# Authentication, authorization and accountability building blocks

*Platform Identity and Access Management Architect Study Guide · Identity Management Concepts · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/identity-management-concepts/authentication-authorization-and-accountability-building-blocks*

Map identity requirements to authentication (who the user is), authorization (OAuth scopes limited by the user's own access) and accountability (Setup Audit Trail, login and verification history, field history and Field Audit Trail), and know each audit tool's retention.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Identity Management Concepts
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Describe the building blocks that are part of an identity solution (authentication, authorization, accountability) and how to enable.

## What the exam expects

- Sort a list of requirements into authentication, authorization and accountability, and name the Salesforce feature that enables each.
- Explain what limits the data an OAuth client can reach: the scopes granted to it and the authorizing user's own object, field and record access.
- Choose the right audit record (Setup Audit Trail, Login History, Identity Verification History, field history) for a "who did what" question.
- Meet long retention requirements: archive SetupAuditTrail through the API, and use Field Audit Trail for field history.
- Make handler-created records traceable with a dedicated Execute Registration As user.

Key terms: **authentication** (who a person is); **authorization** (what a person can do); **accountability** (tracing who changed or did what, and when); **scope** (the kind of protected resource a token can reach); **Setup Audit Trail** (history of setup changes); **Field Audit Trail** (field history kept until deleted).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Setup Audit Trail page | 20 most recent changes; download covers 180 days | [Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5) |
| Setup Audit Trail retention | Records deleted after 180 days | [Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5) |
| SetupAuditTrail object | Supports query() and retrieve(); no aggregate count(Id) | [SetupAuditTrail](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_setupaudittrail.htm) |
| Login History | Past 6 months; All Logins download includes API logins | [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5) |
| Identity Verification History | Up to 20,000 attempts from the past 6 months | [Identity Verification History](https://help.salesforce.com/s/articleView?id=xcloud.security_verification_history.htm&language=en_US&type=5) |
| Field history retention | 18 months, 24 via the API; until deleted with Field Audit Trail | [Field History Tracking](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5) |
| Field Audit Trail licensing | Salesforce Shield or Field Audit Trail licenses | [Field Audit Trail](https://help.salesforce.com/s/articleView?id=xcloud.field_audit_trail.htm&language=en_US&type=5) |
| full scope | All data the logged-in user can access; no refresh token unless requested | [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5) |
| Execute Registration As | Needs Manage Users; use a dedicated system user in production | [OpenID Connect Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5) |

## Check yourself

- Why can't the `full` scope expose records the authorizing user can't see?
- When should you query the SetupAuditTrail object instead of downloading the audit trail?
- Where do you see that a user denied and flagged a Salesforce Authenticator request?
- Why does a ten-year field retention rule need Field Audit Trail?

## Sources

- [Learn the Language of Identity](https://trailhead.salesforce.com/content/learn/modules/identity_basics/identity_basics_protocols)
- [Monitor Setup Changes with Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5)
- [SetupAuditTrail](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_setupaudittrail.htm)
- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&language=en_US&type=5)
- [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5)
- [Monitor Identity Verification History](https://help.salesforce.com/s/articleView?id=xcloud.security_verification_history.htm&language=en_US&type=5)
- [Field History Tracking](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5)
- [Field Audit Trail](https://help.salesforce.com/s/articleView?id=xcloud.field_audit_trail.htm&language=en_US&type=5)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)
- [Single Sign-On Terminology](https://help.salesforce.com/s/articleView?id=xcloud.sso_terminology.htm&language=en_US&type=5)
- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams