Study guide
Study guide for chapter 13 of the Securing Salesforce: Identity and Access course. Read the five modules first; this page helps you check what stuck.
About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.
This chapter carries four of the Identity and Access Management Architect exam’s objectives: the app’s scope and configuration, and OAuth’s working parts (Salesforce as an Identity Provider, 17% of the exam); and the app’s configuration settings and MFA’s session (Access Management Best Practices, 15%). The exam guide aligns to Summer ‘23 and says “connected apps”; it predates external client apps’ place as the default, refresh token rotation, the idle limit and DPoP. Check its current version before you book.
For the Exam
Section titled “For the Exam”Tick them off as you go. Each one links to where it’s taught.
The app (supports IDP-2, AMB-4)
- I know every OAuth flow goes through an app, and what its client ID and scopes control. (Every flow went through an app)
- I know an app’s settings (the developer’s) are separate from its policies (the admin’s, in this org only). (What an external client app is)
- I know where connected apps stand: new ones restricted since Spring ‘26, support ends Summer ‘27. (The connected apps orgs still have)
The policies (supports IDP-2, AMB-4, AMB-1)
- I know Permitted Users: self-authorize, or admin approved users are pre-authorized by profile or permission set. (Who may use it?)
- I know Use Any API Client bypasses pre-authorization. (Who may use it?)
- I know the scopes limit what an app can do, and to give the fewest. (What may it do?)
- I know the session timeout order, High assurance session required, and that high assurance needs a flow with a person approving. (How long, and how strong?)
- I know Block this application ends every session. (How long, and how strong?)
The tokens (supports IDP-3)
- I know what a refresh token is for, and that it comes with a person’s approval. (How often do you log in to your streaming app?)
- I know rotation, and what happens when a rotated-out token is used. (Each pass works once: rotation)
- I know the 30-day idle limit, a sliding window. (An unused pass expires: the idle limit)
- I know the three ways to revoke: the user, the admin, and the revoke endpoint. (Taking it back)
Beyond the Exam
Section titled “Beyond the Exam”The exam is the floor, not the ceiling. These are the habits from this chapter that an architect needs, whether or not a question ever asks about them.
- Look at every app, on the Insights and OAuth Usage pages, on a schedule.
- An app per line, so you can block one without stopping the rest.
- Assign before you restrict when you switch an app to pre-authorized users.
- Rotation, the idle limit, IP allowlists and DPoP where they fit.
- A revoke runbook for every partner integration.
- No codes over the phone, no secrets in records.
- A plan and a date for every retired mechanism.
Words to Know
Section titled “Words to Know”| Term | In one line |
|---|---|
| External client app | The app every OAuth and SAML connection goes through; the new default |
| Connected app | The older kind; new ones restricted since Spring ‘26, unsupported from Summer ‘27 |
| Settings and policies | The developer’s half, packaged; the admin’s half, this org only |
| Local or packaged | Made and used in one org, or distributed to others |
| Permitted Users | Who may use the app: self-authorize, or admin pre-authorized |
| Use Any API Client | A permission that bypasses an app’s pre-authorization |
| High assurance session required | A policy that requires MFA to use the app |
| Insights page | Shows every app’s security controls, on or off |
| OAuth Usage page | Shows who’s connected to an external client app; lets you block it |
| Refresh token rotation | A new refresh token at every use; reuse revokes the chain |
| Idle limit | A refresh token unused for 30 days expires |
| DPoP | Binds tokens to the app’s private key, so a stolen one is useless |
| API Access Control | Only approved apps can reach the API; requested from Support |
Check Yourself
Section titled “Check Yourself”Short scenarios in the style of the course. Decide your answer before you open it.
1. An admin switches a widely used app to "Admin approved users are pre-authorized", and everyone loses access. What went wrong?
Nobody was pre-authorized yet. Assign the profile or permission set to the app first, then switch the policy. Reread Who may use it?.
2. An app is set to pre-authorized users only, but a user who isn't on the list can still use it. Why?
The user probably has Use Any API Client, which bypasses pre-authorization. Reread Who may use it?.
3. A security team requires MFA for a sensitive app, and wants the same for a JWT bearer integration. What do you tell them?
High assurance works for flows with a person approving, such as the web server flow; JWT bearer has nobody to ask for MFA. Protect it another way: pre-authorized users, few scopes, the private key in a vault. Reread How long, and how strong?.
4. A refresh token copied from an app's logs is used by someone else, and the real app then can't refresh either. What happened, and is it good?
Rotation: a rotated-out token was used, so Salesforce revoked the whole chain. Yes: the thief got nothing, and the forced sign-in means someone notices. Reread Each pass works once: rotation.
5. A partner tells you its systems were breached, and it holds tokens for your org. What do you do first?
Block its app on the OAuth Usage page and revoke its tokens, then rotate its secret and read the logs. Reread Taking it back and Door 2.
6. An employee says IT support called and asked them to type a code at a Salesforce page ending in /setup/connect. What was it, and what stops it?
The device flow’s verification page: the caller’s app was being approved as the employee. Device flow restricted to local apps, uninstalled apps restricted, pre-authorized users, and telling people IT never asks for that. Reread Door 1.
7. An org has forty connected apps. What's the plan before Summer '27?
Find them on the Insights page, retire the ones nobody uses, and migrate the rest with Migrate to External Client App, checking each one’s controls. Reread The connected apps orgs still have.
Watch it on video
Section titled “Watch it on video”My 2024 exam preparation video, part 2, walks the exam guide across this part of the course, from OAuth to every flow. The note under the video says what’s still right and what’s changed since.
Explore
Section titled “Explore”- Configure the External Client App OAuth Settings (opens in a new tab), Salesforce Help (Winter ‘27; checked 2026-11-07)
- Salesforce Certified Platform Identity and Access Management Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07)
The official list of objectives and their weights. Always check the current version before you book an exam.