Platform Identity and Access Management Architect Study Guide
The CertifyForce Platform Identity and Access Management Architect study guide covers the official Salesforce Platform Identity and Access Management Architect exam outline in 25 units across all 6 exam sections, one unit per exam-guide topic. The exam itself has 60 scored questions plus 5 unscored, a 120-minute limit and a 65% passing score, and its largest section is Accepting Third-Party Identity in Salesforce at 21%. Every unit is verified against official Salesforce documentation, cites its sources, and links to the practice questions that test it. Last updated October 16, 2026.
Designed for identity professionals who want to demonstrate their knowledge, skills, and capabilities at assessing identity architecture; designing secure, high-performance access management solutions on the Customer 360 platform; and communicating technical solutions effectively to business and technical stakeholders.
25 lessons · 6 exam sections · about 3 h of reading ·
Exam sections
Unlock the full guide
Every lesson's summary, exam expectations, key facts and self-check questions are free to read. The Platform Identity and Access Management Architect pack unlocks the self-check answers, core concepts, exam traps and worked scenarios, reading progress, personalized “read next”, and unlimited practice exams.
Identity Management Concepts
17% of the exam- SAML, OpenID Connect and delegated authentication patterns~8 minHow federated SSO (SAML and OpenID Connect), delegated authentication and certificate-based login differ: who checks the credentials, which messages flow, and which pattern fits SP- or IdP-initiated logins, social sign-on, identity provider chains and org-to-org SSO.
- Authentication, authorization and accountability building blocks~7 minMap identity requirements to authentication (who the user is), authorization (OAuth scopes limited by the user's own access) and accountability (Setup Audit Trail, login and verification history, field history and Field Audit Trail), and know each audit tool's retention.
- Establishing trust with certificates, metadata and signed tokens~7 minWhich certificate goes where when Salesforce is a SAML service provider or identity provider, how Issuer, Entity ID and metadata set up trust, and how JWT bearer signatures, mutual TLS, named and external credentials and the delegated authentication endpoint establish trust between systems.
- User provisioning methods: JIT, SCIM and handlers~6 minChoose between pushed provisioning (SCIM, API loads) and provisioning at login (standard SAML JIT, a custom SAML JIT handler, an authentication provider's registration handler), and know the SCIM endpoints, the JIT prerequisites and why connected app user provisioning points the other way.
- Troubleshooting SAML, OAuth and JIT login failures~7 minA failure, cause and fix catalog for single sign-on: SAML Login History statuses and the SAML Assertion Validator, JIT error codes and the Custom Error URL, OpenID Connect and OAuth error codes, JWT bearer audience and subject mistakes, and certificate rotation in both directions.
Accepting Third-Party Identity in Salesforce
21% of the exam- Configuring Salesforce as a SAML service provider~8 minWhen Salesforce trusts a third-party identity provider, how the SAML single sign-on setting maps users and validates signatures, how to route users to one of several IdPs, how to require SSO without locking admins out, and how SAML single logout and sandbox refreshes behave.
- B2E and B2C provisioning with self-registration~7 minHow to provision employees from a corporate directory and consumers who exist in no directory: SCIM connectors and JIT for B2E, and for B2C self-registration with business or person accounts, the Configurable Self-Reg Page and its handler, the self-registration controller, micro-batching and headless registration.
- Authentication providers for OpenID Connect and social sign-on~8 minHow to choose between a SAML setting, a predefined or OpenID Connect authentication provider, a custom Apex provider and delegated authentication when Salesforce accepts a third party's identity, and how to configure providers: registration handler, Salesforce-managed sandbox apps, PKCE, single logout, the client configuration URLs and their request parameters, and third-party access tokens.
- Standard JIT attributes and registration handler provisioning~7 minHow users get created and kept current at login: the attributes standard SAML JIT requires for internal and Experience Cloud users and the order it matches users, contacts and accounts, moving existing users to Federation ID JIT, how registration handlers create, update and confirm users for authentication providers, and the per-user permission that turns on delegated authentication.
- Login History and diagnostics for SSO monitoring~7 minHow to monitor and diagnose logins that come from third-party identity: Login History fields, list views, downloads and SOQL (Login Type, Login Subtype, Authentication Service ID, Authentication Method Reference), routing SAML failure statuses to the IdP or the admin team, Delegated Authentication Error History and status codes, and the Test-Only Initialization URL.
Salesforce as an Identity Provider
17% of the exam- Choosing OAuth 2.0 authorization flows and PKCE~8 minHow to pick the OAuth 2.0 flow from who is present and what the client can protect: web server flow with PKCE, the user-agent flow it replaces, the device flow for limited-input devices, and JWT bearer, client credentials and SAML bearer for unattended servers, plus why the username-password flow is blocked.
- Connected app OAuth settings, scopes and permitted users~8 minWhich OAuth settings a connected app or external client app needs for each flow (callback URL, device flow, client credentials with a Run As user, PKCE and the web server secret), how to pick least-privilege scopes, and how Permitted Users and the Use Any API Client permission decide who can authorize.
- OAuth tokens: refresh, expiration, revocation and introspection~7 minHow long each OAuth token lives in Salesforce, how refresh token policies, the idle TTL limit, rotation and the refresh-flow secret behave, how to revoke tokens from the app, from Setup or by rotating consumer details, and how to validate ID tokens, opaque tokens and JWT-based access tokens.
