Salesforce Updated Identity-and-Access-Management-Architect Exam Questions and Answers by caelan

If Salesforce is brokering identity from an enterprise SSO platform to downstream applications, then in its relationship with the enterprise SSO system Salesforce is acting as a service provider. It is consuming authentication from the enterprise identity source and then using that result to participate in further federation to third-party apps. That distinction matters because the same platform can be an SP upstream and an IdP downstream in the same overall architecture. Resource server and client-application labels do not describe the identity role Salesforce is playing in that specific trust relationship. The key point is directional trust: Salesforce receives the authentication from the enterprise SSO provider, so it is the service provider in that connection. This is why option A is the best answer in Salesforce terms.

If AWS holds the workforce credentials and Salesforce must trust that external identity for authentication, OpenID Connect is the natural standards-based fit when AWS can operate as the identity provider. Salesforce can consume an OIDC provider for authentication and authorization scenarios in a way that avoids building a custom authentication server unnecessarily. A connected app by itself does not make AWS the identity source, and a custom external auth provider is only needed when there is no suitable standard protocol support. The architecture requirement is to let Salesforce trust the external identity system while preserving standards and minimizing custom code. Configuring AWS as an OpenID Connect provider satisfies that need cleanly. This is why option D is the best answer in Salesforce terms.

Just-in-Time provisioning is designed for exactly this onboarding pattern: a user authenticates through an external identity provider, and Salesforce creates the user automatically on first successful login. That avoids preloading every external user into Salesforce before they ever visit the site. Middleware and custom web services can do similar work, but JIT is the native, lower-complexity mechanism built into Salesforce federation. Login flows by themselves do not create the user record during the authentication handshake. The architectural value of JIT is that it keeps the source of identity external while letting Salesforce create and update the user only when the person actually needs access. It is efficient, standard, and commonly used with Experience Cloud. This is why option B is the best answer in Salesforce terms.

The OAuth 2.0 Device Flow is intended for devices that have limited input or display capabilities and therefore cannot easily support a standard browser-based login interaction. Instead of collecting full credentials on the device, the user completes authorization on a secondary device using a verification code and URL. That is why Salesforce recommends device flow for TVs, appliances, kiosks, and similarly constrained hardware. Asset Token Flow solves a different problem: it authorizes a registered asset or device to call Salesforce as a connected thing. Here the requirement is about registration and user authorization from a constrained device, so the device flow is the correct match. The design distinction is between human sign-in on limited hardware and secure machine identity for an asset. This is why option D is the best answer in Salesforce terms.