Study guide
Study guide for chapter 12 of the Securing Salesforce: Identity and Access course. Read the five modules first; this page helps you check what stuck.
About this study guide. It’s built only from this course’s own content and the published Salesforce exam guide’s list of objectives. It is never based on real exam questions, and it doesn’t claim to know what’s on the exam. If you’ve taken the exam, please don’t send me questions from it: the certification agreement forbids sharing them, and memorizing answers is the wrong way to become an architect anyway.
This chapter carries five of the Identity and Access Management Architect exam’s objectives, across four of its sections: recommending a provisioning method (Identity Management Concepts, 17%); provisioning users from identity stores, and for single sign-on (Accepting Third-Party Identity, 21%); roles, profiles and permission sets during single sign-on (Access Management Best Practices, 15%); and Identity Connect (Salesforce Identity, 12%). The exam guide aligns to Summer ‘23, before Identity Connect’s retirement notice, so check its current version before you book.
For the Exam
Section titled “For the Exam”Tick them off as you go. Each one links to where it’s taught.
Choosing a method (supports IDC-4, TPI-2)
- I can name the five ways a user gets made, and when each arrives. (Five ways in)
- I can recommend a method from where the truth lives, how many, how fast, and who needs a user before logging in. (How to choose)
Just in time (supports TPI-4)
- I know JIT creates or updates her user from the assertion’s attributes at login. (At her first login)
- I know the four required fields, the
User.prefix, and that JIT needs the Federation ID. (What the assertion must carry) - I know the setting: User Provisioning Enabled, type Standard or Custom. (Turning it on)
- I know what JIT can’t do: only at login, never removes anyone, no permission sets. (What it can’t do)
Handlers and access (supports TPI-4, AMB-2)
- I know the custom handler,
Auth.SamlJitHandler, its two methods,createUserandupdateUser, and Execute Handler As with Manage Users. (The custom JIT handler) - I can compare the SAML JIT handler, the registration handler and the token exchange handler. (Three doors, one job)
- I can explain how profiles, roles and permission sets get set during single sign-on, and who should decide them. (Who decides her access?)
Leaving (supports TPI-2, TPI-4)
- I know switching her off at the identity provider stops the login, not the user. (The login stops, the user doesn’t)
- I know the difference between freeze and deactivate. (Freeze or deactivate)
- I know SCIM lets an identity provider create, update and deactivate Salesforce users. (The identity provider pushes)
Salesforce as the source (supports SID-1)
- I know user provisioning for connected apps creates and removes accounts in other apps, and that it’s not available on external client apps. (A hard truth, with a date)
- I know what Identity Connect did, and that it’s retiring with no replacement. (Identity Connect, a legacy note)
Beyond the Exam
Section titled “Beyond the Exam”The exam is the floor, not the ceiling. These are the habits from this chapter that an architect needs, whether or not a question ever asks about them.
- Salesforce follows the source of truth, never typed in twice.
- Send who she is, map what it means in Salesforce.
- Design the move, not just the join: access should change with her, not just grow.
- Leaving reaches every place she had access, the same day.
- Tidy after a leave: records, permission sets, app tokens.
- Admins by hand, with a direct login, as the backup plan.
Words to Know
Section titled “Words to Know”| Term | In one line |
|---|---|
| User provisioning | Making users, keeping them up to date, and switching them off |
| Joins, moves, leaves | The three moments; in the industry, joiner, mover, leaver |
| Just-in-time (JIT) provisioning | Creating or updating a user from the SAML assertion at login |
| Attributes | Extra fields in the assertion, such as User.Email |
| Federation ID | The value JIT matches her on, in the assertion’s subject |
Auth.SamlJitHandler | The Apex interface for a custom JIT handler |
| Execute Handler As | The user a handler runs as; needs Manage Users |
| Freeze | Blocks logins at once; keeps the licence |
| Deactivate | Stops her logging in; frees the licence; keeps her records |
| SCIM | An open standard an identity provider uses to push users into Salesforce |
| User provisioning for connected apps | Salesforce creating and removing accounts in other apps |
| Identity Connect | A retiring product that connected Active Directory to Salesforce |
Check Yourself
Section titled “Check Yourself”Short scenarios in the style of the course. Decide your answer before you open it.
1. A company with SAML single sign-on wants staff to get Salesforce users automatically the first time they log in, with no code. What do you turn on?
Standard just-in-time provisioning: User Provisioning Enabled, type Standard, with the Federation ID as the identity type, and the identity provider sending at least Email, LastName, ProfileId and Username. Reread Turning it on.
2. New sales managers must own accounts before their first login. The team plans to use JIT. What's the problem?
JIT only runs at login: nobody who hasn’t logged in has a user. Create them another way, a data load or the identity provider pushing users. Reread How to choose.
3. JIT creates users with the right profile, but they also need a permission set based on their department. What do you use?
A custom SAML JIT handler: it reads the department attribute and assigns the permission set, which standard JIT has no field for. Plan for the mixed DML trap. Reread The custom JIT handler.
4. An employee left a month ago and was disabled at the identity provider. An audit finds her Salesforce user still active. Why, and what's the fix?
Disabling her at the identity provider stopped her single sign-on, but the leave never reached Salesforce: JIT never removes anyone. Deactivate her, tidy what she owned, and have the identity provider push leaves with SCIM. Reread The login stops, the user doesn’t.
5. An admin can't deactivate a departing user because she's selected in a custom hierarchy field. How do you keep her out meanwhile?
Freeze her account, which blocks logins at once, then reassign and deactivate later. Freezing doesn’t free her licence. Reread Freeze or deactivate.
6. Salesforce is the identity provider for a team, and the team wants accounts in another app created and removed with their Salesforce users. What's the feature, and what's the catch today?
User provisioning for connected apps. It’s a connected app feature, not available on external client apps, and new connected apps are restricted since Spring ‘26. Reread A hard truth, with a date.
7. An org still uses Identity Connect to sync its Active Directory into Salesforce. What do you advise?
Plan the move before the subscription ends: Identity Connect is retiring, gets security updates only, and has no replacement. Reread Identity Connect, a legacy note.
Explore
Section titled “Explore”- Enable Just-in-Time Provisioning (opens in a new tab), Salesforce Help (Winter ‘27; checked 2026-11-07)
- Salesforce Certified Platform Identity and Access Management Architect Exam Guide (opens in a new tab), Salesforce Help (checked 2026-11-07)
The official list of objectives and their weights. Always check the current version before you book an exam.