- Salesforce as a SAML and OpenID Connect provider~8 minHow Salesforce gives identity to third-party systems: enabling the SAML identity provider and SAML-enabled apps (entity ID, ACS URL, subject, Name ID, start URL, single logout), OpenID Connect apps with ID token audiences and custom attributes, Experience Cloud sites as identity providers, canvas signed requests, user provisioning for connected apps and JWT external credentials.
Access Management Best Practices
15% of the exam- MFA methods, SSO signals and session security levels~8 minWhich MFA method each user type needs under the 2026 enforcement, how an SSO identity provider proves MFA with AMR and ACR signals, and how Session Security Levels, the SessionLevel attribute and login flows decide whether a login yields a standard or high-assurance session.
- Assigning profiles and permission sets during SSO~6 minHow to keep profiles, roles and permission sets in step with the identity provider at SSO login: a minimum-access profile plus permission set groups, what standard JIT can and can't set, the Custom SAML JIT handler's createUser and updateUser contract, expiring assignments, SCIM entitlements, and validating ID token claims before granting access.
- Login auditing, Event Monitoring and login flows~6 minWhich tool answers which audit question during and after login: Session Management for live sessions, Identity Verification History and the methods report for MFA, Event Monitoring, Real-Time Event Monitoring, transaction security and Threat Detection for activity and attacks, and login flows for checks that run at every login.
- Connected app policies: IP relaxation, sessions and handlers~7 minThe admin-side policies of a connected app or external client app: the four IP Relaxation options and their limits under continuous IP enforcement, session timeout and high assurance, mobile PIN, start URL, the custom connected app handler, the permissions to manage apps, installing uninstalled apps, and why new integrations use external client apps.
Salesforce Identity
12% of the exam- Identity Connect role and retirement migration~8 minWhat Identity Connect did (push provisioning from Active Directory to Salesforce, immediate session revocation, optional SSO from a customer-hosted server), why it is being retired with no replacement, what stops when a subscription ends, and how to scope, replace and decommission it.
- Customer Identity: headless, passwordless and Customer 360 fit~7 minWhere Salesforce Customer Identity (the exam guide's Customer 360 Identity) fits in a Customer 360 architecture: the login, registration, verification and SSO layer for customers and partners, separate from Data 360 profile unification, with headless identity for off-platform apps, passwordless login, SMS verification options and login flows that collect profile data later.
- Choosing internal, identity and Experience Cloud licenses~7 minHow to pick a user license from requirements: internal versus external, Identity Only, Salesforce Platform and Salesforce Integration for employees and systems, and External Identity, Customer Community, Customer Community Plus, Partner Community, Channel Account and External Apps for external users, with member-based versus login-based pricing, person-account fit and scale guidance.
Community (Partner and Customer)
18% of the exam- Experience Cloud login pages, branding and sessions~8 minHow to shape what external users see before and after they log in to an Experience Cloud site: the four login page types, Login & Registration branding with dynamic expid URLs, Experience Builder themes and audience-based branding sets, and profile session settings that keep customers signed in.
- External IdPs and external user models on sites~8 minHow an Experience Cloud site accepts outside identity (SAML service provider with site endpoints, authentication providers as relying party, Login Discovery routing to partner IdPs) and how to pick the account and contact model behind each external user: business contact, partner account, person account or contactless user.
- External Identity license capabilities, limits and upgrades~7 minWhat the External Identity license behind Salesforce Customer Identity includes and leaves out (objects, the default profile, ten custom objects, the 10 million monthly login guidance, guest users), and how to move users up to community licenses or back down to contactless users.
- Embedded Login versus redirect-based OAuth~7 minWhen Embedded Login still fits (a login form on an external page that can't do SSO, or login before purchase), why Salesforce disabled it by default in Summer '24 and recommends redirect-based OAuth instead, and how to set it up and troubleshoot it: Allow embedded login, CORS, the external client app, meta tags and a server-side callback.
Common questions about the Platform Identity and Access Management Architect study guide
Is the Platform Identity and Access Management Architect study guide free?
Partly. Every unit's summary and its "What the exam expects", "Key facts" and "Check yourself" sections are free to read without an account. The "Core concepts", "Exam traps" and "Worked scenario" sections, reading progress and unlimited timed mock exams come with the Platform Identity and Access Management Architect pack (USD $19).
How current is the Platform Identity and Access Management Architect study guide?
It is written to the current official Salesforce Platform Identity and Access Management Architect exam outline, and each unit is checked against Salesforce documentation before it is published. The most recent update was October 16, 2026, and every unit shows its own last-updated date.
How does the study guide map to the official Platform Identity and Access Management Architect exam guide?
There is one unit per topic in the official exam guide, grouped under its 6 weighted sections: Identity Management Concepts (17%), Accepting Third-Party Identity in Salesforce (21%), Salesforce as an Identity Provider (17%), Access Management Best Practices (15%), Salesforce Identity (12%), Community (Partner and Customer) (18%). Each unit quotes the exam objective it covers word for word.
How do the practice questions link to the study guide?
Each unit lists the reviewed practice questions that test it (300 questions are linked across the guide), so you can read a topic and practice it in one click. After a practice exam, every missed question links back to the unit that teaches it.