Salesforce Certified Platform Identity and Access Management Architect

The Salesforce Certified Platform Identity and Access Management (IAM) Architect certification is designed for professionals who specialize in building and managing secure, scalable, and high-performing identity solutions within the Salesforce Customer 360 platform. This certification validates your expertise in identity architecture, authentication mechanisms, access control, and integration across systems, as well as your ability to communicate technical designs to both business and technical stakeholders.

– What the Exam Measures

This certification evaluates your ability to:

Design secure identity architectures that span multiple systems and platforms, ensuring seamless authentication and integration.
Explain and justify architectural decisions and trade-offs in identity management solutions.
Apply best practices in identity and access management (IAM) to Salesforce implementations, aligning with enterprise-level security and compliance standards.

– Key Skills and Knowledge Areas

Candidates should have the ability to:

Differentiate between federated and delegated Single Sign-On (SSO) models.
Configure and troubleshoot SAML, OAuth, and OpenID Connect within Salesforce.
Establish and maintain trust relationships between Identity Providers (IdPs) and Service Providers (SPs).
Implement social sign-on and authentication mechanisms for Salesforce Communities.
Understand and apply multi-factor authentication (MFA) strategies.
Utilize Identity Connect and design appropriate user lifecycle management processes such as automated provisioning and just-in-time provisioning.
Explain the importance of a strong SSO strategy for enterprise security.

– Who Should Take the Exam

The Salesforce Certified Platform Identity and Access Management Architect credential is ideal for professionals who:

Have 1+ years of experience designing and implementing IAM solutions on the Salesforce Customer 360 platform.
Possess 2+ years of experience in identity and/or security technologies.
Are involved in designing, implementing, or managing identity solutions that integrate with Salesforce.

Typical job roles include:

Enterprise Architect
Technical Architect
Security Architect
Integration Architect
Identity Architect
Solution Architect

– Recommended Experience

Candidates should be comfortable with:

Designing and configuring delegated authentication and SAML-based SSO.
Understanding the differences between IdP-initiated and SP-initiated flows.
Managing OAuth flows and configuring Connected Apps for identity management.
Implementing login flows, MFA, and user provisioning mechanisms.
Communicating complex identity design concepts effectively to stakeholders.

Areas where candidates may need assistance include:

Writing Apex code for custom identity integrations.
Understanding networking and domain management as it relates to identity.
Configuring Salesforce for automated lifecycle management and social sign-on through the user interface.

Exam Details

The Salesforce Platform Identity and Access Management (IAM) Architect Exam consists of 60 multiple-choice or multiple-select questions, along with up to five non-scored questions that are included for research purposes and do not affect your final score.
Candidates are given a total of 120 minutes to complete the exam. To pass, you must achieve a minimum score of 67%.
The exam is available in two delivery formats: it can be taken as a proctored exam at an authorized testing center or as an online proctored exam, allowing you to take the test remotely under supervision.
No external resources are permitted during the exam—this includes both hard-copy materials and online references.
There are no prerequisites for this certification, meaning you can directly register and attempt the exam without needing to hold any prior Salesforce credentials. However, a strong understanding of identity and access management concepts is highly recommended for success.

Course Outline

The Salesforce Platform Identity and Access Management Architect Exam evaluates a candidate’s expertise and proficiency across the following key objectives.

1. Understand Identity Management Concepts: 17%

Describing common authentication patterns and understand the differences between each one.
Describing the building blocks that are part of an identity solution (authentication, authorization, and accountability) and how you enable those building blocks using Salesforce features.
Describing how trust is established between two systems.
Given a scenario, recommending the appropriate method for provisioning users in Salesforce.
Given a scenario, troubleshooting common points of failure that may be encountered in a single sign-on (SSO) solution (SAML, OAuth, etc.).

2. Learn about Accepting Third-Party Identity in Salesforce: 21%

Given a use case, describing when Salesforce is used as a Service Provider (SP).
Given a scenario, recommending the most appropriate way to provision users from identity stores in business-to-employer (B2E) and business-to-consumer (B2C) scenarios.
Given a scenario, recommending the appropriate authentication mechanism when Salesforce needs to accept third-party Identity (Enterprise Directory, Social, Community, etc.).
Given a scenario, identifying the ways to provision users in Salesforce to enable SSO and apply access rights.
Given a scenario, identifying the auditing and monitoring approaches available on the platform, and describe the tools available to diagnose Identity Provider (IdP) issues.

3. Salesforce as an Identity Provider: 17%

Given a scenario, identifying the most appropriate OAuth flow (Web-based, JWT, User agent, Device auth flow).
Given a scenario, recommend appropriate Scope and Configuration of the Connected App for Authorization.
Describing the various implementation concepts of OAuth (scopes, secrets, tokens, refresh tokens, token expiration, token revocation, etc.).
Given a scenario, recommend the Salesforce technologies that should be used to provide identity to the third-party system (Canvas, Connected Apps, App Launcher, etc.).

4. Understand Access Management Best Practices: 15%

Given a set of requirements, determining the most appropriate methods of multi-factor authentication (MFA) to use, and the right type of session they should yield.
Given a scenario, determining how to best assign roles, profiles, and permission sets to a user during the SSO process, how to keep these assignments up to date.
Given a scenario, describing which tools you can apply to audit and verify the activity/user during and after login.
Given a scenario, identifying the configuration settings for a Connected App.

5. Learn About Salesforce Identity: 12%

Given a set of requirements, identifying the role Identity Connect plays in a Salesforce Identity implementation.
Given a scenario, identifying if Salesforce Customer 360 Identity fits into a fully-developed Customer 360 solution.
Give a set of requirements, recommending the most appropriate Salesforce license type(s).

6. Understand Community (Partner and Customer): 18%

Describing the capabilities for customizing the user experience for Experience Cloud (Branding options, authentication options, identity verification self-registration, communications, password reset, etc.).
Given a set of requirements, determine the best way to support external IdPs in communities and leverage the right user/contact model to support community user experience.
Given a requirement, understanding the advantages and limitations of External Identity solutions and associated licenses.
Given a scenario, determining when to use embedded login.

Salesforce Certified Platform Identity and Access Management Architect Exam FAQs

Click Here For FAQs!

Salesforce Exam Candidate Code of Conduct

Every participant in the Salesforce Certification Program is expected to maintain the highest standards of honesty, integrity, and professionalism throughout their certification journey. By enrolling in the program, candidates agree to comply with the Salesforce Credential and Certification Program Agreement, which sets clear expectations for ethical conduct during exam preparation, testing, and post-exam activities.

Candidates are encouraged to prepare using official Salesforce learning materials, collaborate responsibly within the Trailblazer Community, and adhere strictly to all exam rules and security procedures. Any form of misconduct—including sharing or soliciting confidential exam content, obtaining unauthorized assistance, or breaching testing protocols—constitutes a violation of the program’s ethical standards.

Such actions can lead to serious disciplinary measures, including the invalidation of exam results, revocation or suspension of credentials, and, in severe cases, permanent disqualification from the Salesforce Certification Program.

Salesforce Exam Policy

The Salesforce Exam Policy defines the official procedures and rules for scheduling, rescheduling, canceling, and completing Salesforce certification exams—whether taken online or at a designated testing center. These policies are designed to ensure a secure, fair, and consistent testing experience for all candidates.

– Onsite (Testing Center) Exams

For exams taken at a Pearson VUE testing center, candidates may reschedule or cancel their appointment up to 48 hours before the scheduled exam time through their Pearson VUE account. Requests made after this deadline are generally not permitted. Candidates who fail to appear for their exam without prior notice will be recorded as no-shows, resulting in the forfeiture of the exam fee.

– Online Proctored Exams

Candidates opting for the online proctored exam can reschedule or cancel their test up to 24 hours before the scheduled start time via the Pearson VUE platform, with no additional cost. Changes requested after the cutoff time are typically not allowed, and failure to comply may lead to the loss of the full exam fee.

Salesforce Certified Platform Identity and Access Management Architect Exam Study Guide

Step 1: Understand the Exam Guide

The first step in preparing for the Salesforce Certified Platform Identity and Access Management Architect Exam is to carefully study the official exam guide provided by Salesforce. This document serves as your blueprint for success. It outlines the exam format, domains covered, percentage weightage of each section, and the depth of knowledge required. Understanding the guide helps you align your preparation with Salesforce’s expectations and focus on high-priority topics such as identity architecture, authentication mechanisms, access management, and integration patterns.

The guide also specifies important administrative details, including the number of questions, time limits, and passing score. By analyzing the guide early in your preparation, you can build a structured study plan that ensures comprehensive coverage of all exam domains without overlooking critical areas.

Step 2: Build a Foundation with Hands-On Experience and Training Courses

A solid combination of hands-on experience and formal Salesforce training is key to mastering the concepts tested in this exam. Salesforce recommends that candidates have prior experience working on identity and access management (IAM) solutions within the Salesforce Customer 360 platform, as practical application reinforces theoretical knowledge.

Training courses, such as those offered by Salesforce Trailhead Academy, provide structured learning paths led by certified instructors. These courses delve into the technical and architectural aspects of identity design, including SSO configuration, OAuth flows, SAML setup, federation, and user provisioning. Pairing these lessons with real-world implementation in a sandbox or developer org helps bridge the gap between learning and doing—preparing you for both conceptual and scenario-based questions.

Step 3: Enhance Your Knowledge on Trailhead

Trailhead, Salesforce’s free learning platform, is an invaluable resource for developing expertise at your own pace. It features interactive modules, projects, and trails specifically designed for the Identity and Access Management Architect path. Topics such as authentication flows, login policies, identity federation, and connected apps are presented through practical examples and guided challenges.

In addition to identity-specific trails, you can explore broader areas like security best practices, integration architecture, and platform encryption to build a well-rounded understanding of Salesforce’s security model. Completing these modules not only strengthens your conceptual grasp but also earns you badges and credentials that reflect your progress and readiness for certification.

Step 4: Gain Practical Experience to Strengthen Your Expertise

Nothing prepares you better than real-world, hands-on experience. Working directly with Salesforce environments allows you to see how identity and access management principles apply in practical scenarios. Focus on configuring Identity Providers (IdPs), setting up Service Provider (SP) Initiated and IdP Initiated SAML flows, managing Connected Apps, and implementing Multi-Factor Authentication (MFA) across user profiles.

Experimenting with Identity Connect, login flows, and user lifecycle management (including automated provisioning and just-in-time provisioning) gives you a deeper technical understanding of how these components interact. The more familiar you become with Salesforce configuration interfaces and identity protocols, the more confident you’ll be when answering detailed, scenario-driven exam questions.

Step 5: Engage with Study Groups, Communities, and Trailhead Academy

Collaboration and discussion play a major role in effective exam preparation. Join Salesforce study groups, online forums, or Trailblazer Community hubs dedicated to certification support. Engaging with other professionals enables you to exchange insights, clarify complex topics, and stay updated on the latest identity management trends and Salesforce security features.

You can also enroll in Trailhead Academy’s certification workshops or architect bootcamps, where you’ll learn directly from certified Salesforce experts. These sessions provide mentorship, structured study schedules, and exposure to real-world case studies—making them ideal for deepening your conceptual and practical understanding.

Step 6: Take Practice Tests and Assess Your Readiness

Before scheduling your final exam, it’s essential to evaluate your knowledge and timing through Salesforce practice exams or sample tests. Practice assessments mirror the real exam format and question style, helping you become familiar with the level of difficulty and pacing required.

Use your results to identify weaker areas and revisit those domains using targeted study. Analyzing both correct and incorrect answers enhances your critical thinking and reinforces conceptual clarity. Consistent practice will help you build confidence, improve retention, and ensure that you’re fully prepared for the live exam environment.

Step 7: Review Salesforce Documentation, Tip Sheets, and User Guides

As you approach the final stage of your preparation, reinforce your knowledge by studying official Salesforce documentation available on Salesforce Help. Resources such as Tip Sheets, Implementation Guides, and User Guides offer detailed technical insights into identity and access management functionalities.

Reviewing this documentation helps you understand Salesforce’s official recommendations, configuration nuances, and real-world best practices that may appear in exam scenarios. These resources are constantly updated by Salesforce, ensuring that your knowledge remains aligned with current platform capabilities and standards.