Identity Management Concepts17% of the exam
Authentication, authorization and accountability building blocks
Map identity requirements to authentication (who the user is), authorization (OAuth scopes limited by the user's own access) and accountability (Setup Audit Trail, login and verification history, field history and Field Audit Trail), and know each audit tool's retention.
Describe the building blocks that are part of an identity solution (authentication, authorization, accountability) and how to enable.
~7 min read · 9 practice questions ·
What the exam expects
- Sort a list of requirements into authentication, authorization and accountability, and name the Salesforce feature that enables each.
- Explain what limits the data an OAuth client can reach: the scopes granted to it and the authorizing user's own object, field and record access.
- Choose the right audit record (Setup Audit Trail, Login History, Identity Verification History, field history) for a "who did what" question.
- Meet long retention requirements: archive SetupAuditTrail through the API, and use Field Audit Trail for field history.
- Make handler-created records traceable with a dedicated Execute Registration As user.
Key terms: authentication (who a person is); authorization (what a person can do); accountability (tracing who changed or did what, and when); scope (the kind of protected resource a token can reach); Setup Audit Trail (history of setup changes); Field Audit Trail (field history kept until deleted).
Key facts
Setup Audit Trail page
- Detail
- 20 most recent changes; download covers 180 days
Setup Audit Trail retention
- Detail
- Records deleted after 180 days
SetupAuditTrail object
- Detail
- Supports query() and retrieve(); no aggregate count(Id)
Login History
- Detail
- Past 6 months; All Logins download includes API logins
Identity Verification History
- Detail
- Up to 20,000 attempts from the past 6 months
Field history retention
- Detail
- 18 months, 24 via the API; until deleted with Field Audit Trail
Field Audit Trail licensing
- Detail
- Salesforce Shield or Field Audit Trail licenses
full scope
- Detail
- All data the logged-in user can access; no refresh token unless requested
Execute Registration As
- Detail
- Needs Manage Users; use a dedicated system user in production
Sources for this section (8)
- Setup Audit Trailhelp.salesforce.com (opens in a new tab)
- SetupAuditTraildeveloper.salesforce.com (opens in a new tab)
- Monitor Login Historyhelp.salesforce.com (opens in a new tab)
- Identity Verification Historyhelp.salesforce.com (opens in a new tab)
- Field History Trackinghelp.salesforce.com (opens in a new tab)
- Field Audit Trailhelp.salesforce.com (opens in a new tab)
- OAuth Tokens and Scopeshelp.salesforce.com (opens in a new tab)
- OpenID Connect Providerhelp.salesforce.com (opens in a new tab)
- Why can't the `full` scope expose records the authorizing user can't see?
- When should you query the SetupAuditTrail object instead of downloading the audit trail?
- Where do you see that a user denied and flagged a Salesforce Authenticator request?
- Why does a ten-year field retention rule need Field Audit Trail?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (9 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams