a server-side system, and how should Connected App policies differ for each?

Learn this concept
Unseen

When would an architect use the Salesforce /introspect endpoint versus the /userinfo endpoint?

Learn this concept
Unseen

What is a refresh token in OAuth and how can its lifetime be configured in Salesforce Connected App policies? What happens if refresh token rotation is enabled?

Learn this concept
Unseen

How does token introspection work in Salesforce OAuth?

Learn this concept
Unseen

Given a scenario, recommend the Salesforce technologies that should be used to provide identity to the third-party system

0/7

  • When Salesforce acts as a SAML IdP to a third-party SP, what must be configured in Salesforce (Connected App as SAML SP) and what metadata does Salesforce provide to the SP?
  • How does the Salesforce App Launcher work as an identity federation mechanism, and what must be configured for users to access a third-party app via SAML from App Launcher?
  • A company wants users to access multiple third-party SaaS apps (Slack, Jira, etc.) via Salesforce-initiated SSO. What Salesforce feature enables outbound SAML SSO, and what are the configuration requirements?
  • What is Salesforce Canvas, and how does it use OAuth to pass identity context (signed request) to an embedded third-party application?
  • A company wants to embed an external web application inside Salesforce and pass the current user's identity to that application. What Salesforce technology enables this, and how does trust work?
  • What are Named Credentials and External Credentials in Salesforce, and how do they simplify the management of OAuth tokens and secrets for outbound API callouts?
  • What is the difference between Named Principal and Per-User principal authentication in External Credentials, and when would each be used for outbound API authentication?
  • What are the MFA verification methods supported by Salesforce?
  • What is the difference between the Salesforce Authenticator app, TOTP authenticator apps, and hardware security keys (WebAuthn/U2F) as MFA factors?
  • What are the trade-offs of each MFA factor type (Authenticator app, TOTP, hardware keys)?
  • What determines which MFA method is most appropriate for a given user population?
  • How do high-assurance sessions differ from standard sessions in Salesforce, and what triggers a session to be classified as high-assurance?
  • What is the 'MFA for all direct UI logins' enforcement in Salesforce, and how does it interact with SSO where the IdP handles MFA? Is there a risk of double MFA prompts?
  • When SSO is used for authentication, who is responsible for enforcing MFA — Salesforce or the Identity Provider — and what are the implications for Salesforce's MFA requirement?
  • How can Session Security Levels and Session-Based Permission Sets be used together to gate access to sensitive features behind an MFA step-up challenge?
  • A company requires that users accessing a sensitive Permission Set Group must complete MFA each session, even if they already logged in with SSO. How is this enforced in Salesforce?
  • How does Salesforce support built-in authenticators (biometrics, platform authenticators via WebAuthn), and what configuration is required to allow users to register this MFA factor?
  • How does the Salesforce Authenticator app's 'trusted location' and 'push notification' feature work, and what security risk does automatic trust introduce?
  • What is the difference between org-wide MFA enforcement and profile- or permission-set-based MFA enforcement in Salesforce, and which takes precedence?
  • During JIT provisioning, how are profile and permission set assignments determined, and what happens if the JIT assertion does not include profile information?
  • What Salesforce features allow permission set assignments to be automatically updated when a user's SAML attributes change at subsequent logins (not just initial provisioning)?
  • A company's HR system is the source of truth for Salesforce role assignments. After users are provisioned via SSO, role changes in the HR system must sync automatically. What options exist and what are their trade-offs?
  • How does the custom Apex JIT handler enable complex access-rights assignment logic that the standard JIT provisioning attribute mapping cannot handle?
  • What is Event Monitoring in Salesforce and what identity-related event types does it capture that are useful for security auditing?
  • What is the difference between the Setup Audit Trail and Event Monitoring for auditing administrative identity changes, and when would each be used?
  • What is the Identity Verification History in Salesforce, what events does it record, and how does it differ from Login History for auditing identity verification events?
  • A company must demonstrate that no unauthorized access occurred during a security incident. Which Salesforce audit tools provide tamper-evident records of user login and data access activity?
  • How can Transaction Security Policies be used to detect and respond to anomalous login behavior in real time, and what actions can they trigger?
  • How can Salesforce Shield's Event Monitoring and Field Audit Trail be combined to provide a complete picture of 'who accessed what and when' for compliance purposes?
  • What are the key Connected App settings that control OAuth behavior: Callback URL, OAuth Scopes, Consumer Key/Secret, and how does each setting impact security?
  • What is the 'Permitted Users' setting on a Connected App, and what is the difference between 'All users may self-authorize' and 'Admin-approved users are pre-authorized'?
  • How can a Connected App be configured to enable SAML assertions for SP-initiated SSO when Salesforce acts as the Identity Provider?
  • How do session policies on a Connected App (session timeout, session level) override org-level session settings, and what are the use cases for app-specific session policies?
  • What is My Domain login policy and what is the difference between 'Redirect' and 'Prevent login from https://login.salesforce.com', and when should each option be selected?
  • How do profile-level login hours and login IP ranges work in Salesforce?
  • How do profile-level login restrictions differ from org-level network access restrictions, and what happens when both are configured?
  • What are password policies in Salesforce and where are they configured (org level vs. profile level)?
  • How do password policies interact with SSO environments where Salesforce passwords may never be used?
  • What identity-related use cases does a Login Flow enable (e.g., step-up authentication, custom MFA, terms of service acceptance)?
  • What is a Salesforce Login Flow and how is it associated with a Connected App or profile?
  • What is the Connected App 'Start URL' setting and when is it used versus the relay state parameter in SSO flows?
  • How does the 'IP Relaxation' setting on a Connected App interact with org-level IP restrictions, and what are the security risks of setting it to 'Relax IP restrictions'?
  • What is Salesforce Identity Connect, and what role does it play in synchronizing users from Microsoft Active Directory to Salesforce?
  • What are the architectural components of Identity Connect (directory agent, Salesforce org, AD/LDAP)?
  • What are the key limitations of Identity Connect compared to a full SCIM integration or a custom middleware solution for AD-to-Salesforce provisioning?
  • A company already has Okta managing identity and provisioning to Salesforce via SCIM. Is there a use case for Identity Connect in this architecture, or are the two tools redundant?
  • What is Salesforce Customer 360 Identity (now Salesforce Identity for Customers) and in what scenarios does it provide identity management capabilities for cross-cloud customer experiences?
  • What role does a single canonical customer identity play in a Customer 360 architecture, and what challenges arise when identity is siloed across multiple Salesforce clouds?
  • What is the difference between managing B2B partner identities, B2C customer identities, and B2E employee identities in Salesforce?
  • What license and identity features differ across B2B, B2C, and B2E user populations in Salesforce?
  • A company has both a Service Cloud org for support and an Experience Cloud site for self-service. Customers should have one login identity shared across both. How does Customer 360 Identity (or an equivalent architecture) solve this?
  • What is the difference between the Salesforce Identity license and the standard Salesforce license in terms of feature access, and when is an Identity license sufficient?
  • When should an External Identity license be used versus an Experience Cloud Customer Community license, and what are the feature and cost differences?
  • A company has employees who only need SSO access to Salesforce as a hub to launch other apps (App Launcher) but do not use CRM features. What is the most appropriate Salesforce license?
  • A company needs 10,000 external partners to log in to an Experience Cloud site and view cases and knowledge articles. What license type is most cost-effective and appropriate?
  • What branding and authentication customization capabilities are available on Experience Cloud login pages?
  • How are custom login pages configured for Experience Cloud?
  • How can multiple authentication providers (SAML, OIDC, social) be presented on the Experience Cloud login page, and what controls determine their ordering and display?
  • What is the self-registration flow in Experience Cloud?
  • What must be configured to automatically create a Contact and User record when a customer self-registers?
  • What email communications are generated by Experience Cloud for user management events (welcome email, password reset, verification)?
  • How are Experience Cloud email templates for user management events customized?
  • How does identity verification work in Experience Cloud for password reset flows?
  • What options exist for customizing the identity verification experience?
  • What are the options for configuring the password reset experience in an Experience Cloud site, and how can an architect prevent unauthorized account enumeration through the reset flow?
  • What is the person account versus contact/account user model in Experience Cloud, and how does this choice affect the identity and SSO configuration?
  • How does the Experience Cloud user model (user tied to Contact/Account) affect access to records and data, and what sharing considerations arise when external users are provisioned via SSO?
  • What is a Registration Handler in Salesforce Authentication Providers, and how can it be customized to control user matching, creation, and attribute mapping for Experience Cloud logins?
  • An Experience Cloud site needs to allow customers to log in using a corporate SAML IdP. The customers already have Contact records in Salesforce. How should the user/contact model be configured for this scenario?
  • When a customer logs in to Experience Cloud via a third-party IdP (e.g., Google) for the first time, how can the platform be configured to match the incoming identity to an existing Contact record rather than creating a duplicate?
  • A partner org uses Salesforce and wants its users to SSO into a vendor's Experience Cloud site without re-entering credentials. What configuration is required on both orgs, and which org acts as the IdP?
  • What features are included with the External Identity license?
  • What are the limits and constraints of the External Identity license in terms of CRM object access, API access, and customization capabilities?
  • What features require a higher-tier Experience Cloud license (e.g., Customer Community, Partner Community)?
  • A company wants external customers to log in via Experience Cloud and access Salesforce Knowledge articles. Is the External Identity license sufficient, or is a higher license required?
  • A company needs partners to log in to an Experience Cloud site, access their Opportunity and Case records, and collaborate with the internal team. What license type is required and why is External Identity insufficient?
  • A company has a branded marketing website and wants users to authenticate with their Experience Cloud identity without leaving the marketing site. What Salesforce feature enables this, and what are the configuration requirements?
  • What are the security considerations and CORS configuration requirements for deploying Embedded Login on an external domain?
  • What is Embedded Login in Salesforce Experience Cloud, and in what scenarios is it the right choice over a standard redirect to the community login page?
  • How is Embedded Login technically implemented (e.g., Visualforce, Lightning Web Components, or a Salesforce-provided JavaScript library), and what OAuth flow does it use under the hood?

Prepare for the Exam

Play Today's Certle
Back to track

Study Community

Ask questions and get the latest info from other Platform Identity and Access Management Architect studiers.

Go to Discord

When would an architect use the Salesforce /introspect endpoint versus the /userinfo endpoint?

Explainer

Learn More

Practice Question

Keep going

Next conceptWhat is a refresh token in OAuth and how can its lifetime be configured in Salesforce Connected App policies? What happens if refresh token rotation is enabled?

Checklist progress

0/174 (0%)

0 of 174 concepts learned

Tip: You can filter concepts by status.

Prepare for the Exam

Play Today's Certle
Back to track

Study Community

Ask questions and get the latest info from other Platform Identity and Access Management Architect studiers.

Go to Discord

Explainer

When Salesforce acts as a service provider in an OAuth 2.0 token exchange flow, an Apex token exchange handler must validate incoming tokens from an external identity provider. For opaque access tokens and refresh tokens that cannot be validated locally, the handler calls out to either the identity provider's /introspect or /userinfo endpoint to verify the token and retrieve user information.

Core information
  • The OAuth 2.0 token exchange flow allows Salesforce to integrate with a primary application and central identity provider where users log in via the identity provider and access Salesforce data through a token exchange handler.
More details and nuances
  • The validateIncomingToken method receives the token type as an Auth.OAuth2TokenExchangeType enum parameter, which determines whether to call introspect/user info endpoints (for ACCESS_TOKEN or REFRESH_TOKEN) or use JWT validation methods (for JWT or ID_TOKEN).