Salesforce Certified Identity Access Management Architect QA

Welcome to Exam Salesforce Certified Platform Identity and Access Management Architect certification Exam Test 2026

Certified Platform Identity and Access Management Architects are experts at assessing architecture environments and requirements in order to design sound, high-performing solutions on the Salesforce Platform that meet Single Sign-on (SSO) requirements.

The Salesforce Certified Platform Identity and Access Management credential is designed for professionals who want to demonstrate their knowledge, skills, and capabilities at assessing identity architecture; designing secure, high-performance access management solutions on the Customer 360 platform; and communicating technical solutions effectively to business and technical stakeholders.

Exam Outline

The Salesforce Certified Platform Identity and Access Management Architect Exam measures a candidate’s knowledge and skills related to the following objectives.

Identity Management Concepts: 17%

• Describe common authentication patterns and understand the differences between each one.

• Describe the building blocks that are part of an identity solution (authentication, authorization, accountability) and how to enable.

• Describe how trust is established between two systems.

• Given a scenario, recommend the appropriate method for provisioning users in Salesforce.

• Given a scenario, troubleshoot common points of failure that may be encountered in a single sign-on solution (SAML, OAuth, etc.).

Accepting Third-Party Identity in Salesforce: 21%

• Given a use case, describe when Salesforce is used as a Service Provider.

• Given a scenario, recommend the most appropriate way to provision users from identity stores in business-to-employer (B2E) and business-to-consumer (B2C) scenarios.

• Given a scenario, recommend the authentication mechanism when Salesforce needs to accept 3rd Party Identity.

• Given a scenario, identify the ways that users can be provisioned in Salesforce to enable SSO and apply access rights.

• Given a scenario, identify the auditing and monitoring approaches available on the platform, and describe the tools available to diagnose issues.

Salesforce as an Identity Provider: 17%

• Given a scenario, identify the most appropriate OAuth flow (Web based, JWT, User agent, Device auth flow).

• Given a scenario, recommend appropriate scope and configuration of the connected app for authorization.

• Describe the various implementation concepts of OAuth (scopes, secrets, tokens, refresh tokens, token expiration, token revocation, etc.).

• Given a scenario, recommend the Salesforce technologies that should be used to provide identity to the 3rd party system.

Access Management Best Practices: 15%

• Given a set of requirements, determine the most appropriate methods of multi-factor authentication (MFA) to use, and the right type of session they should yield.

• Given a scenario, determine how to best assign roles, profiles, and permission sets to a user during the SSO process, how to keep these assignments up to date.

• Given a scenario, describe which tools you can apply to audit and verify the activity/user during and after login.

• Given a scenario, identify the configuration settings for a Connected App.

Salesforce Identity: 12%

• Given a set of requirements, identify the role Identity Connect plays in a Salesforce Identity implementation.

• Given a scenario identify if Salesforce Customer 360 Identity fits into fully a developed Customer 360 solution.

• Give a set of requirements, recommend the most appropriate Salesforce license type(s).

Community (Partner and Customer): 18%

• Describe the capabilities for customizing the user experience for Experience Cloud.

• Given a set of requirements, determine the best way to support external IdPs in communities and leverage the right user/contact model to support community user experience.

• Given a requirement, understand the advantages and limitations of External Identity solutions and associated licenses.

• Given a scenario, determine when to use embedded login.