# Platform identity, MFA, teams and connected apps

*MuleSoft Platform Integration Architect Study Guide · Designing integration solutions to meet security requirements · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect/designing-integration-solutions-to-meet-security-requirements/platform-identity-mfa-teams-and-connected-apps*

How Anypoint Platform secures access to its control plane: multi-factor authentication for direct and SSO sign-ins, business groups and Organization Administrator inheritance, cascading team permissions, and connected apps with the right type, grant, audience and least-privilege scopes.

- Certification: Salesforce MuleSoft Platform Integration Architect
- Exam section: Designing integration solutions to meet security requirements
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect

**Official exam objective:**

> Design secure access to the Anypoint Platform control plane and APIs.

## What the exam expects

- Decide how multi-factor authentication (MFA) applies to direct sign-ins, single sign-on (SSO) users and non-human accounts.
- Explain how the Organization Administrator permission behaves across a business group hierarchy, including when a child business group does not inherit it.
- Design a team hierarchy whose permissions cascade from the Everyone team to specialized child teams.
- Select the connected app type, grant type and audience that fit an automation, an internal tool or a third-party product.
- Apply least privilege to a connected app through scopes, business groups, environments and client secret expiry.

**Business group:** a self-contained group of resources such as applications and APIs inside the root organization ([Anypoint Platform Business Groups](https://docs.mulesoft.com/access-management/business-groups)). **Team:** a group of users that receives permissions which cascade to child teams ([Using Teams](https://docs.mulesoft.com/access-management/teams)). **Connected app:** an OAuth 2.0 and OpenID Connect integration that gives an external application restricted access to the organization ([Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/connected-apps-overview)). **Scope:** a role with associated permissions that sets what a connected app can do in a business group and environment ([Creating Connected Apps](https://docs.mulesoft.com/access-management/creating-connected-apps-dev)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| MFA for direct sign-ins | On by default; cannot be turned off at organization level | [Enabling and Managing MFA](https://docs.mulesoft.com/access-management/multi-factor-authentication) |
| MFA for SSO users | Configured in the IdP; shown as n/a in Settings | [Enabling and Managing MFA](https://docs.mulesoft.com/access-management/multi-factor-authentication) |
| MFA-exempt account types | Test automation tools; RPA systems | [Enabling and Managing MFA](https://docs.mulesoft.com/access-management/multi-factor-authentication) |
| Business groups | Off by default; maximum 100; one owner each | [Anypoint Platform Business Groups](https://docs.mulesoft.com/access-management/business-groups) |
| Organization Administrator inheritance | Into children created later; not retroactive | [Anypoint Platform Business Groups](https://docs.mulesoft.com/access-management/business-groups) |
| Team limits | 1000 teams; 10 nesting levels; names unique organization-wide | [Using Teams](https://docs.mulesoft.com/access-management/teams) |
| Client credentials app reach | Only the organization where it was created | [Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/connected-apps-overview) |
| Connected app limits | 2000 apps per organization; 1000 scopes per app | [Creating Connected Apps](https://docs.mulesoft.com/access-management/creating-connected-apps-dev) |
| Refresh tokens | Expire after 90 days; need offline_access with Authorization Code | [Creating Connected Apps](https://docs.mulesoft.com/access-management/creating-connected-apps-dev) |
| Client secret | No expiration by default; expiry can be set | [Creating Connected Apps](https://docs.mulesoft.com/access-management/creating-connected-apps-dev) |

## Check yourself

- When does a refresh token issued through an Anypoint Platform connected app stop working?
- Why can a child business group's owner not see the parent group's client ID and client secret?
- When should the only Organization Administrator contact customer support about MFA?
- How many levels deep can an Anypoint Platform team hierarchy go?

## Sources

- [Enabling and Managing Multi-Factor Authentication in Anypoint Platform](https://docs.mulesoft.com/access-management/multi-factor-authentication)
- [Creating Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/creating-connected-apps-dev)
- [Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/connected-apps-overview)
- [Anypoint Platform Business Groups](https://docs.mulesoft.com/access-management/business-groups)
- [Using Teams to Manage User Permissions](https://docs.mulesoft.com/access-management/teams)
- [Permissions in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-permissions)
- [Configuring Identity Management in Anypoint Platform](https://docs.mulesoft.com/access-management/external-identity)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams