Thinking Like an Identity Architect

Chapter 1 of Securing Salesforce: Identity and Access, Part 1: Who Are You? Start here.

Here’s the question for this chapter. Identity has a reputation: people who’ve worked on Salesforce for years are nervous about it. Why, and what does it really take?

My answer is that identity is intricate, not hard. It’s set up once and then left to run, so few people ever get to practice it. The settings are few, but each one is exact, and the real skill is learning the back-and-forth between the parties. This chapter gives you that way of looking before any mechanism: what the course will give you, the diagram it runs on, and why none of it stays set.

The ideas in this chapter

Set it up once, and it just runs. That’s why identity feels hard: not because it is, but because nobody practices it.
Intricate, not hard. A few settings, each one exact. It’s 5 dollars to turn the screw, and 295 to know which screw.
Learn the switching. Almost every mechanism is a ping-pong match between a few parties. Learn the steps of the dance, not the screens.
Two goals. Pass the exam, and know what to do on a real project. The course alternates between them.
Know the exam’s date. Six sections, each with a weight, aligned to Summer ‘23. The platform has moved since.
One route, three parts. People in a browser first; then the mechanisms in both directions; then everyone outside the company, the agents, and running it.
The swim lane is identity’s diagram. One lane per party, time running down the page, every call with its answer.
A redirect is a code in the 300s: “go there instead”. The browser follows it by itself. In OAuth, the last one carries a code to the app, which makes its own call.
The browser is the broker. During a login, the servers usually don’t call each other; they redirect the browser.
Whichever lane shows the login screen is the identity provider. Circle it every time.
Security keeps changing. Two OAuth flows retire on February 20, 2027; new connected apps are restricted; MFA covers every employee login; single sign-on logins need Device Activation. So every fact in this course has a date.

The picture

Here’s the picture the course turns on: a login, read as a swim lane, one row at a time. Each row is one call from the browser and its answer back to it.

Click to enlarge

Look for the arrow that isn’t there: the instance never calls the login server. It sends your browser, and your browser goes. Every chapter after this one adds lanes to that picture.

The path through this chapter

Four modules, each standing on its own.

Intricate, Not Hard. Why identity feels hard; this isn’t rocket science; the auto mechanic and the screw; the ping-pong match; and why you should build it to remember it.
Two Goals, One Route. Pass the exam, then go deeper; the exam’s six sections and weights, dated; the three parts of the course; and why this order.
Read a Swim Lane. Every domain has its diagram; the tennis match; the parts of a swim lane; what a redirect is, and its two kinds; one login, row by row; the browser is the broker; who shows the login screen; and five questions for reading any swim lane.
Security Keeps Changing. The retired OAuth flows, the end of new connected apps, MFA for every employee login, and Device Activation for single sign-on, each in Salesforce’s words and dated; the pattern behind them; and how this course dates things.

Then draw one yourself. The practice has you watch your own login and draw it as a swim lane, with a model answer to check against. And check what stuck with the study guide.

What an architect decides here

This chapter decides no setting. It sets the habits every later decision uses:

Draw it first. Every identity design starts as a swim lane, with every call and its answer.
Name the identity provider: the one lane that shows the login screen.
Write it down when it’s set up, because it will run for years after the people who built it have moved on.
Date every fact and every decision, and put the retirement dates in the plan.
Study for both goals: what the exam asks, and what the project needs.

Beyond the exam: what AI changes. Agents log in too, through the same doors. On the swim lane, an agent is one more lane, and alongside “who is this?” comes a second question: “who is this acting for?” Chapter 17 draws it. What AI doesn’t change is this chapter’s point: someone still has to know which screw, and draw the lanes before changing anything.

Explore

Each module lists its own sources, each checked 2026-11-07. Two to start with:

Salesforce Certified Platform Identity and Access Management Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07)
Prepare for MFA Enforcement for All Employee Users (opens in a new tab), Salesforce Help (checked 2026-11-07)

Next: The Front Door: Logging In to Salesforce