Study guide
Study guide for chapter 1 of the Securing Salesforce: Identity and Access course. Read the four modules first; this page helps you check what stuck.
About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.
This chapter has no exam objective of its own. It’s the frame for all of them: how the exam is laid out, the diagram that makes every flow readable, and what has changed since the exam’s release alignment. The swim lane supports the first objective in the Identity Management Concepts section (17%): describing common authentication patterns and how they differ. Chapters 2 to 5 teach it in depth.
For the Exam
Section titled “For the Exam”Tick them off as you go. Each one links to where it’s taught.
The exam itself
- I can name its six sections and their weights: Identity Management Concepts 17%, Accepting Third-Party Identity in Salesforce 21%, Salesforce as an Identity Provider 17%, Access Management Best Practices 15%, Salesforce Identity 12%, Community (Partner and Customer) 18%. (The exam, in its own words)
- I know the exam guide says it’s aligned to the Summer ‘23 release, and that I should check the current guide before I book. (The exam, in its own words)
Reading a swim lane (supports IDC-1)
- I can read a swim lane: one lane per party, time running down the page, every call with its answer. (The parts of a swim lane)
- I can walk through a direct login to Salesforce, row by row: the instance redirects the browser to log in; the login server shows the login screen; it checks the username and password and answers with a session; the browser asks again, with the session. (One login, row by row)
- I know a redirect is an answer in the 300s, most often 302, with a
Locationheader, and that the browser follows it by itself. (What a redirect is) - I know the two kinds: an automatic redirect the browser simply follows, and one that carries a code to an OAuth client, whose own server then calls Salesforce for a token. (Two kinds of redirect)
- I know a redirect is the server answering the browser, and the browser making the next call: during a login, the servers usually don’t call each other. (The browser is the broker)
- I know whichever system shows the login screen is the identity provider, and that there should be only one. (Who shows the login screen?)
What changed since Summer ‘23 (newer than the exam’s release alignment, so beyond the exam today)
- I know the OAuth username-password flow and the user-agent and hybrid user-agent flows retire on February 20, 2027, and why, in Salesforce’s words. (Two OAuth flows retire)
- I know new connected apps can’t be created since Spring ‘26 without asking Salesforce Support, that existing ones keep working, and that new work uses external client apps. (New connected apps)
- I know Salesforce enforces MFA for all employee logins, including single sign-on, and requires phishing-resistant MFA for privileged users and admins. (MFA for every employee login)
- I know single sign-on logins can need Device Activation (SAML from February 9, 2026), unless the device is recognized, the trusted IP ranges are narrow enough, or the identity provider used a secure method and says so. (Device Activation for single sign-on)
Beyond the Exam
Section titled “Beyond the Exam”The exam is the floor, not the ceiling. These are the habits from this chapter that an architect needs, whether or not a question ever asks about them.
- Identity is intricate, not hard. Know which screw, and how far to turn it.
- Learn the steps of the switching, not the screens.
- Practice what you don’t do every day. Build it in a free org before you need it.
- Write it down when you set it up. It will run for years.
- Answer “how do our people log in?” with a drawing, not a sentence.
- Look for the arrow that isn’t there.
- Study for both goals: the exam’s list, and the project’s decisions.
- Date every fact, and put the retirement dates in the plan.
Words to Know
Section titled “Words to Know”| Term | In one line |
|---|---|
| Swim lane | A diagram with one column per party and time running down the page; identity’s main diagram |
| Lane | One party’s column in a swim lane: a browser, a server, a phone |
| Call and answer | An arrow from the party that asks, and the arrow back with what it gets |
| Redirect | A server’s answer in the 300s meaning “go there instead”; the browser makes the next call |
| Client | In OAuth, the app asking for access; its own server takes the code and asks for the token |
| Session | Proof, kept by the browser, that you’ve already logged in |
| Login server | The Salesforce server that checks who you are and gives you a session |
| Instance | The Salesforce server your org runs on; it only checks the session |
| Identity provider | The system that shows the login screen and decides who you are |
| MFA | Multi-factor authentication: proving who you are with more than one kind of factor |
| Phishing-resistant MFA | Security keys and built-in authenticators, which a fake login page can’t trick you into handing over |
| Device Activation | Salesforce asking a user to confirm a browser or device it doesn’t recognize |
| External client app | Salesforce’s new generation of connected apps, for new work |
Check Yourself
Section titled “Check Yourself”Short scenarios in the style of the course. Decide your answer before you open it.
1. A colleague draws your company's login as three boxes, Salesforce, the company's login page and the browser, with arrows going both ways between all three. What would you change?
Draw it as a swim lane instead: one lane each, time running down the page, one row per step, every call with its answer. Then check the arrow between Salesforce and the login page: during a login the servers usually don’t call each other; they redirect the browser. Reread The tennis match and The browser is the broker.
2. Your users click a link to a Salesforce record and see your company's own login page, not Salesforce's. Which system is the identity provider?
The company’s login page: whichever system shows the login screen is the identity provider. Salesforce is providing a service. Reread Who shows the login screen?
3. A data-loading tool sends an integration user's username and password to Salesforce to get a token. It has worked for years. What do you tell the team?
That’s the OAuth username-password flow, and its retirement is enforced on February 20, 2027, because it “directly passes the user’s credentials”. Plan the move now: for a server with no person, Salesforce points to the client credentials flow. Reread Two OAuth flows retire.
4. Your staff log in through single sign-on, with MFA at the identity provider. Someone says the new MFA rules don't apply to them. Are they right?
No. Salesforce’s enforcement covers all employee logins, “including… Single Sign-On (SSO)”. The identity provider’s MFA can count, but Salesforce has to be told about it in the login. Reread MFA for every employee login.
5. You're studying, and you find a blog post from 2022 explaining how to create a connected app for a new integration. Can you follow it as written?
Not as written. Since Spring ‘26, creating new connected apps is off and only possible through Salesforce Support; new work uses external client apps. The ideas may still help; check every step against today’s pages, and look at the date. Reread New connected apps and How this course dates things.
Explore
Section titled “Explore”- Salesforce Certified Platform Identity and Access Management Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07): the official list of sections, weights and objectives. Always check the current version before you book the exam.