# Platform Identity and Client Management

*MuleSoft Platform Architect Study Guide · Establishing organizational and platform foundations · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/establishing-organizational-and-platform-foundations/platform-identity-and-client-management*

Separate organization-user SSO from API-consumer registration, then configure federation, provisioning and OIDC client-provider capabilities in their proper scopes.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Establishing organizational and platform foundations
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Compare and contrast Identity Management and Client Management options on Anypoint Platform.

## What the exam expects

- Distinguish Anypoint user sign-in from registration of API consumer applications.
- Choose Identity Management or Client Management for the identity being managed.
- Explain organization scope and the provisioning route for external SSO users.
- Identify the provider capabilities required for OIDC client management.

**Identity Management** configures user SSO; **Client Management** manages API consumers; an **IdP** provides identity services; **dynamic client registration** creates a consumer registration; **introspection** checks tokens through the provider ([User identity](https://docs.mulesoft.com/access-management/external-identity), [Client management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| User identity | Identity Management configures organization-user SSO. | [User identity](https://docs.mulesoft.com/access-management/external-identity) |
| SSO standards | OIDC and SAML 2.0 are supported user-federation options. | [User identity](https://docs.mulesoft.com/access-management/external-identity) |
| Scope | Root-organization identity configuration applies across business groups. | [User identity](https://docs.mulesoft.com/access-management/external-identity) |
| Invitations | Invite User stores credentials with the native identity provider. | [User identity](https://docs.mulesoft.com/access-management/external-identity) |
| Consumer registration | API portals dynamically register clients with the configured external IdP. | [Client management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task) |
| Provider checks | Dynamic registration and introspection are separate required capabilities. | [Client management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task) |
| Matching names | Same-username SSO and existing users coexist independently. | [User identity](https://docs.mulesoft.com/access-management/external-identity) |
| Attribute mapping | Configure matching attribute names on both sides. | [User identity](https://docs.mulesoft.com/access-management/external-identity) |
| Existing SSO client | Use the manual user-SSO procedure when Anypoint is already registered. | [OIDC user setup](https://docs.mulesoft.com/access-management/conf-openid-connect-task) |

## Check yourself

- Why does a matching username not prove an SSO login is using the original Anypoint account?
- When an IdP attribute carries the expected value under a different configured name, what must be aligned?
- When Anypoint already exists as a client application in the IdP, which user-SSO registration procedure applies?

## Sources

- [Configuring Identity Management in Anypoint Platform](https://docs.mulesoft.com/access-management/external-identity)
- [Configuring OpenID Connect Client Management in Anypoint Platform](https://docs.mulesoft.com/access-management/configure-client-management-openid-task)
- [Configuring OpenID Connect Identity Management in Anypoint Platform](https://docs.mulesoft.com/access-management/conf-openid-connect-task)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams