Salesforce Identity & Access Management Architect Certification Exam Guide
📋 Quick Navigation
⚡ Quick Answer
What is the Salesforce Identity & Access Management Architect Certification Exam Guide?
The Salesforce Identity & Access Management Architect Certification Exam Guide validates expertise in the relevant Salesforce domain. Exam format: 65% passing score. Offered by Salesforce, registered through Webassessor/Kryterion. Updated for Winter '26.
Winter '26 Edition
Last Updated: March 2026 | Exam Version: Winter '26
The Identity & Access Management Architect certification validates your expertise in designing secure, scalable identity solutions on the Salesforce platform. This credential is ideal for architects with prior system or application architecture experience who want to specialize in authentication, authorization, and security implementation. You'll need foundational knowledge of Salesforce administration and hands-on experience with identity protocols.
⚡ What's New in Winter '26
🔐 Enhanced OAuth Flows
Winter '26 introduces advanced OAuth 2.0 flow configurations for improved enterprise authentication scenarios and user consent management.
🛡️ Compliance Updates
New security compliance requirements align with updated audit trail capabilities and session management policies across identity providers.
🔑 Federation Enhancements
Expanded federation options provide greater flexibility for delegated authentication and multi-tenant identity architecture designs.
📊 Exam At a Glance
| Certification Name | Salesforce Identity & Access Management Architect |
| Level | Architect |
| Prerequisites | Application Architect or System Architect certification; identity and security experience recommended |
| Number of Questions | 60 multiple-choice |
| Duration | 120 minutes |
| Passing Score | 68% |
| Exam Fee | $400 USD |
| Retake Fee | $200 USD |
| Delivery | Proctored online or at authorized testing center |
🎯 Exam Domains & Weightings
1. Identity and Single Sign-On
30%This domain covers the foundational authentication mechanisms that enable seamless user access across connected systems. You'll master SAML 2.0 and OAuth 2.0 protocols, My Domain implementation, SSO flow architecture, and user lifecycle provisioning strategies.
🆕 Winter '26: Winter '26 expands OAuth 2.0 configuration options for enterprise-grade authentication workflows.
2. Access Management
30%This domain examines how to architect permission structures, role hierarchies, and authorization frameworks that control what authenticated users can access. You'll design solutions using Connected Apps, permission sets, and attribute-based access control patterns.
🆕 Winter '26: Enhanced Connected App policies now support granular token management and consent workflows.
3. Security and Compliance
25%This domain addresses protective measures including multi-factor authentication, session management policies, and audit trail configurations. You'll evaluate security trade-offs and implement compliance frameworks aligned with organizational governance requirements.
🆕 Winter '26: Improved audit logging capabilities provide deeper visibility into authentication and authorization events.
4. Integration
15%This domain covers identity integration patterns where Salesforce connects with external systems, identity providers, and third-party applications. You'll design federation architectures and configure integration points that maintain security across system boundaries.
🆕 Winter '26: New federation options support expanded delegated authentication scenarios.
❓ Sample Exam Questions
A Salesforce organization needs to implement a secure authentication system that supports multiple external applications while maintaining centralized user identity management. Which of the following best describes the primary focus of an Identity and Access Management Architect in this scenario?
- A. Build custom dashboards to monitor user login activity and generate compliance reports
- B. Architect and implement identity solutions that enable secure authentication, authorization frameworks, and federated access across the Salesforce ecosystem
- C. Set up automated workflows to provision user accounts and manage email notifications
- D. Configure API rate limiting and establish Salesforce API usage policies
A company needs to enable employees to access Salesforce using their corporate identity provider credentials without separate login. What are the recommended authentication frameworks to implement this requirement?
- A. Basic Authentication and Digest Authentication mechanisms
- B. SAML 2.0 and OAuth 2.0 frameworks
- C. Kerberos and LDAP protocols exclusively
- D. Salesforce-specific proprietary authentication tokens only
A Salesforce administrator needs to implement single sign-on for their organization and enable federated authentication capabilities. Which foundational platform component must be configured first to support these identity requirements?
- A. Customize the organization's Salesforce theme and color palette through branding settings
- B. Deploy My Domain to create a custom login URL that enables SSO and identity feature functionality
- C. Configure API rate limits and set up data backup protocols for the organization
- D. Install third-party AppExchange packages to manage user authentication externally
A company implements a federated identity management system where employees log in once through their corporate identity provider and then seamlessly access Salesforce, Slack, and Jira without additional logins. Which Salesforce feature enables this capability?
- A. Setting up IP whitelisting rules to control network access across applications
- B. Configuring SAML-based Single Sign-On to authenticate users against a centralized identity provider
- C. Creating custom permission sets for each integrated application
- D. Establishing org-wide defaults to synchronize user roles across platforms
A company needs to establish secure authentication between Salesforce and multiple third-party applications while maintaining centralized control over access permissions. Which feature should be implemented to achieve this requirement?
- A. API Gateway to filter all incoming requests from external sources
- B. Connected Apps using OAuth 2.0 framework with customizable authorization policies for granular access management
- C. IP whitelisting combined with single sign-on limited to Salesforce users only
- D. API version controls to restrict data access based on application release dates
📚 Study Resources
🏃 Trailhead
Complete the official Certification Prep trail — free, covers all exam domains, and is updated each release.
Go to Trailhead →📄 Official Exam Guide
Download the official exam guide from Trailhead for the exact domain weightings and topic list for Winter '26.
Official Guide →💬 Trailblazer Community
Join the study group on the Trailblazer Community to share tips, ask questions, and connect with other candidates.
Join Community →💡 Top Exam Tips
- Master the Identity and Single Sign-On and Access Management domains—together they represent 60% of the exam. Develop deep expertise in SAML 2.0 and OAuth 2.0 protocols, SSO implementation flows, user provisioning workflows, and federation strategies.
- Distinguish between federation and delegated authentication approaches. Know when to use each pattern and how they address different business scenarios involving external identity providers and Salesforce.
- Study security and compliance mechanisms thoroughly (25% of exam): MFA implementation, session timeout policies, audit trail configuration, and how they balance security with user experience in enterprise environments.
- Prepare for scenario-based questions asking you to architect SSO solutions for specific business cases. Practice articulating design decisions, trade-offs, and security considerations for various enterprise authentication requirements.
- Design identity solutions across multiple scenarios and practice explaining the reasoning behind your architectural choices. Understand how to evaluate and communicate security implications when selecting between authentication and authorization patterns.
🙋 Frequently Asked Questions
Ready to Get Certified?
Start with Trailhead and book your exam when you're consistently scoring 80%+ on practice questions.
Book the Exam →🏛️ More Architect Certifications
Explore related Salesforce certifications in the Architect track