Two Goals, One Route

Module 2 of 4 in the chapter Thinking Like an Identity Architect, chapter 1 of Securing Salesforce: Identity and Access. Each module stands on its own.

The question this module answers: What will this course give you, and in what order?

Two goals

I teach this course to two goals. The first is to help you pass the exam: the Salesforce Certified Platform Identity and Access Management Architect. The second is deeper knowledge: what you need on a real project, whether or not a question ever asks about it.

So the course alternates between them. Here’s what the exam guide says, and here’s how it works underneath. Here’s the setting, and here’s the trouble it causes when it’s wrong. You’ll see it in the chapters, which teach the mechanism and then ask what an architect decides; and in the study guides, which have a section For the Exam and a section Beyond the Exam.

I do it that way because the two goals need each other. The exam rewards knowing what each mechanism does. A real project rewards knowing which one to choose, and what happens on the day it breaks. If you only study for the exam, you’ll pass and still be lost on your first single sign-on project. If you skip the exam’s list, you’ll miss parts of the domain you’ll be asked about anyway.

The exam, in its own words

Here’s the exam, as Salesforce’s exam guide describes it. I read it again on November 6, 2026 (exam guide (opens in a new tab)). It has six sections, each with a weight:

Section	Weight	Where this course teaches it
Identity Management Concepts	17%	Chapters 2 to 6, 12, 16 and 18
Accepting Third-Party Identity in Salesforce	21%	Chapters 2, 6, 7, 10, 12, 14 and 16
Salesforce as an Identity Provider	17%	Chapters 5, 7, 8, 9, 11 and 13
Access Management Best Practices	15%	Chapters 2, 8, 12, 13 and 16
Salesforce Identity	12%	Chapters 12, 14 and 15
Community (Partner and Customer)	18%	Chapters 10, 14 and 15

Two things to notice. First, accepting someone else’s identity is the biggest section, at 21%. That’s single sign-on with Salesforce as the service provider, and its cousins. Second, the customer and partner section is 18%, nearly as big. Many people study the employee side and forget the outsiders. Don’t.

And one more thing to notice: Summer ‘23. The exam guide says the exam is aligned to that release. The platform hasn’t stood still since, and module 4 shows how much has moved. So this course teaches what the exam asks, and tells you plainly, with a date, where Salesforce has changed things since. Always check the current exam guide before you book.

One route, in three parts

Now the route. It follows the order I teach the class in, and it starts with a person.

Part 1: Who Are You? (See). People in a browser. The first days of my class are really about a human driving the browser, because that’s how most of us use Salesforce. This part covers how Salesforce checks who you are (chapter 2, the front door), why one system can trust another (chapter 3, keys and certificates), single sign-on and the browser in the middle (chapter 4), and how to choose the right mechanism for a situation (chapter 5).

Part 2: Accepting and Providing Identity (Design). The mechanisms, in both directions. First SAML: Salesforce accepting someone else’s login (chapter 6), and Salesforce giving its own login to others (chapter 7). Then OAuth, which can be a server, a mobile device, or one system talking to another. It starts with one base pattern (chapter 8) and builds out from it: flows with a person present (chapter 9), the mirror image (chapter 10), and flows with no person at all (chapter 11). Then getting users in and out (chapter 12), and the apps and tokens that make it work (chapter 13).

Part 3: Customers, Partners and Agents (Direct). Everyone outside the company: customers and partners (chapter 14), and the login experience they see (chapter 15). Then running it: watching the door and troubleshooting (chapter 16), the newest arrivals, AI agents (chapter 17), and the strategy and design review that pulls it all together (chapter 18).

Each part goes a level deeper: you see how it works, then you design with it, then you direct it across a company and beyond. Along the way, a delivery company called Steve Trucking gives you something real to design for, at a few checkpoints. You don’t need it to follow the rest.

Why this order

Why start with the browser? Because single sign-on and the browser’s redirects are the foundation of everything after them. OAuth’s flows with a person in them still run through the browser. If you’ve learned the dance in Part 1, Part 2 is the same dance with new partners.

And why save customers, partners and agents for last? Because they use every mechanism from the first two parts, often all at once. An external user might log in with a social account, through a site with its own login page, and reach an app that holds a token for them. You can only design that once you know each piece.

If you’re an admin or a developer, Part 1 stands on its own. Take it, try it in a free org, and come back for Parts 2 and 3 when you’re ready.

What’s next

Module 3: the diagram this whole course runs on, and how to read one. The swim lane.

What an architect takes from this

• Study for both goals. The exam’s list tells you what to know; the project tells you what to choose.
• Know the weights. Accepting third-party identity (21%) and customers and partners (18%) together are almost 40% of the exam.
• Know the exam’s date. It’s aligned to Summer ‘23; check the current guide, and know what’s changed since (module 4).
• Follow the person. People in a browser first, then the mechanisms both ways, then everyone outside the company.

Explore

• Salesforce Certified Platform Identity and Access Management Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07): the official list of sections, weights and objectives. Always check the current version before you book the exam.