Updated for Summer '26
New to this track? Our Salesforce Certified System Architect exam prep is the recommended first step. See our certification path to understand where this certification fits. The Salesforce Certified Platform Identity and Access Management Architect exam weights Identity and Single Sign-On most heavily (30%) — see the full breakdown, study tips, and practice questions below. See our full study guide for deep section coverage. Ready to book? Read our exam tips and study plan.
Join 800+ passed this month • Updated for 2026 • No sign-up required
Updated for Summer '26
This page is reviewed every release to stay aligned with the current exam blueprint.
Exam Blueprint Aligned
Section weightages match the official Summer '26 exam guide
Questions Reviewed
Practice questions and explanations checked each release cycle
Works on Any Device
Full practice experience on phone, tablet, or desktop
Free, No Sign-Up
Start practicing immediately — no account or email required
Written & verified by Krishna Mohan
5× Salesforce Certified · 12+ years in data engineering & Salesforce · Updated for Summer '26
Who is the Identity and Access Management Architect exam for?
- Identity Architects: Security professionals who design SSO, OAuth, and SAML configurations for enterprise Salesforce integrations with corporate identity providers.
- Integration Specialists: Developers and architects who build server-to-server and user-facing authentication flows between Salesforce and external applications.
- Security Engineers: Engineers responsible for MFA enforcement, Connected App policies, and identity federation across multi-org or multi-cloud Salesforce environments.
Exam Fees & Registration
Exam Fee
$400
One-time registration fee
Retake Fee
$200
If you need to retake the exam
Comparing certs? View all Salesforce exam fees in one place →
Certification Validity
Your Salesforce Certified Platform Identity and Access Management Architect certification is valid for 3 years from the date you pass the exam. You'll need to maintain your certification through continuing education or retake the exam.
How to Register
Register for the Salesforce Certified Platform Identity and Access Management Architect exam through the official Salesforce certification portal.
Register for ExamExam data verification: questions, duration, passing score, fees, and section coverage were checked against official source references on .
Official sources: Salesforce exam pricing·Independent prep resource; no braindumps or leaked exam questions.
Salesforce Certified Platform Identity and Access Management Architect – Complete Summer '26 Guide
This exam tests SSO architecture, OAuth 2.0 flows, SAML configuration, and Connected App security on the Salesforce Platform. You’ll need to match authentication patterns to integration scenarios and configure MFA, My Domain, and identity federation.
Recommended Prerequisites
We recommend completing this certification first to prepare you better.
Salesforce Certified Platform Identity and Access Management Architect Exam Weightage by Section
Exam Topics
Exam Tips
- 1Identity and SSO + Access Management are 60%—know SAML, OAuth, SSO flows, and user provisioning.
- 2Understand federation, delegated authentication, and when to use each.
- 3Know security and compliance: MFA, session management, audit trails.
- 4Be ready for "how would you implement SSO for X scenario?" questions.
Prerequisites
- •Application Architect
- •System Architect
- •Identity and security experience
Focus Areas
- •Identity and Single Sign-On
- •Access Management
- •Security and Compliance
- •Integration
Study Strategy
Design identity solutions for various scenarios.
Understand SSO flows, federation, and user lifecycle management.
Practice explaining security trade-offs.
Exam Format and First-Attempt Readiness
The Salesforce Certified Platform Identity and Access Management Architect exam has 60 questions in 105 min, passing score ~58%. Most Salesforce exams test scenario-based decisions — focus on when to use each feature, not just terms.
- Study Identity and Single Sign-On and Access Management first — together they carry 60% of the exam.
- Do timed question sets. Build pacing and confidence.
- Review why wrong answers are wrong. It improves scenario reasoning.
- Book the exam once your mock scores are steady above ~58%.
Is the Identity and Access Management Architect Exam Hard?
Is the Identity and Access Management Architect Exam Hard?
The IAM Architect exam is demanding because it requires precise knowledge of authentication protocols — SAML 2.0, OAuth 2.0, and their many variations. You must match the correct flow to a specific integration scenario and understand the security implications of each choice. Memorizing flow names is not enough; the exam tests whether you know which flow to recommend when given specific constraints like no browser access, machine-to-machine communication, or mobile-first requirements.
- 60 questions in 120 minutes — protocol-specific questions require exact knowledge of flow mechanics and configuration steps.
- ~68% passing score — about 41 correct answers, with multiple OAuth flow options that look similar but serve different use cases.
- Protocol precision — questions test the difference between JWT Bearer, Client Credentials, Web Server, and Device flows at a configuration level.
- SSO architecture — expect questions on SP-initiated vs. IdP-initiated flows, Federation ID mapping, certificate management, and multi-IdP routing.
Pass Rate Guidance
Book the exam when you can diagram every OAuth 2.0 flow from memory, configure a SAML SSO setup end to end, and explain when Salesforce should act as IdP vs. SP.
Identity and Access Management Architect Exam Format Explained
Identity and Access Management Architect Exam Format Explained
The exam is proctored online or in-person. Here is the format:
Total Questions
60 scored questions
Time Limit
105 min
Passing Score
~58%
Question Type
Multiple-choice & multiple-select
How Many Questions Are Scenario-Based?
Most questions describe an integration or authentication scenario and ask you to select the correct OAuth flow, SSO configuration, or identity architecture to meet the requirements.
Best Way to Pass on Your First Attempt
- Map every OAuth flow to its use case: Web Server for interactive login, JWT Bearer for server-to-server, Client Credentials for machine-to-machine, Device for browserless clients, and PKCE for mobile apps.
- Configure SAML from both sides: Know how to set up Salesforce as both a Service Provider and an Identity Provider, including certificate exchange, assertion attributes, and Federation ID mapping.
- Study Connected App security: Understand OAuth scopes, IP restrictions, session policies, and how certificate-based authentication eliminates shared secrets.
- Know MFA enforcement rules: Understand how MFA interacts with SSO (IdP-provided vs. Salesforce-enforced), which methods are supported, and how session security levels affect high-assurance access.
Identity and Access Management Architect: Key Concepts for the Exam
Identity Fundamentals: Authentication vs Authorisation
Authentication verifies who you are (login). Authorisation determines what you can access (permissions). An Identity Provider (IdP) authenticates users and issues assertions. A Service Provider (SP) relies on the IdP's assertion to grant access. Salesforce can act as both — as an IdP for connected apps and external systems, and as an SP when receiving SSO from corporate identity systems like Okta or Azure AD. Understanding this distinction is the foundation for all IAM exam questions.
SAML 2.0 SSO: SP-Initiated vs IdP-Initiated
SAML 2.0 is the standard for web SSO. SP-Initiated SSO: the user accesses Salesforce, gets redirected to the IdP for login, the IdP sends a SAML assertion back to Salesforce. IdP-Initiated SSO: the user logs in at the IdP portal first, then accesses Salesforce from there — no redirect needed. My Domain is required for SSO — it provides the Salesforce login URL that the IdP redirects to. The exam tests the SSO flow direction, how to configure the SAML settings, and certificate management.
OAuth 2.0 Flows: Server, JWT, and Client Credentials
Web Server Flow (Authorization Code): user-facing, browser redirect, best for interactive login. JWT Bearer Flow: server-to-server, no user interaction — client signs a JWT with a private key registered as a certificate on the Connected App. Client Credentials Flow: machine-to-machine authentication using client ID & secret. Device Flow: for devices without browsers (smart TV, IoT). PKCE (Proof Key for Code Exchange): protects mobile apps against authorization code interception. The exam presents an integration scenario and asks which OAuth flow is appropriate.
Connected Apps: Scopes, Policies, and Sessions
Connected Apps define the OAuth configuration — scopes (which Salesforce data the app can access), IP ranges, session duration, and refresh token policy. OAuth scopes include api, full, refresh_token, web, chatter_api, and others. The Manage Connected Apps permission is required to modify policies. IP allowlists on Connected Apps can restrict which IPs can obtain tokens. Certificate-based authentication (mutual TLS) eliminates shared secrets by using client certificates for authentication.
MFA, My Domain, and Identity Connect
Multi-Factor Authentication (MFA) is now required for all Salesforce users — admins cannot disable it org-wide. MFA methods: Salesforce Authenticator (push notification), TOTP apps (Google Authenticator), security keys (WebAuthn). My Domain customises the Salesforce login URL and is required for SSO, custom components, and some lightning features. Identity Connect (Salesforce Identity for AD) syncs Active Directory users to Salesforce — supports LDAP directory integration for provisioning and deprovisioning.
In SP-initiated SSO, the user hits Salesforce (the Service Provider), gets redirected to the Identity Provider to authenticate, and returns with a signed SAML assertion that Salesforce validates before granting a session.
How to Pass the Salesforce Identity and Access Management Architect Exam
The IAM Architect exam tests deep knowledge of authentication, authorization, and identity federation. Focus on OAuth flows, SAML configuration, Connected Apps, and how to secure both Salesforce and external applications.
OAuth 2.0 Flows
Know all OAuth flows: Web Server (authorization code), User-Agent (implicit), Username-Password, JWT Bearer, Device, and Refresh Token flows. Match each flow to its use case and security characteristics.
SAML & SSO Configuration
Understand how SAML 2.0 enables SSO: SP-Initiated vs. IdP-Initiated flows, assertion attributes, Federation IDs, and how to configure Salesforce as a SP or IdP. Know common troubleshooting steps.
Connected Apps & Scopes
Know how Connected Apps control external system access to Salesforce APIs. Understand OAuth scopes, IP restrictions, user provisioning (SCIM), and how policies control access.
Multi-Factor Authentication
Know MFA enforcement methods: Salesforce Authenticator, TOTP apps, security keys. Understand how MFA interacts with SSO (IdP-provided MFA vs. Salesforce MFA), and the MFA enforcement timeline implications.
Salesforce Identity Features
Know User Provisioning for Connected Apps, Identity Connect (AD sync), Login Flows for custom authentication logic, and how External Identity licenses differ from internal user licenses.
Is the Salesforce Certified Platform Identity and Access Management Architect Exam Hard?
DifficultyChallenging; plan about 8-16 weeks of focused prep.
Book When ReadyScore 85%+ on three timed mocks before scheduling.
Use Practice, Not DumpsOriginal practice questions build skill without risking your credential.
Exam format: 60 questions, 105 min, ~58% passing score.
Get the Full Question Bank
Most candidates book the exam after scoring 75%+ on full mocks.
If you’re planning to test this quarter, aim to complete full mocks at least 10–14 days before your exam date.
Want to ensure you pass on your first try? Contact us for more information on our full 60-question mock exams and a personalized study plan. You can also reach out to km.krishnamohan25@gmail.com.
Request Mock Exams & Study PlanSalesforce Certified Platform Identity and Access Management Architect Exam FAQs
- What is covered on the Salesforce Certified Platform Identity and Access Management Architect exam?
- The Salesforce Certified Platform Identity and Access Management Architect exam—formerly Salesforce Certified Identity and Access Management Architect— covers section-wise weightage as shown above. Use the exam topics and practice questions on this page to align your study with the official outline.
- What is Identity and Access Management Architect?
- Identity and Access Management Architect designs identity solutions, SSO implementations, user provisioning, and ensures secure access management across systems.
Next Architect Certifications
After this architect certification, progress toward CTA or other architect domains: