# Identity Connect role and retirement migration

*Platform Identity and Access Management Architect Study Guide · Salesforce Identity · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/salesforce-identity/identity-connect-role-and-retirement-migration*

What Identity Connect did (push provisioning from Active Directory to Salesforce, immediate session revocation, optional SSO from a customer-hosted server), why it is being retired with no replacement, what stops when a subscription ends, and how to scope, replace and decommission it.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Salesforce Identity
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a set of requirements, identify the role Identity Connect plays in a Salesforce Identity implementation.

## What the exam expects

- Describe the role Identity Connect plays in an existing implementation: Active Directory (AD) to Salesforce push provisioning, immediate session revocation on deprovisioning, and optional single sign-on (SSO).
- Describe how it is deployed: a customer-hosted Windows or Linux service, a dedicated integration user, and paid permission set licenses.
- Recognize that Identity Connect is being retired (security updates only) with no Salesforce replacement, and never recommend it for a new implementation.
- Plan a migration: discovery, choosing a replacement (Microsoft's connector, an existing provisioning product, a marketplace tool or SCIM), explaining why Just-in-Time (JIT) provisioning is not like-for-like, and decommissioning.
- Key terms: **Identity Connect** (Salesforce's AD-to-Salesforce provisioning and SSO service, now being retired); **push provisioning** (the directory sends changes as they happen); **JIT provisioning** (Salesforce creates or updates the user at SAML login); **SCIM** (open standard REST API for provisioning user identities); **integration user** (the Salesforce user record Identity Connect uses to apply AD changes).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Direction of sync | AD to Salesforce; updates pushed "instantaneously" | [Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_about.htm&language=en_US&type=5) |
| Deprovisioning | The user's Salesforce session is revoked immediately | [Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_about.htm&language=en_US&type=5) |
| Where it runs | A service on a customer Windows or Linux server | [Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_about.htm&language=en_US&type=5) |
| Editions | Additional cost in Enterprise, Performance, Unlimited; 10 licenses in Developer Edition | [Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_about.htm&language=en_US&type=5) |
| Integration user | Created before install; use it only for Identity Connect | [Install Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_install.htm&language=en_US&type=5) |
| Retirement status | Security updates only; no replacement from Salesforce | [Identity Connect Retirement](https://help.salesforce.com/s/articleView?id=000390663&language=en_US&type=1) |
| Affected users | Users assigned the Identity Connect user permission set | [Identity Connect Retirement](https://help.salesforce.com/s/articleView?id=000390663&language=en_US&type=1) |
| After the order ends | No new provisioning, no updates to existing users, SSO through it stops | [Identity Connect Retirement](https://help.salesforce.com/s/articleView?id=000390663&language=en_US&type=1) |
| JIT timing | Creates or updates users only when they log in with SAML | [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5) |
| SCIM | All editions; REST operations with an OAuth 2.0 access token | [Manage Salesforce User Identities with SCIM](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_overview.htm&language=en_US&type=5) |

## Check yourself

- Why can't standard SAML JIT provisioning meet a requirement to end access the moment AD deprovisions a user?
- When does Salesforce point a customer to Microsoft's connector as the replacement?
- Which users does the retirement affect?
- Where does Identity Connect run?

## Sources

- [Identity Connect Retirement](https://help.salesforce.com/s/articleView?id=000390663&language=en_US&type=1)
- [Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_about.htm&language=en_US&type=5)
- [Install Identity Connect](https://help.salesforce.com/s/articleView?id=xcloud.identityconnect_install.htm&language=en_US&type=5)
- [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5)
- [Manage Salesforce User Identities with SCIM](https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_overview.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams