# Configuring Salesforce as a SAML service provider

*Platform Identity and Access Management Architect Study Guide · Accepting Third-Party Identity in Salesforce · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/accepting-third-party-identity-in-salesforce/configuring-salesforce-as-a-saml-service-provider*

When Salesforce trusts a third-party identity provider, how the SAML single sign-on setting maps users and validates signatures, how to route users to one of several IdPs, how to require SSO without locking admins out, and how SAML single logout and sandbox refreshes behave.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Accepting Third-Party Identity in Salesforce
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a use case, describe when Salesforce is used as a Service Provider.

## What the exam expects

- Tell when Salesforce is the service provider (or relying party) and when it is the identity provider.
- Configure a SAML single sign-on setting: Issuer, Entity ID, certificates, SAML Identity Type and Location, binding, signature method and URLs.
- Support several identity providers with one setting each and Login Discovery routing.
- Require SSO for employees while keeping a break-glass path for admins, and send users straight to the IdP from My Domain.
- Configure SAML single logout and recover SAML after a sandbox refresh.

Key terms: **service provider** (the system that trusts another to authenticate users); **identity provider** (the system that authenticates them); **SAML single sign-on setting** (Salesforce's record of one trusted IdP); **Federation ID** (the User field that holds the IdP's identifier for a user); **front-channel SLO** (logout redirects in the user's own browser).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| SP vs IdP | The system that trusts another to authenticate users is the service provider | [Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_about.htm&language=en_US&type=5) |
| Issuer and Entity ID | Must match `<saml:Issuer>` and one `<saml:Audience>` | [Create a SAML SSO Setting](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5) |
| Assertion subject | The error page says username or Federation ID; the setting's Identity Type can also be User ID, read from the Subject or an Attribute | [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5) |
| Signature check | Response signature first; if missing or invalid, the assertion signature | [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US&type=5) |
| Login Discovery | Apex `MyDomainLoginDiscoveryHandler`; Login Page Type Discovery | [My Domain Login Discovery](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_login_discovery.htm&language=en_US&type=5) |
| Disable login with Salesforce credentials | Applies only to users with Is Single Sign-On Enabled | [Require SSO](https://help.salesforce.com/s/articleView?id=xcloud.sso_enforce_sso_login.htm&language=en_US&type=5) |
| Break-glass URL | My Domain URL plus `?login` or `?login=true` | [FAQs for Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_tips.htm&language=en_US&type=5) |
| SAML SLO | Front-channel only; same browser | [SAML SLO as Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_slo_saml_sp_configuring.htm&language=en_US&type=5) |
| Sandbox refresh | SAML disabled, configuration kept except the Salesforce Login URL | [FAQs for Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_tips.htm&language=en_US&type=5) |

## Check yourself

- Why can one SAML single sign-on setting not serve two different identity providers?
- When does Disable login with Salesforce credentials stop a user from logging in with a password?
- When SAML SSO stops working in a freshly refreshed sandbox, what is the first fix?

## Sources

- [Configure SSO with Salesforce as a SAML Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml.htm&language=en_US&type=5)
- [Step 2: Create a SAML Single Sign-On Setting in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5)
- [Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_about.htm&language=en_US&type=5)
- [SAML Single Sign-On Flows](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US&type=5)
- [Step 3: Share Your SAML SSO Configuration with Your Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_sp_endpoints.htm&language=en_US&type=5)
- [Configure SAML SSO Between Salesforce Orgs or Experience Cloud Sites](https://help.salesforce.com/s/articleView?id=xcloud.sso_between_multiple_orgs.htm&language=en_US&type=5)
- [Create an Interview-Based Login Page with My Domain Login Discovery](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_login_discovery.htm&language=en_US&type=5)
- [Require Users to Log In with Single Sign-On (SSO)](https://help.salesforce.com/s/articleView?id=xcloud.sso_enforce_sso_login.htm&language=en_US&type=5)
- [FAQs for Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_tips.htm&language=en_US&type=5)
- [Configure SAML Single Logout with Salesforce as the Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_slo_saml_sp_configuring.htm&language=en_US&type=5)
- [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5)
- [Configure Your Experience Cloud Site as a Service Provider or Relying Party](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_sp.htm&language=en_US&type=5)
- [Set Up Single Sign-On for Your Internal Users (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/identity_login/identity_login_sso)
- [Customize Salesforce Login with My Domain (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/identity_login/identity_login_my_domain)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams