Salesforce Identity12% of the exam
Identity Connect role and retirement migration
What Identity Connect did (push provisioning from Active Directory to Salesforce, immediate session revocation, optional SSO from a customer-hosted server), why it is being retired with no replacement, what stops when a subscription ends, and how to scope, replace and decommission it.
Given a set of requirements, identify the role Identity Connect plays in a Salesforce Identity implementation.
~8 min read · 8 practice questions ·
What the exam expects
- Describe the role Identity Connect plays in an existing implementation: Active Directory (AD) to Salesforce push provisioning, immediate session revocation on deprovisioning, and optional single sign-on (SSO).
- Describe how it is deployed: a customer-hosted Windows or Linux service, a dedicated integration user, and paid permission set licenses.
- Recognize that Identity Connect is being retired (security updates only) with no Salesforce replacement, and never recommend it for a new implementation.
- Plan a migration: discovery, choosing a replacement (Microsoft's connector, an existing provisioning product, a marketplace tool or SCIM), explaining why Just-in-Time (JIT) provisioning is not like-for-like, and decommissioning.
- Key terms: Identity Connect (Salesforce's AD-to-Salesforce provisioning and SSO service, now being retired); push provisioning (the directory sends changes as they happen); JIT provisioning (Salesforce creates or updates the user at SAML login); SCIM (open standard REST API for provisioning user identities); integration user (the Salesforce user record Identity Connect uses to apply AD changes).
Key facts
Direction of sync
- Detail
- AD to Salesforce; updates pushed "instantaneously"
Deprovisioning
- Detail
- The user's Salesforce session is revoked immediately
Where it runs
- Detail
- A service on a customer Windows or Linux server
Editions
- Detail
- Additional cost in Enterprise, Performance, Unlimited; 10 licenses in Developer Edition
Integration user
- Detail
- Created before install; use it only for Identity Connect
Retirement status
- Detail
- Security updates only; no replacement from Salesforce
Affected users
- Detail
- Users assigned the Identity Connect user permission set
After the order ends
- Detail
- No new provisioning, no updates to existing users, SSO through it stops
JIT timing
- Detail
- Creates or updates users only when they log in with SAML
SCIM
- Detail
- All editions; REST operations with an OAuth 2.0 access token
Sources for this section (5)
- Identity Connecthelp.salesforce.com (opens in a new tab)
- Install Identity Connecthelp.salesforce.com (opens in a new tab)
- Identity Connect Retirementhelp.salesforce.com (opens in a new tab)
- Just-in-Time Provisioning for SAMLhelp.salesforce.com (opens in a new tab)
- Manage Salesforce User Identities with SCIMhelp.salesforce.com (opens in a new tab)
- Why can't standard SAML JIT provisioning meet a requirement to end access the moment AD deprovisions a user?
- When does Salesforce point a customer to Microsoft's connector as the replacement?
- Which users does the retirement affect?
- Where does Identity Connect run?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams