# Securing shopper and business user access

*B2C Solution Architect Study Guide · Integration · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/b2c-solution-architect/integration/securing-shopper-and-business-user-access*

Which controls secure Business Manager users, API clients, storefront shoppers, service-org users and Marketing Cloud Engagement data across a B2C solution, and what each control does and doesn't protect against.

- Certification: Salesforce B2C Solution Architect
- Exam section: Integration
- Study guide: https://www.certifyforce.com/study-guide/b2c-solution-architect

**Official exam objective:**

> Given a B2C use case, recommend features and approaches that ensure security for both customers and internal business users while complying with regional and local legal requirements.

## What the exam expects

- Secure Business Manager users and API clients: IP lists, Unified Authentication, session and password settings, site- and locale-scoped roles.
- Protect shoppers and the storefront: password-protected sites, customer lockout, eCDN firewall and WAF, SLAS client type, payment data retention.
- Secure the service org for B2C service: record-view audit evidence, Experience Cloud sharing sets and the MFA requirement.
- Protect sensitive data in Engagement and outbound Commerce calls: PGP file decryption, Tokenized Sending and keystore certificates.

Key terms:
- **Business Manager:** the B2C Commerce administration application for merchants and administrators.
- **Unified Authentication:** Business Manager login with Account Manager credentials, where Account Manager runs password and login policy.
- **SLAS:** Shopper Login and API Access Service, which issues shopper tokens; a private client keeps its secret on a server.
- **Sharing set:** an Experience Cloud setting that gives site users access to records tied to their own account or contact.
- **Tokenized Sending:** an Engagement feature that stores tokens instead of sensitive contact data and resolves them at send time.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Allowlist without the block option | Other addresses can still log in | [IP Settings](https://help.salesforce.com/s/articleView?id=cc.b2c_ip_address_settings.htm&type=5&language=en_US) |
| Business Manager idle logout | 15 minutes, can't be changed | [Login Settings](https://help.salesforce.com/s/articleView?id=cc.b2c_login_settings.htm&type=5&language=en_US) |
| Password policy under Unified Authentication | Set in Account Manager | [User Authentication](https://help.salesforce.com/s/articleView?id=cc.b2c_user_authentication.htm&type=5&language=en_US) |
| Static content after enabling protection | Valid until it expires unless the cache is invalidated | [Password Protection](https://help.salesforce.com/s/articleView?id=cc.b2c_storefront_password_protection.htm&type=5&language=en_US) |
| Payment instruments | Masked after retention, default 12 months | [Secure Storage](https://help.salesforce.com/s/articleView?id=cc.b2c_secure_storage.htm&type=5&language=en_US) |
| SLAS client with a BFF | Private client, secret on the server | [SLAS Best Practices](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-best-practices.html) |
| Sharing sets per profile | One; applies across all the user's sites | [Sharing Sets](https://help.salesforce.com/s/articleView?id=platform.networks_setting_light_users.htm&type=5&language=en_US) |
| MFA scope | Internal UI users in production and sandboxes; not API logins or external users | [MFA Requirements](https://help.salesforce.com/s/articleView?id=xcloud.mfa_understand_requirements.htm&type=5&language=en_US) |
| Private CA for outbound TLS | Import as TrustedCertificateEntry | [Keys and Certificates](https://help.salesforce.com/s/articleView?id=cc.b2c_certificates_and_private_keys.htm&type=5&language=en_US) |

## Check yourself

- When does Business Manager send the first warning before deactivating an unused local account?
- Why keep the old key after re-encrypting data at rest with a new one?
- What load must a Tokenized Sending resolver handle?
- When does Enforce Password History start remembering Business Manager passwords?

## Sources

- [Configure Business Manager IP Address Settings](https://help.salesforce.com/s/articleView?id=cc.b2c_ip_address_settings.htm&type=5&language=en_US)
- [User Authentication for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_user_authentication.htm&type=5&language=en_US)
- [Business Manager Login Settings](https://help.salesforce.com/s/articleView?id=cc.b2c_login_settings.htm&type=5&language=en_US)
- [Introduction to Roles in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_introduction_to_roles.htm&type=5&language=en_US)
- [Administrator Role and Permissions in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_administrator_role.htm&type=5&language=en_US)
- [Storefront Password Protection](https://help.salesforce.com/s/articleView?id=cc.b2c_storefront_password_protection.htm&type=5&language=en_US)
- [Secure Storage in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_secure_storage.htm&type=5&language=en_US)
- [Private Keys and Certificates in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_certificates_and_private_keys.htm&type=5&language=en_US)
- [Customer Lists Preferences for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_customer_lists_preferences.htm&type=5&language=en_US)
- [Storefront Network Access in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_storefront_network_access.htm&type=5&language=en_US)
- [SLAS Best Practices](https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/slas-best-practices.html)
- [Lightning Page View Event Type](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_lightningpageview.htm)
- [Create a Sharing Set for Experience Cloud Site Users](https://help.salesforce.com/s/articleView?id=platform.networks_setting_light_users.htm&type=5&language=en_US)
- [Understand MFA Requirements](https://help.salesforce.com/s/articleView?id=xcloud.mfa_understand_requirements.htm&type=5&language=en_US)
- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US)
- [Use a Created Key with File Transfer Activities](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_use_a_created_key_with_file_transfer_activities.htm&type=5&language=en_US)
- [Tokenized Sending](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_tokenized_sending1.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the B2C Solution Architect pack (USD $19): https://www.certifyforce.com/practice-exams