Policies and Settings22% of the exam
SAML SSO, SCIM and identity provider groups
How to guide a client's identity setup: SAML SSO availability by plan and where it is configured, required attributes and how Slack matches accounts, guest exclusions and the owner bypass, JIT versus SCIM provisioning, profile sync pitfalls, IdP groups for workspaces and channels, and the HR and IT discovery questions that come first.
Provide guidance and requisite setup of identity management settings in Slack.
~7 min read · 9 practice questions ·
What the exam expects
- Recommend the plan and configuration level for SAML SSO (workspace on Business+, org on Enterprise; Free and Pro only with a connected Salesforce org).
- Choose the SSO requirement option when guests have no IdP accounts, and explain the owner bypass for IdP outages.
- Name the required SAML attributes and explain how Slack matches a sign-in to an account, including during an IdP change.
- Compare JIT and SCIM provisioning and diagnose SAML profile sync overwriting SCIM values.
- Connect IdP groups to workspaces and channels, and ask HR and IT the lifecycle and security questions before configuring anything.
Key terms:
- SAML SSO: sign-in through an identity provider (IdP) using SAML 2.0.
- NameID: the IdP's unique, pseudo-random identifier for a user that should not change over time.
- JIT provisioning: Slack creates the account at the user's first SSO sign-in.
- SCIM provisioning: the IdP creates, updates and deactivates Slack accounts ahead of sign-in through the SCIM API.
- IdP group: an IdP security group synced to Slack and connected to workspaces or channels.
Key facts
SAML SSO plans
- Detail
- Business+ and Enterprise; Free and Pro only with a connected Salesforce org
Who enables SSO
- Detail
- Workspace Owner (below Enterprise); Org Owner (Enterprise)
Required SAML attributes
- Detail
- NameID and email
Binding window after SSO is required
- Detail
- 72 hours
Additional SSO configurations
- Detail
- Up to 11
SSO bypass
- Detail
- Workspace Owners and Org Owners, with email and password
Default provisioning with SSO
- Detail
- JIT
SCIM billing
- Detail
- Billable at first sign-in
Leaving an IdP group
- Detail
- Removes the person only from required workspaces
Sources for this section (5)
- Why must email addresses stay the same when a client switches identity providers?
- When should SSO be required for all members excluding guests?
- Which two attributes must every SAML response include?
- What does SCIM add over JIT provisioning?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Consultant pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Consultant guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (9 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams