New to this track? Our Salesforce Certified System Architect exam prep is the recommended first step. See our certification path to understand where this certification fits. The Salesforce Certified Platform Identity and Access Management Architect exam weights Accepting Third-Party Identity in Salesforce most heavily (21%), see the full breakdown, study tips, and practice questions below.
Free practice • No sign-up required
Independent study resource
Exam objectives and policies can change. Confirm current details with the certification issuer.
Check current objectives
Use the official exam guide as the source for current objectives and section weights.
Practice for learning
Use sample questions to review concepts and identify topics for further study.
Works on Any Device
Full practice experience on phone, tablet, or desktop
Free, No Sign-Up
Start practicing immediately, no account or email required
Salesforce Certified Platform Identity and Access Management Architect – Complete 2026 Guide
This exam tests how you design login and access for Salesforce: single sign-on with SAML, the OAuth flows, Connected Apps, multi-factor authentication, and how user accounts are created and kept in step. The exam is 60 scored questions in 120 minutes, with a 65% pass mark, weighted towards Accepting Third-Party Identity in Salesforce (21%) and Community (Partner and Customer) (18%).
Recommended Prerequisites
We recommend completing this certification first to prepare you better.
| Official exam name and code | Salesforce Certified Platform Identity and Access Management Architect (Identity & Access Mgmt) |
|---|---|
| Questions | 60 |
| Time allotted | 120 min |
| Passing score | 65% |
| Exam fee | $400 |
| Retake fee | $200 |
| Prerequisite certifications | Recommended preparation: Salesforce Certified System Architect |
| Study guide release | Summer '26 |
Salesforce Certified Platform Identity and Access Management Architect Exam Weightage by Section
1. Identity Management Concepts (17%)
17%2. Accepting Third-Party Identity in Salesforce (21%)
21%3. Salesforce as an Identity Provider (17%)
17%4. Access Management Best Practices (15%)
15%5. Salesforce Identity (12%)
12%6. Community (Partner and Customer) (18%)
18%Exam Topics
Last updated:
Who is the Identity and Access Management Architect exam for?
- Identity architects: You design how people and systems log in, and you want the credential that proves it.
- Integration specialists: You build server-to-server connections and need to pick the right OAuth flow with confidence.
- Security engineers: You own multi-factor authentication, Connected Apps and session policy for a Salesforce org.
Exam Fees & Registration
Exam Fee
$400
One-time registration fee
Retake Fee
$200
If you need to retake the exam
Comparing certs? View all Salesforce exam fees in one place →
Certification Validity
Maintenance and renewal requirements vary. Check the issuer’s current credential page for requirements that apply to you.
How to Register
Check current Salesforce Certified Platform Identity and Access Management Architect credential and registration details with the issuer.
View official credential detailsOfficial references: Use the issuer’s current materials to confirm exam objectives, format, and fees before booking.
Official sources: Salesforce exam pricing·Independent exam-prep resource; details may change.
Exam Tips
- 1Identity and SSO + Access Management are 60%. Know SAML, OAuth, SSO flows, and user provisioning.
- 2Understand federation, delegated authentication, and when to use each.
- 3Know security and compliance: MFA, session management, audit trails.
- 4Be ready for "how would you implement SSO for X scenario?" questions.
Prerequisites
- •Application Architect
- •System Architect
- •Identity and security experience
Focus Areas
- •Identity and Single Sign-On
- •Access Management
- •Security and Compliance
- •Integration
Study Strategy
Design identity solutions for various scenarios.
Understand SSO flows, federation, and user lifecycle management.
Practice explaining security trade-offs.
Exam Format and First-Attempt Readiness
The Salesforce Certified Platform Identity and Access Management Architect exam has 60 questions in 120 min, passing score 65%. Most Salesforce exams test scenario-based decisions. Focus on when to use each feature, not just terms.
- Study Accepting Third-Party Identity in Salesforce and Community (Partner and Customer) first, together they carry 39% of the exam.
- Do timed question sets. Build pacing and confidence.
- Review why wrong answers are wrong. It improves scenario reasoning.
- Book the exam once your mock scores are steady at 75%+.
Is the Identity and Access Management Architect Exam Hard?
Is the Identity and Access Management Architect Exam Hard?
It is a demanding exam because the answers turn on small differences between protocols. You need to know SAML and the OAuth flows well enough to match one to a specific situation, not just describe them. It is one of the four exams that earn the System Architect credential.
- 60 multiple-choice questions in 105 minutes.
- About 65% to pass, roughly 35 correct answers out of 60. Confirm it in the official exam guide before you book.
- Protocol detail matters. Expect questions where two OAuth flows both look workable and only one fits.
- Single sign-on design. Know which side starts the login, how users are provisioned, and what Salesforce can do as an identity provider.
Pass Rate Guidance
You are ready when you can sketch each OAuth flow from memory, set up SAML single sign-on in both directions, and say what a Connected App's scopes and policies control. Aim for 75% or more on practice tests.
Identity and Access Management Architect Exam Format Explained
Identity and Access Management Architect Exam Format Explained
You can take the exam online with a proctor or at a test centre. Here is what to expect:
Total Questions
60 scored questions
Time Limit
120 min
Passing Score
65%
Question Type
Multiple-choice & multiple-select
How Many Questions Are Scenario-Based?
Most questions describe a login or integration situation and ask which flow, setting or feature fits. The detail that decides it is usually whether a person is involved and whether the app can hold a secret safely.
Best Way to Pass on Your First Attempt
- Match each OAuth flow to its situation: Web server when a person logs in through a browser, JWT bearer for server-to-server with no user, device flow for a TV or CLI, user-agent for a browser or mobile app.
- Set up SAML both ways: Salesforce as the service provider logging users in from an outside provider, and Salesforce as the identity provider for other apps.
- Learn Connected App controls: Scopes, IP restrictions, session policies and which users are pre-authorised.
- Know the multi-factor rules: What satisfies the requirement, and how single sign-on interacts with it.
Identity and Access Management Architect: Key Concepts
Authentication and Authorisation Are Not the Same
Authentication proves who someone is, which is logging in. Authorisation decides what they may then do or which data an app may reach. SAML handles authentication for people. OAuth handles authorisation for applications: it gives an app a token to act on someone's behalf, or on its own behalf, without handing over a password. OpenID Connect sits on top of OAuth and adds an identity token, so an app learns who the user is as well as what it may do. Many exam questions become easy once you decide which of the two the scenario is really about.
SAML Single Sign-On: Who Starts the Login
With SAML, the identity provider checks the user and vouches for them, and the service provider is the app they are reaching. In service-provider-initiated single sign-on the user starts at Salesforce, is redirected to the provider to log in, and comes back with an assertion. In identity-provider-initiated single sign-on the user starts at the provider's portal and clicks through to Salesforce. Setup needs the provider's certificate, the entity ID and the login URL to match on both sides, and Salesforce needs My Domain turned on. Typical failures are a mismatched entity ID, an expired certificate, or clocks out of step so the assertion looks stale. Salesforce can also be the identity provider for other applications.
OAuth 2.0 Flows and When Each Fits
Web server flow (authorisation code) is for apps with a server that can keep a secret, where a person logs in through a browser. User-agent flow suits apps running in a browser or on a phone, where no secret can be hidden. JWT bearer flow is for server-to-server access with no person present: the app signs an assertion with a certificate and receives a token. Client credentials flow also covers server-to-server work tied to a single integration user. Device flow is for devices with awkward input, such as a TV, where the user authorises on another screen. Refresh tokens let an app get new access tokens without asking the user again, and their lifetime is controlled by policy.
Connected Apps: Scopes, Policies and Sessions
A Connected App is how an outside application is registered with Salesforce. Its scopes limit what a token may do, for example reading data, managing the user's account or acting offline with a refresh token. Policies control who may use it: admin pre-authorised; so only chosen profiles or permission sets can connect, or self-authorised, where any user may approve it. You can restrict it to trusted IP ranges, set how long sessions last, and set a refresh token policy such as expiring after a period of inactivity. Newer orgs may use External Client Apps for the same purpose. Revoking the app's tokens cuts off access immediately.
Provisioning, Multi-Factor and My Domain
Accounts have to be created and removed as well as authenticated. Just-in-time provisioning creates or updates a Salesforce user from the SAML assertion the first time they log in. User provisioning for Connected Apps pushes accounts out to other systems. SCIM is the standard many identity providers use for the same job. Multi-factor authentication is required for Salesforce access, and the requirement can be met by a verification method in Salesforce or by single sign-on where the provider enforces it. My Domain gives the org its own login URL, which single sign-on and several identity features depend on. For customers, Experience Cloud supports social sign-on and self-registration.
In SP-initiated SSO, the user hits Salesforce (the Service Provider), gets redirected to the Identity Provider to authenticate, and returns with a signed SAML assertion that Salesforce validates before granting a session.
How to Pass the Salesforce Identity and Access Management Architect Exam
Nearly every question is a choice between protocols or flows. Look for whether a person is present, whether a secret can be kept, and which side starts the login.
Choosing an OAuth Flow
Person plus a server that keeps a secret: web server flow. No person at all: JWT bearer. Browser or mobile app with no secret: user-agent. Limited input device: device flow.
SAML Setup and Failures
Entity ID, certificate and login URL must match on both sides, and My Domain must be on. Mismatched IDs, expired certificates and clock drift are the usual causes of failure.
Connected App Controls
Scopes limit what a token can do. Admin pre-authorisation limits who can connect. IP ranges and session policies tighten it further.
Multi-Factor Authentication
The requirement can be satisfied inside Salesforce or by the identity provider through single sign-on. Know which methods count.
Provisioning Users
Just-in-time provisioning creates users during single sign-on. SCIM and user provisioning keep accounts in step and remove leavers.
Is the Salesforce Certified Platform Identity and Access Management Architect Exam Hard?
DifficultyChallenging; plan about 8-16 weeks of focused prep.
Book When ReadyScore 75%+ on three timed mocks before scheduling.
Use Practice, Not DumpsOriginal practice questions build skill without risking your credential.
Exam format: 60 questions, 120 min, 65% passing score.
Salesforce Certified Platform Identity and Access Management Architect Practice Questions (With Explanations)
Test your knowledge with these 15 sample questions.
Question 1: What is the primary focus of an Identity and Access Management Architect?
Key takeaway: They design solutions that meet SSO and identity requirements on the platform.
Show correct answer and explanation
Correct answer: B. Designing solutions that meet Single Sign-On (SSO) and identity requirements on the Salesforce Platform
They design solutions that meet SSO and identity requirements on the platform.
- Email is unrelated to the IAM Architect's core identity/SSO focus.
- 'Only reports' undersells the role, which is about SSO and identity architecture, not reporting.
- Slack is unrelated to the IAM Architect's core identity/SSO focus.
Question 2: Which protocol is commonly used for SSO with Salesforce?
Key takeaway: SAML 2.
Show correct answer and explanation
Correct answer: C. SAML 2.0 and OAuth 2.0
SAML 2.0 and OAuth 2.0 are used for SSO and identity with Salesforce.
- 'Only SOAP' is an API messaging protocol, not the specific SSO protocols being asked about.
- 'Only HTTP' is a generic transport protocol, not the specific identity protocols (SAML/OAuth) used for SSO.
- 'Only FTP' is a file transfer protocol, unrelated to SSO.
Question 3: What does My Domain provide in Salesforce?
Key takeaway: My Domain provides custom login URL and is required for SSO and identity features.
Show correct answer and explanation
Correct answer: A. Custom login URL and foundation for SSO and identity
My Domain provides custom login URL and is required for SSO and identity features.
- 'Only reports' is unrelated to My Domain's actual identity/URL foundation purpose.
- 'Only branding' undersells My Domain, which specifically establishes the SSO/identity foundation, not just visual branding.
- 'Only dashboards' is unrelated to My Domain's actual identity/URL foundation purpose.
Question 4: Which feature allows users to log in once and access multiple connected apps?
Key takeaway: SSO allows one login to access multiple connected applications.
Show correct answer and explanation
Correct answer: D. Single Sign-On (SSO)
SSO allows one login to access multiple connected applications.
- 'Only roles' misattributes single-login access to a different access-control feature.
- 'Only profiles' misattributes single-login access to a different access-control feature.
- 'Only permission sets' misattributes single-login access to a different access-control feature.
Question 5: What is the purpose of Connected Apps in identity?
Key takeaway: Connected Apps provide OAuth-based access with configurable policies.
Show correct answer and explanation
Correct answer: D. OAuth-based access for external and internal apps with configurable policies
Connected Apps provide OAuth-based access with configurable policies.
- 'Only internal apps' undersells Connected Apps, which manage both external and internal app access.
- 'Only email' is unrelated to Connected Apps' OAuth-based access purpose.
- 'Only external apps' undersells Connected Apps, which manage both external and internal app access.
Question 6: What is an Identity Provider (IdP) in SSO?
Key takeaway: IdP authenticates users and asserts identity to Salesforce.
Show correct answer and explanation
Correct answer: C. The system that authenticates users and asserts identity to Salesforce
IdP authenticates users and asserts identity to Salesforce.
- A permission set controls object/field access, it isn't an authentication system.
- A profile controls access levels, it isn't an authentication/identity-asserting system.
- Salesforce alone isn't the IdP in this scenario, the IdP is the external system asserting identity.
Question 7: Which OAuth flow is used for server-to-server integration?
Key takeaway: Client credentials and JWT bearer are for server-to-server.
Show correct answer and explanation
Correct answer: B. Client credentials or JWT bearer
Client credentials and JWT bearer are for server-to-server.
- Authorization code flow is designed for user-facing scenarios, not server-to-server integration.
- Implicit flow is a simplified user-facing flow, not designed for secure server-to-server integration.
- Device flow is for devices without browsers, not the typical server-to-server integration scenario.
Question 8: What does Session Security Level control?
Key takeaway: Session Security Level enforces session assurance requirements.
Show correct answer and explanation
Correct answer: C. Session requirements (e.g., high assurance, require re-auth)
Session Security Level enforces session assurance requirements.
- 'Only timeout' undersells Session Security Level, which covers broader session requirements beyond just timeout.
- 'Only OWD' misattributes session security to an unrelated record-access concept.
- 'Only IP' undersells Session Security Level, which is about broader assurance/re-auth requirements, not just IP restriction.
Question 9: Which SAML attribute is used for user provisioning?
Key takeaway: Federation ID and attributes support user matching and provisioning.
Show correct answer and explanation
Correct answer: A. Federation ID and other attributes for matching/provisioning
Federation ID and attributes support user matching and provisioning.
- 'Only email' undersells the Federation ID's specific matching/provisioning role.
- 'Only role' undersells the Federation ID's specific matching/provisioning role.
- 'Only name' undersells the Federation ID, which serves the specific matching/provisioning purpose described.
Question 10: What is the purpose of Auth. Provider?
Key takeaway: Auth.
Show correct answer and explanation
Correct answer: C. To configure external IdP connection (e.g., SAML, OAuth)
Auth. Provider configures external IdP (SAML/OAuth) connection.
- 'To create users only' undersells Auth. Provider's broader identity connection purpose.
- Auth. Provider doesn't replace SSO, it configures the external connection SSO relies on.
- 'To assign permission sets' is unrelated to what an Auth. Provider configures.
Question 11: Which feature supports multi-factor authentication?
Key takeaway: 2FA and verified modes support multi-factor authentication.
Show correct answer and explanation
Correct answer: A. Two-Factor Authentication (2FA) and verified modes
2FA and verified modes support multi-factor authentication.
- 'SSO only' misattributes multi-factor authentication to a different, single-login feature.
- 'OAuth only' misattributes MFA to a different authorization protocol.
- 'SAML only' misattributes MFA to a different SSO protocol.
Question 12: What does Federation ID enable?
Key takeaway: Federation ID links Salesforce user to external identity.
Show correct answer and explanation
Correct answer: B. Linking Salesforce user to external identity for SSO and provisioning
Federation ID links Salesforce user to external identity.
- 'Only SSO' undersells Federation ID's specific role in both SSO and provisioning.
- 'Only permission sets' is unrelated to Federation ID's actual identity-linking purpose.
- 'Only OAuth' misattributes Federation ID's purpose to a different protocol.
Question 13: Which consideration applies when designing for multiple IdPs?
Key takeaway: Domain-based routing supports multiple IdPs.
Show correct answer and explanation
Correct answer: B. Domain-based routing and IdP selection logic
Domain-based routing supports multiple IdPs.
- 'Single IdP only' is the opposite of the multi-IdP scenario the question describes.
- 'Manual only' contradicts the fact that automated routing logic is the actual design consideration.
- 'No routing' contradicts the fact that domain-based routing is a real design consideration for multiple IdPs.
Question 14: What is the purpose of Certificate and Key Management?
Key takeaway: Certificate management ensures SAML and signing key trust.
Show correct answer and explanation
Correct answer: A. To manage SAML certificates and signing keys for trust
Certificate management ensures SAML and signing key trust.
- 'To create users' misattributes certificate/key management's actual trust-and-signing purpose.
- 'To assign profiles' is unrelated to certificate and key management.
- 'To create permission sets' is unrelated to certificate and key management.
Question 15: Which best practice supports identity governance?
Key takeaway: Access reviews, least privilege, and audit support governance.
Show correct answer and explanation
Correct answer: D. Regular access reviews, least privilege, and audit logging
Access reviews, least privilege, and audit support governance.
- 'No review' contradicts the fact that regular access reviews are a core identity governance best practice.
- 'No logging' contradicts the fact that audit logging is a core identity governance best practice.
- 'All access' contradicts the least-privilege principle that's central to good identity governance.
Get the Full Question Bank
Most candidates book the exam after scoring 75%+ on full mocks.
If you’re planning to test this quarter, aim to complete full mocks at least 10–14 days before your exam date.
Contact us for more information on our full 60-question mock exams and a personalized study plan. Use the contact form.
Request Mock Exams & Study PlanSalesforce Certified Platform Identity and Access Management Architect Exam FAQs
- What is covered on the Salesforce Certified Platform Identity and Access Management Architect exam?
- The Salesforce Certified Platform Identity and Access Management Architect exam (formerly Salesforce Certified Identity and Access Management Architect) covers section-wise weightage as shown above. Use the exam topics and practice questions on this page to align your study with the official outline.
- What is Identity and Access Management Architect?
- Identity and Access Management Architect designs identity solutions, SSO implementations, user provisioning, and ensures secure access management across systems.
- Do I need Application Architect before Identity Architect?
- Yes, Application Architect and System Architect are typically required. Identity Architect requires deep understanding of identity, SSO, and security.
- Are there free practice questions for the Salesforce Certified Platform Identity and Access Management Architect exam?
- Yes. This page includes free sample practice questions with explanations. Use them alongside the current official documentation.
- How do I prepare for the Salesforce Certified Platform Identity and Access Management Architect certification?
- Use the exam tips, prerequisites, and study strategy on this Salesforce Certified Platform Identity and Access Management Architect study guide (formerly Salesforce Certified Identity and Access Management Architect). Focus first on the highest-weighted sections, then take the sample practice questions. Schedule the exam when you consistently score well on practice tests.
Next Architect Certifications
This is one of the four exams for System Architect. Good next steps:
Honest Cert Breakdown
Difficulty: Hard
4/5One of the four CTA domain exams. OAuth flows, SAML, SSO, connected apps, and certificate management. Security expertise is not optional here.
Salary Range
$125,000–$165,000 / year
US average for certified professionals • Updated Summer '26 • Source: Salesforce Talent Ecosystem
Is it worth it?
Required on the CTA path. Highly valuable in enterprises with complex identity requirements, financial services, healthcare, government.
Section Breakdown
Section-by-Section Breakdown
Identity Protocols & Concepts
SAML 2.0: assertions (authentication, attribute, authorisation), SP-initiated vs IdP-initiated SSO flows. OAuth 2.0: authorisation code, implicit, client credentials, device, JWT bearer token flows. OpenID Connect: ID token, UserInfo endpoint, OIDC as identity layer on top of OAuth. When to use SAML vs OAuth vs OIDC.
SSO Design & Implementation
Configuring Salesforce as an Identity Provider (IdP) and as a Service Provider (SP). My Domain: requirement for SSO, custom subdomain design. Federated authentication vs delegated authentication vs Salesforce-managed credentials. Just-in-time (JIT) provisioning for user creation via SSO. Single Logout (SLO) design.
OAuth & Connected Apps
Connected Apps: creating, configuring scopes, IP relaxation, permitted users, session policies. Named credentials: per-user vs named principal OAuth. OAuth flows: which flow for which use case, web app (Web Server), mobile (PKCE), server-to-server (JWT Bearer), legacy (Username-Password). Token storage, refresh tokens, and expiry.
Community & External Identity
Experience Cloud identity: self-registration, social login (Google, Facebook, LinkedIn), External Identity licences. Auth providers: configuring third-party social login via Auth Provider framework. Registration handlers: custom Apex to control user provisioning from external IdPs. Digital experiences and B2C identity patterns.
MFA & Security Policies
Salesforce MFA enforcement: Salesforce Authenticator, TOTP apps, security keys. MFA requirement timeline and enforcement for direct logins. Session security levels and policies. IP restrictions: trusted IP ranges at org level, profile level, connected app level. Login hours and session timeout configuration.
10-Week Study Plan
How to Read Scenario Questions
- 1.SAML = SSO for enterprise users; OAuth = API access: When a scenario says "employees need to log into Salesforce using their corporate credentials," the answer is SAML SSO. When a scenario says "an application needs to access Salesforce data on behalf of a user," the answer is OAuth 2.0.
- 2.JWT Bearer for server-to-server: Any scenario involving background jobs, integration middleware, or automated processes accessing Salesforce APIs, without a user present, should use JWT Bearer Token flow. Never Username-Password flow for production systems.
- 3.JIT for large user populations: If a scenario involves many external users who should be automatically provisioned, JIT is the correct answer over manual user creation or pre-provisioning scripts. JIT can create and update users with every login.
- 4.My Domain is required: SSO, connected apps with OAuth, and Lightning features all require My Domain. Any question about enabling SSO for an org assumes My Domain is configured first.
Readiness Benchmark
Aim for 75%+ on practice exams before scheduling. IAM Architect is protocol-heavy, many candidates who know Salesforce well struggle because they haven’t worked with SAML and OAuth deeply. Hands-on SSO configuration is the best preparation. If you can configure SSO end-to-end from scratch, you are ready.
10 Must-Know Concepts
- SAML 2.0: IdP vs SP roles, assertion types, SP-initiated vs IdP-initiated flows
- OAuth 2.0 flows: when to use each (Web Server, JWT Bearer, Client Credentials, Device)
- OpenID Connect: ID token, UserInfo endpoint, OIDC vs OAuth scope
- My Domain: why it is required, custom subdomain, login policy settings
- JIT provisioning: attribute mapping, user creation and update on login
- Connected Apps: scopes, IP relaxation, permitted users, session policies
- Named credentials: per-user OAuth vs named principal, when each applies
- Auth Providers: configuring social login, custom registration handlers
- MFA: Salesforce Authenticator, TOTP, security keys, enforcement levels
- Session security: trusted IP ranges, login hours, session timeout, security levels
Common Questions
- What is the Salesforce IAM Architect certification?
- The Identity & Access Management Architect certification validates expertise in designing identity solutions for Salesforce, including SSO (SAML, OAuth, OIDC), connected apps, external identity for Experience Cloud, MFA enforcement, and session security. The exam has 60 questions, ~110-minute time limit, 65% passing score, and a $400 fee. It is part of the System Architect credential path.
- What is the difference between SAML and OAuth?
- SAML (Security Assertion Markup Language) is an XML-based protocol designed for SSO, it passes authentication assertions between an Identity Provider and a Service Provider, allowing users to sign in once and access multiple applications. OAuth 2.0 is an authorisation framework, it grants applications access to resources on behalf of a user without sharing credentials. OpenID Connect (OIDC) adds an identity layer on top of OAuth, returning a signed ID token with user identity claims. For Salesforce SSO, SAML is traditional enterprise IdP integration; OAuth/OIDC is used for API access and modern apps.
- What is JIT provisioning in Salesforce?
- Just-in-Time (JIT) provisioning automatically creates or updates a Salesforce user account when they first log in via SSO, using attributes passed in the SAML assertion. Without JIT, you must pre-create user accounts before SSO works. With JIT, the IdP passes user attributes (name, email, profile, role) in the SAML assertion, and Salesforce creates the account on first login. JIT can also be used to update user attributes on every login.
- Which OAuth flow should I use for server-to-server integration?
- For server-to-server integrations where no user is present (background jobs, integration middleware). Use the OAuth 2.0 JWT Bearer Token Flow. The server signs a JWT with a private key (the corresponding certificate is uploaded to the Connected App), and exchanges it for an access token, no user interaction required. This is more secure than Username-Password flow (which passes credentials in the request) and is the recommended pattern for Salesforce APIs in automated processes.
- How long should I study for the IAM Architect exam?
- Plan for 10–12 weeks with 10–15 hours per week. The exam requires deep understanding of identity protocols that many Salesforce developers have not worked with extensively. Set up SSO in a Salesforce dev org using a free IdP (like Okta Developer, Auth0, or PingOne free tier) to gain hands-on experience. Configuring both SP-initiated and IdP-initiated SSO, connected apps, and JIT provisioning in a real environment significantly improves exam performance.
Where to Go Next
After this certification, consider: Application Architect, System Architect, or Technical Architect (CTA).
Topic Difficulty Heatmap
Which topics are a gimme vs which ones trap confident candidates. Use this to prioritise your final-week revision. These are our own topic groupings for study planning, not the official exam sections, those and their weightings are in the credential's exam guide.
| Topic | Difficulty | Study Tip |
|---|---|---|
| Identity and Single Sign-On | Hard | SAML, OAuth, and federation, flow and configuration are heavily tested. |
| Access Management | Trap ⚠ | Permission sets, profiles, and session security, identity vs access confusion. |
| Security and Compliance | Moderate | Audit and compliance requirements. Know the Salesforce security features. |
| Integration | Moderate | Identity for integrations and external IdP, common scenario topic. |
Difficulty based on analysis of common candidate errors across each exam section.
Put It Into Practice
Free IAM Architect practice questions covering SAML, OAuth, SSO design, and connected apps.
Start Free Practice QuestionsFast Facts: IAM Architect Focus Areas
- OAuth flows: All five OAuth 2.0 flows, when each is appropriate, and the security trade-offs. JWT Bearer Token and Web Server flows are the most tested for enterprise scenarios.
- SAML and SSO: SAML 2.0 configuration (IdP-initiated vs. SP-initiated), federation with external identity providers, and Just-in-Time (JIT) provisioning.
- Connected Apps and scopes: Connected App design, OAuth scopes, IP restrictions, session policies, and when to use Named Credentials vs. Connected Apps for integrations.
Section Weightings to Prioritise
Identity Fundamentals + SSO = 54%. OAuth flows and SAML configuration are your most critical study areas.
Scenario Strategy: How to Approach IAM Questions
IAM questions describe an authentication or integration scenario and ask which OAuth flow, SAML configuration, or identity pattern is correct. The key is identifying who initiates the flow and whether a user is involved.
- Server-to-server with no user interaction = JWT Bearer Token flow. User logs in via web browser = Web Server flow. Mobile app with user = User-Agent flow. Legacy system with no browser = Username-Password (flag as insecure but still tested).
- For SSO questions: IdP-initiated means the user starts at the identity provider; SP-initiated means the user starts at Salesforce. Know both flows and which metadata needs to be exchanged.
- JIT provisioning creates/updates Salesforce users on first login using attributes in the SAML assertion. Use it when you cannot pre-provision users in bulk.
- For MFA questions: Salesforce requires MFA for all users. Verify whether a third-party MFA (from an IdP like Okta) satisfies the Salesforce MFA requirement; it does if configured correctly.
How to Know You’re Ready
75%+ on 3 timed full mocks before booking
IAM Architect has a steep learning curve for candidates who haven’t configured SSO or OAuth in a real environment. Build a Connected App, configure SSO with an identity provider, and test each OAuth flow in a sandbox before sitting the exam.
3 Concepts That Fail Most Identity & Access Management Architect Candidates
These are not the hardest topics; they are the ones where candidates are most confidently wrong. Learn the distinction early.
1. OAuth 2.0 Flows: Authorization Code vs JWT Bearer vs Client Credentials
Authorization Code flow is for user-facing apps where a human logs in (most common). JWT Bearer flow is for server-to-server integration where a trusted server asserts a user identity without a login prompt. Client Credentials flow is for machine-to-machine with no user context. Candidates use Authorization Code for server integrations, the exam expects JWT Bearer for server-to-server with user context assertion and Client Credentials for pure system calls.
2. Named Credentials vs Auth. Providers: Outbound vs Inbound Identity
Named Credentials store the endpoint URL, authentication method, and credentials for Salesforce making outbound callouts to external systems. Auth. Providers configure Salesforce as a service provider (SP) for inbound Single Sign-On, external users log in via an external Identity Provider (IdP). Candidates configure Named Credentials for SSO, the exam expects Auth. Provider + SAML or OIDC for SSO and Named Credentials for outbound callouts.
3. Delegated Authentication vs SSO: Custom Login vs Federated Identity
Delegated Authentication calls a custom web service endpoint to validate Salesforce login credentials against an external system (legacy LDAP integration). SAML/OIDC SSO federates identity by trusting an external IdP’s assertion without re-validating credentials. Delegated Auth is legacy and should not be recommended for new implementations, the exam expects SAML or OIDC SSO for modern identity federation.
FAQs From Candidates
- What is the Salesforce IAM Architect exam format?
- The Salesforce Identity & Access Management Architect exam has 60 multiple-choice questions, a 105-minute time limit, a 65% passing score, and a $200 fee. It is a component exam for the System Architect role-based credential and tests SSO, OAuth, SAML, and identity federation architecture.
- What are the highest-weight IAM Architect exam sections?
- Salesforce Identity Fundamentals (28%) and Single Sign-On (26%) together account for 54% of the IAM Architect exam. OAuth flows, SAML configuration, and Connected App design are the most heavily tested topics.
- What is the hardest part of the IAM Architect exam?
- OAuth flow selection is the most nuanced section; candidates must know all five OAuth flows (Web Server, User-Agent, JWT Bearer Token, Username-Password, Device), when each is appropriate, and the security implications of each. SAML vs. OAuth decision-making for SSO scenarios is also heavily tested.
- What prerequisites help with the IAM Architect exam?
- Salesforce Administrator (ADM-201) knowledge of profiles, permission sets, and the Salesforce security model is the best foundation. Real experience configuring SSO with an identity provider (Okta, Azure AD, Ping), setting up Connected Apps, and troubleshooting OAuth flows is essential.
- What concepts do most Identity & Access Management Architect candidates get wrong?
- The most commonly misunderstood topics for the Identity & Access Management Architect exam are: (1) OAuth 2.0 Flows: Authorization Code vs JWT Bearer vs Client Credentials; (2) Named Credentials vs Auth. Providers: Outbound vs Inbound Identity; (3) Delegated Authentication vs SSO: Custom Login vs Federated Identity. Candidates are most confidently wrong on these. Learn the distinctions early to avoid losing marks on questions you expect to get right.
- Why do most Identity Access Management Architect candidates fail questions about OAuth 2.0 Flows?
- Authorization Code flow is for user-facing apps where a human logs in (most common). JWT Bearer flow is for server-to-server integration where a trusted server asserts a user identity without a login prompt. Client Credentials flow is for machine-to-machine with no user context. Candidates use Authorization Code for server integrations, the exam expects JWT Bearer for server-to-server with use...
- Why do most Identity Access Management Architect candidates fail questions about Named Credentials vs Auth. Providers?
- Named Credentials store the endpoint URL, authentication method, and credentials for Salesforce making outbound callouts to external systems. Auth. Providers configure Salesforce as a service provider (SP) for inbound Single Sign-On, external users log in via an external Identity Provider (IdP). Candidates configure Named Credentials for SSO, the exam expects Auth. Provider + SAML or OIDC for...
- Why do most Identity Access Management Architect candidates fail questions about Delegated Authentication vs SSO?
- Delegated Authentication calls a custom web service endpoint to validate Salesforce login credentials against an external system (legacy LDAP integration). SAML/OIDC SSO federates identity by trusting an external IdP's assertion without re-validating credentials. Delegated Auth is legacy and should not be recommended for new implementations, the exam expects SAML or OIDC SSO for modern identit...
Keep Studying
Start IAM Architect Prep
After this exam, consider Application Architect or System Architect next.
Share or cite this study guide
Free to link from a forum post, study repo or article. Copy the Markdown and paste it anywhere.