Salesforce Identity & Access Management Architect Study Guide (Spring '26)

Exam Sections & Weightings

10-Week Study Plan

Scenario Strategy Tips

• 1.SAML = SSO for enterprise users; OAuth = API access: When a scenario says "employees need to log into Salesforce using their corporate credentials," the answer is SAML SSO. When a scenario says "an application needs to access Salesforce data on behalf of a user," the answer is OAuth 2.0.
• 2.JWT Bearer for server-to-server: Any scenario involving background jobs, integration middleware, or automated processes accessing Salesforce APIs — without a user present — should use JWT Bearer Token flow. Never Username-Password flow for production systems.
• 3.JIT for large user populations: If a scenario involves many external users who should be automatically provisioned, JIT is the correct answer over manual user creation or pre-provisioning scripts. JIT can create and update users with every login.
• 4.My Domain is required: SSO, connected apps with OAuth, and Lightning features all require My Domain. Any question about enabling SSO for an org assumes My Domain is configured first.

Top 10 Concepts to Review

1. SAML 2.0: IdP vs SP roles, assertion types, SP-initiated vs IdP-initiated flows
2. OAuth 2.0 flows: when to use each (Web Server, JWT Bearer, Client Credentials, Device)
3. OpenID Connect: ID token, UserInfo endpoint, OIDC vs OAuth scope
4. My Domain: why it is required, custom subdomain, login policy settings
5. JIT provisioning: attribute mapping, user creation and update on login
6. Connected Apps: scopes, IP relaxation, permitted users, session policies
7. Named credentials: per-user OAuth vs named principal — when each applies
8. Auth Providers: configuring social login, custom registration handlers
9. MFA: Salesforce Authenticator, TOTP, security keys — enforcement levels
10. Session security: trusted IP ranges, login hours, session timeout, security levels

Frequently Asked Questions

What is the Salesforce IAM Architect certification?

The Identity & Access Management Architect certification validates expertise in designing identity solutions for Salesforce — including SSO (SAML, OAuth, OIDC), connected apps, external identity for Experience Cloud, MFA enforcement, and session security. The exam has 60 questions, ~110-minute time limit, ~68% passing score, and a $400 fee. It is part of the System Architect credential path.

What is the difference between SAML and OAuth?

SAML (Security Assertion Markup Language) is an XML-based protocol designed for SSO — it passes authentication assertions between an Identity Provider and a Service Provider, allowing users to sign in once and access multiple applications. OAuth 2.0 is an authorisation framework — it grants applications access to resources on behalf of a user without sharing credentials. OpenID Connect (OIDC) adds an identity layer on top of OAuth, returning a signed ID token with user identity claims. For Salesforce SSO, SAML is traditional enterprise IdP integration; OAuth/OIDC is used for API access and modern apps.

What is JIT provisioning in Salesforce?

Just-in-Time (JIT) provisioning automatically creates or updates a Salesforce user account when they first log in via SSO, using attributes passed in the SAML assertion. Without JIT, you must pre-create user accounts before SSO works. With JIT, the IdP passes user attributes (name, email, profile, role) in the SAML assertion, and Salesforce creates the account on first login. JIT can also be used to update user attributes on every login.

Which OAuth flow should I use for server-to-server integration?

For server-to-server integrations where no user is present (background jobs, integration middleware), use the OAuth 2.0 JWT Bearer Token Flow. The server signs a JWT with a private key (the corresponding certificate is uploaded to the Connected App), and exchanges it for an access token — no user interaction required. This is more secure than Username-Password flow (which passes credentials in the request) and is the recommended pattern for Salesforce APIs in automated processes.

How long should I study for the IAM Architect exam?

Plan for 10–12 weeks with 10–15 hours per week. The exam requires deep understanding of identity protocols that many Salesforce developers have not worked with extensively. Set up SSO in a Salesforce dev org using a free IdP (like Okta Developer, Auth0, or PingOne free tier) to gain hands-on experience. Configuring both SP-initiated and IdP-initiated SSO, connected apps, and JIT provisioning in a real environment significantly improves exam performance.