# External IdPs and external user models on sites

*Platform Identity and Access Management Architect Study Guide · Community (Partner and Customer) · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/community-partner-and-customer/external-idps-and-external-user-models-on-sites*

How an Experience Cloud site accepts outside identity (SAML service provider with site endpoints, authentication providers as relying party, Login Discovery routing to partner IdPs) and how to pick the account and contact model behind each external user: business contact, partner account, person account or contactless user.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Community (Partner and Customer)
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a set of requirements, determine the best way to support external IdPs in communities and leverage the right user/contact model to support community user experience.

## What the exam expects

- Choose SAML (site as service provider) or an authentication provider (site as relying party) for an external IdP, and route users to partner IdPs from a Login Discovery page.
- Configure a site SAML setting: For Communities endpoints, primary URL, unique Entity ID, Recipient with `sc`, login-page options, employees logging in on the site.
- Branch provisioning logic per site or entry point: `communityId` in a Custom SAML JIT handler, `expid` for authentication provider registration.
- Pick the account and contact model for external users: business account contact, partner-enabled account, person account or contactless user.

Key terms: **service provider** (the site trusts a SAML IdP's assertion); **relying party** (the site trusts an OpenID Connect or OAuth provider through an authentication provider); **For Communities endpoints** (per-site SAML URLs Salesforce generates); **contactless user** (External Identity user with no contact record); **person account** (one record merging account and contact for B2C).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| SAML vs auth provider | SAML for SSO only; auth provider for SSO plus third-party data | [Site as SP or Relying Party](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_sp.htm&language=en_US&type=5) |
| Site endpoints | For Communities section; primary URL only | [Share Your SAML Configuration](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_sp_endpoints.htm&language=en_US&type=5) |
| Entity ID | Unique per org, starts with https; generally the site URL | [JIT Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| Encrypted assertions | Recipient adds `&sc=<certificate ID>` | [JIT Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5) |
| Employees on a site | Allow employees to log in directly to an Experience Cloud site | [Add SSO Providers to the Login Page](https://help.salesforce.com/s/articleView?id=xcloud.sso_sp_test_connection.htm&language=en_US&type=5) |
| JIT handler per site | Branch on `communityId`; handler creates account and contact | [SamlJitHandler](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_SamlJitHandler.htm) |
| Registration handler | Salesforce inserts a returned new User; `updateUser` on repeat logins | [RegistrationHandler](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm) |
| Entry-point branching | `expid` on the Single Sign-On Initialization URL | [Authentication Provider User Experience](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_expid.htm&language=en_US&type=5) |
| Partner self-registration | Account must be enabled as partner | [Self-Registration Apex Controller](https://help.salesforce.com/s/articleView?id=experience.networks_self_reg_apex.htm&language=en_US&type=5) |
| Contactless limits | External Identity only; no Login As, delegated admin or SCIM create | [Create Contactless Users](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_manage_create_contactless_users.htm&language=en_US&type=5) |

## Check yourself

- Why must a site's SAML setting usually use the site URL as Entity ID?
- When does the site need an authentication provider rather than SAML?
- Which parameter lets one registration handler run different logic for two microsites?
- Why can't support agents use Login As on a contactless user?

## Sources

- [Configure Your Experience Cloud Site as a Service Provider or Relying Party](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_sp.htm&language=en_US&type=5)
- [Step 2: Create a SAML Single Sign-On Setting in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_service_provider_configuration.htm&language=en_US&type=5)
- [Step 3: Share Your SAML SSO Configuration with Your Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_sp_endpoints.htm&language=en_US&type=5)
- [Step 4: Add Single Sign-On Providers to the Login Page and Test the SSO Connection](https://help.salesforce.com/s/articleView?id=xcloud.sso_sp_test_connection.htm&language=en_US&type=5)
- [Just-in-Time SAML Assertion Fields for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_community_requirements.htm&language=en_US&type=5)
- [SamlJitHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_SamlJitHandler.htm)
- [Authentication Provider SSO](https://help.salesforce.com/s/articleView?id=xcloud.sso_authentication_providers.htm&language=en_US&type=5)
- [Control Your Authentication Provider User Experience](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params_expid.htm&language=en_US&type=5)
- [RegistrationHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_auth_plugin.htm)
- [LoginDiscoveryHandler Interface](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_interface_Auth_LoginDiscoveryHandler.htm)
- [Use the Configurable Self-Reg Page for Easy Sign-Up](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_discovery_create_config_self.htm&language=en_US&type=5)
- [Configure Person Accounts for Self-Registration](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_self_registration_person_accounts.htm&language=en_US&type=5)
- [Customize the Self-Registration Apex Controller](https://help.salesforce.com/s/articleView?id=experience.networks_self_reg_apex.htm&language=en_US&type=5)
- [Create Lightweight Contactless Users](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_manage_create_contactless_users.htm&language=en_US&type=5)
- [Manage Sites with Contactless Users](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_contactless_users_use_cases.htm&language=en_US&type=5)
- [Experience Cloud User Licenses](https://help.salesforce.com/s/articleView?id=platform.users_license_types_communities.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 16 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams