Join our Community of Marketers.
Identity and access management is a core part of securing modern Salesforce environments. Organizations need reliable ways to verify users, control access, connect external identity systems, and protect applications without creating unnecessary friction.
The IAM Architect Exam, officially known as the Salesforce Certified Platform Identity and Access Management Architect Exam, measures a candidate’s ability to design secure, scalable identity solutions on Salesforce. Candidates are expected to evaluate business requirements, select suitable authentication and authorization approaches, and understand architectural trade-offs.
This guide covers the current exam format, official domains, key IAM concepts, preparation, exam-day advice, and registration.
What Is the Salesforce IAM Architect Exam?
The Salesforce Certified Platform Identity and Access Management Architect credential is designed for professionals who work with identity, security, integration, and access architecture on the Salesforce platform.
Salesforce classifies it as an Intermediate Architect certification. It is relevant to identity, security, technical, solution, and enterprise architects who design authentication and access solutions.
The exam covers Single Sign-On, federation, provisioning, OAuth, SAML, OpenID Connect, Connected Apps, Experience Cloud identity, session security, and access management.
There is no mandatory prerequisite certification. Salesforce recommends at least one year of experience designing and implementing Salesforce IAM solutions and around two years of identity or security technology experience.
IAM Architect Exam Format and Key Details
The current exam structure is straightforward, but candidates should know the details before scheduling.
| Exam Detail | Current Information |
| Official Certification | Salesforce Certified Platform Identity and Access Management Architect |
| Level | Intermediate |
| Questions | 60 scored questions plus up to 5 unscored questions |
| Question Type | Multiple-choice and multiple-select |
| Time Limit | 120 minutes |
| Passing Score | 65% |
| Registration Fee | US$400 plus applicable taxes |
| Retake Fee | US$200 plus applicable taxes |
| Prerequisite | None |
| Languages | English and Japanese |
| Delivery | Online proctored or Pearson VUE test center |
Unscored questions are mixed into the exam and do not affect the final result. Candidates are not told which ones they are.
The exam is closed-book, so reference materials and online resources cannot be used during testing.
What Topics Are Covered on the IAM Architect Exam?
Salesforce divides the exam into six domains. The percentages below show how much emphasis each domain receives.
| Exam Domain | Weight |
| Accepting Third-Party Identity in Salesforce | 21% |
| Community (Partner and Customer) | 18% |
| Identity Management Concepts | 17% |
| Salesforce as an Identity Provider | 17% |
| Access Management Best Practices | 15% |
| Salesforce Identity | 12% |
Accepting Third-Party Identity in Salesforce – 21%
This is the largest section of the exam. Candidates should understand how Salesforce accepts identity from external providers and when Salesforce acts as a Service Provider.
Study external Identity Providers, Single Sign-On, user provisioning, social sign-on, monitoring, and troubleshooting. The exam may present several workable approaches, so you need to identify the one that best fits the stated security and business requirements.
Community (Partner and Customer) – 18%
This domain focuses on external-user identity, particularly in Experience Cloud.
Candidates should understand authentication for customers and partners, external Identity Providers, self-registration, password reset, identity verification, External Identity licensing, and embedded login. You should be able to balance security, usability, and administration for external users.
Identity Management Concepts – 17%
This section tests the foundations of identity architecture.
Key areas include authentication, authorization, accountability, federation, trust relationships, user provisioning, and common SSO problems. Candidates should understand how SAML and OAuth fit into real Salesforce scenarios and why one architecture may be preferable to another.
Salesforce as an Identity Provider – 17%
Salesforce can also act as an Identity Provider for other applications.
This domain covers Connected Apps, OAuth flows, OAuth scopes, client secrets, access tokens, refresh tokens, token expiration, and revocation.
You should be able to choose an OAuth flow based on the application type, user interaction, security requirements, and access pattern.
Access Management Best Practices – 15%
This section includes Multi-Factor Authentication, session management, roles, profiles, permission sets, Connected App security, login auditing, and access assignment. Candidates should understand how access remains secure and manageable as users and business requirements change.
Salesforce Identity – 12%
This domain focuses on Salesforce identity capabilities and how they fit into a wider architecture.
Study Salesforce Identity, identity-related licensing, Identity Connect concepts, and the use of Salesforce identity services in larger Customer 360 environments.
Key Identity and Access Management Concepts You Should Understand
Several concepts appear repeatedly.
Authentication vs. Authorization
Authentication answers: Who is this user?
Authorization answers: What is this user allowed to access?
A user can authenticate successfully and still receive the wrong level of access, so both parts must be designed correctly.
Identity Provider vs. Service Provider
An Identity Provider (IdP) authenticates the user and sends trusted identity information to another system.
A Service Provider (SP) relies on that identity information and gives the user access to an application or service.
Salesforce can operate in either role depending on the architecture. Candidates should also understand IdP-initiated and SP-initiated SAML flows.
SAML, OAuth, and OpenID Connect
| Technology | Primary Purpose |
| SAML | Federated authentication and enterprise SSO |
| OAuth 2.0 | Delegated authorization |
| OpenID Connect | Authentication built on OAuth 2.0 |
Also review Single Sign-On, Just-in-Time provisioning, MFA, social sign-on, Connected Apps, login flows, and user lifecycle management.
A Simple IAM Architecture Scenario
Suppose a company wants employees to sign in to Salesforce with the same corporate credentials they already use for internal systems.
An architect should first identify where authentication should occur. If the corporate identity platform authenticates the employee and Salesforce trusts that identity, the corporate system acts as the IdP and Salesforce acts as the SP. The architect must then decide how users will be provisioned, how trust will be established, and whether SAML or another supported federation approach best meets the requirements.
Thinking through scenarios this way is more useful than memorizing isolated definitions.
How to Prepare for the IAM Architect Exam?
Start with the official Salesforce IAM Architect exam guide. Review all six domains and use the published weightings to organize your study time. The 21% third-party identity section deserves extra attention, but every domain can affect the final result.
Next, focus on architecture rather than terminology. You should understand when to use SAML, OAuth, OpenID Connect, different provisioning methods, and different IdP or SP patterns.
Hands-on practice is valuable. Work with Connected Apps, Authentication Providers, permission sets, session settings, SSO configurations, OAuth settings, and Experience Cloud identity features where possible. Try to understand what is happening at each stage of the authentication process.
Salesforce recommends combining practical experience, documentation, self-study, and SalesforceKing learning. Its preparation resources include the Architect Journey: Identity and Access Management Trailmix.
IAM Architect Practice questions can help when you use them to understand reasoning rather than memorize answers. When reviewing a scenario, ask:
- Who authenticates the user?
- Which system is the IdP?
- Which system is the SP?
- How will the user be provisioned?
- What access is required?
- Which protocol best fits the use case?
- What are the security and maintenance implications?
That method builds the kind of decision-making the exam is designed to test.
Is the IAM Architect Exam Difficult?
The IAM Architect Exam can be challenging because it tests architectural judgment, not just recall.
Candidates may need to choose between several solutions that appear technically valid. The best answer usually depends on the exact requirements, including security, user experience, maintainability, and Salesforce capabilities.
OAuth flow selection, SSO troubleshooting, IdP versus SP responsibilities, provisioning methods, Experience Cloud identity, and access management deserve careful study.
Practical IAM experience helps because candidates must explain why one design is stronger than another.
IAM Architect Exam-Day Tips
You have 120 minutes, so use your time carefully.
Read the complete scenario before selecting an answer. Identify the main business or security requirement first, then evaluate the options against that requirement.
Watch for words such as best, recommended, most secure, and least administrative effort. They often signal what Salesforce expects you to prioritize.
If a question is taking too long, flag it and continue. Return to difficult questions after completing the easier ones.
For multiple-select questions, evaluate every option separately. Leave enough time at the end to review flagged answers before submitting the exam.
How to Register for the IAM Architect Exam?
The IAM Architect certification is listed in Trailhead Academy, and Salesforce certification exams are delivered through Pearson VUE.
Candidates can select an online-proctored exam or an in-person Pearson VUE testing center. The registration fee is US$400 plus applicable taxes, and the retake fee is US$200 plus applicable taxes.
Before scheduling, make sure the legal name in your account matches your government-issued identification and review the latest Pearson VUE testing policies.
Also Read:
Beginner’s Guide to Salesforce Certification Tracks
I Failed My Salesforce Exam – Here’s What I Learned and What to Do Next
Your Day-of-Exam Checklist: What to Do Before and During Your Salesforce Test
How to Use Salesforce Trailhead Like a Pro for Certification Prep?