Platform identity, MFA, teams and connected apps
How Anypoint Platform secures access to its control plane: multi-factor authentication for direct and SSO sign-ins, business groups and Organization Administrator inheritance, cascading team permissions, and connected apps with the right type, grant, audience and least-privilege scopes.
Design secure access to the Anypoint Platform control plane and APIs.
~7 min read · 7 practice questions
What the exam expects
- Decide how multi-factor authentication (MFA) applies to direct sign-ins, single sign-on (SSO) users and non-human accounts.
- Explain how the Organization Administrator permission behaves across a business group hierarchy, including when a child business group does not inherit it.
- Design a team hierarchy whose permissions cascade from the Everyone team to specialized child teams.
- Select the connected app type, grant type and audience that fit an automation, an internal tool or a third-party product.
- Apply least privilege to a connected app through scopes, business groups, environments and client secret expiry.
Business group: a self-contained group of resources such as applications and APIs inside the root organization (Anypoint Platform Business Groups). Team: a group of users that receives permissions which cascade to child teams (Using Teams). Connected app: an OAuth 2.0 and OpenID Connect integration that gives an external application restricted access to the organization (Connected Apps in Anypoint Platform). Scope: a role with associated permissions that sets what a connected app can do in a business group and environment (Creating Connected Apps).
Key facts
- Detail
- On by default; cannot be turned off at organization level
- Detail
- Configured in the IdP; shown as n/a in Settings
- Detail
- Test automation tools; RPA systems
- Detail
- Off by default; maximum 100; one owner each
- Detail
- Into children created later; not retroactive
- Detail
- 1000 teams; 10 nesting levels; names unique organization-wide
- Detail
- Only the organization where it was created
- Detail
- 2000 apps per organization; 1000 scopes per app
- Detail
- Expire after 90 days; need offline_access with Authorization Code
- Detail
- No expiration by default; expiry can be set
Sources for this section (5)
- Enabling and Managing MFAdocs.mulesoft.com (opens in a new tab)
- Anypoint Platform Business Groupsdocs.mulesoft.com (opens in a new tab)
- Using Teamsdocs.mulesoft.com (opens in a new tab)
- Connected Apps in Anypoint Platformdocs.mulesoft.com (opens in a new tab)
- Creating Connected Appsdocs.mulesoft.com (opens in a new tab)
- When does a refresh token issued through an Anypoint Platform connected app stop working?
- Why can a child business group's owner not see the parent group's client ID and client secret?
- When should the only Organization Administrator contact customer support about MFA?
- How many levels deep can an Anypoint Platform team hierarchy go?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the MuleSoft Platform Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 40 lessons of the MuleSoft Platform Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both