Explain trust
Describe authentication patterns, how two systems establish trust, and where single sign-on usually fails.
Partners and press
Overview
Sign-on is the front door to every system. This exam tests who you let through it.
This exam is for people who design identity on Salesforce Customer 360, after 2 or more years in identity or security. It covers accepting third-party identity, acting as an identity provider and the access controls around both. It has no prerequisite, runs 60 questions in 120 minutes and is one of the four prerequisites for System Architect.
11Modules
60Questions
120Minutes
8Roles
What it tests
Learn all the way down.
Learn all the way down.
Perform when it matters.
Accept outside identity
Recommend how Salesforce acts as a service provider and how users are provisioned for employees and customers.
Act as the provider
Pick the right OAuth flow, and set scopes and connected app settings for a third-party system.
Serve external users
Support external identity providers in Experience Cloud, and choose embedded login and the right licenses.
Course outline
From a login that works
From a login that works
to identity others can trust.
We design this course ourselves. Salesforce runs the exam and issues the credential, and LUNARTECH is independent of Salesforce.
Identity design begins with a few ideas applied exactly. You separate authentication from authorization, learn how identity stores and federation work, and see how two systems come to trust each other.
- Authentication against authorization
- Identity stores and directories
- Federation and the idea of an identity provider
- Claims, tokens and assertions
- How trust is established between systems
- Common authentication patterns
You build A diagram of how a user is authenticated and trusted across two systems.
SAML is still the workhorse for enterprise single sign-on. You read assertions and metadata, understand certificates and bindings, and tell service-provider-initiated sign-in from identity-provider-initiated sign-in.
- Anatomy of a SAML assertion
- Metadata exchange and entity IDs
- Certificates, signing and expiry
- SP-initiated and IdP-initiated flows
- RelayState and deep links
- Reading a SAML trace
You build An annotated SAML trace that explains each field and who set it.
Most companies want employees to sign in with their corporate identity. You configure Salesforce to accept SAML and OpenID Connect sign-in, use My Domain to steer users, and choose among the authentication options.
- SAML single sign-on settings in Salesforce
- My Domain and login routing
- Authentication providers and OpenID Connect
- Delegated authentication and its trade-offs
- Single sign-on for several identity providers
- Choosing a method for employees and for customers
You build A working single sign-on configuration for two identity providers.
Sign-in is only half the job; accounts must also appear, change and disappear on time. You compare just-in-time provisioning, SCIM and directory sync, and design joiner, mover and leaver steps.
- Federation IDs and matching users
- Just-in-time provisioning
- SCIM and directory synchronization
- Joiner, mover and leaver processes
- Deprovisioning and freezing users
- Auditing provisioning results
You build A provisioning design covering joiners, movers and leavers.
Sign-in breaks in predictable places. You read login history and assertion validation, trace failures to certificates, clocks, audience values and user matching, and write a guide that a service desk can follow.
- Login history and what it shows
- Assertion validation and error messages
- Certificate and clock problems
- Audience and issuer mismatches
- User matching failures
- Writing a troubleshooting guide
You build A single sign-on troubleshooting guide built from real failure cases.
Salesforce can also vouch for users to other apps. You pick the OAuth flow that suits a web app, a server, a device or a mobile client, and see why the wrong flow becomes a security hole.
- Roles in OAuth: client, resource owner and server
- Web server and user-agent flows
- JWT bearer and SAML bearer flows
- Client credentials and device flows
- Why some flows should be avoided
- Salesforce as an identity provider to other apps
You build A flow selection guide with a worked example for each client type.
Connected apps are where policy meets tokens. You set scopes, permitted users and session policies, and manage access and refresh tokens through their expiry, introspection and revocation.
- Connected app settings and policies
- OAuth scopes and least privilege
- Access tokens and refresh tokens
- Token expiry and refresh policies
- Introspection and revocation
- Pre-authorizing users and managing consent
You build A connected app policy set with scopes, token lifetimes and a revocation procedure.
Strong identity needs a second factor and a record of use. You choose multi-factor methods, set session and login controls, keep permissions right for users arriving through single sign-on, and audit how people sign in.
- Multi-factor methods compared
- Enforcing MFA with single sign-on
- Session settings and login IP controls
- Keeping roles and permission sets right after sign-on
- Login history and event monitoring
- Responding to suspicious sign-ins
You build An access policy covering MFA, session limits and audit review.
Salesforce sells identity as products, and each fits a different need. You learn the role of Identity Connect, judge whether Customer 360 Identity suits a solution, and match license types to the users you must serve.
- What Identity Connect does with a directory
- When Customer 360 Identity fits a solution
- Identity license types and what each allows
- Comparing identity options for employees and customers
- Cost and limits that shape the choice
- Presenting an identity recommendation
You build A recommendation that chooses identity products and licenses for a mixed user base.
Customers and partners sign in differently from staff. You customize the login experience, add self-registration and external identity providers, embed login in other pages, and weigh the license options.
- Customizing the Experience Cloud login page
- Self-registration and user creation
- External identity providers and social sign-in
- Embedded login in other sites
- Community licenses and External Identity compared
- Protecting external accounts from abuse
You build An external user login experience with self-registration and one outside identity provider.
Take a company with employees, partners and customers and design its identity architecture: trust, sign-in, provisioning, tokens, access policy and licenses. You defend each choice and its risks.
- Reading the identity scenario
- Choosing sign-in methods per population
- Designing provisioning and token policy
- Setting access policy and audit
- Presenting and defending the design
You build A full identity architecture for one scenario, with trust model, flows and licenses.
Issued by
Certifying body · Independent of LUNARTECH
Salesforce
Agentforce, Data 360, MuleSoft, Tableau, Slack and the platform underneath them. Salesforce plans to retire 24 certifications on 1 February 2027. Check its current list before you start one.
How you get there
Top-tier roles go to people who can do the work.
Top-tier roles go to people who can do the work.
Here’s how you get there.
Know where you start.
Salesforce describes 1 or more years designing identity on Salesforce Customer 360 and 2 or more years in identity or security technology. No prerequisite.
Work through the course.
Eleven modules, designed by LUNARTECH, at your own pace.
Sit it with Salesforce.
Salesforce runs the exam and issues the credential, so you register and book directly with them.
Support
Support at every stage.
Support at every stage.
You won’t be working through this alone.
Before you start
Try it first.
A 3-day free trial opens a selection of the content. Your card is only charged once it ends.
While you learn
Mentors within reach.
Stuck on a concept? Reach out to a mentor whenever you need help.
While you learn
One-on-one sessions.
On the yearly plan, one-on-one sessions give you dedicated support.
Any time
A team behind you.
Write to info@lunartech.ai at any point, from your trial onwards. If your employer is funding you, we’ll set it up with them directly.
All the way through
A schedule that fits around your life.
Your own paceFrom anywhereAt any hour
After the last lesson
Stay in the network.
Your alumni network stays with you: ongoing support, opportunities and industry insight.
Career support
Career support, past the last lesson. Coaching, a sharper resume, real interview preparation and the people to know.
Career direction
Tailored coaching helps you decide where to aim and how to get there.
Strong portfolio
Hands-on projects become work you can show, not just claim.
Resume and profile
Personalized refinement, so what you send says what you can actually do.
Interview preparation
Preparation for the questions that decide it, so you walk in ready.
Network and search
Connections with industry leaders, and an alumni network that stays with you.
Reviews
Real stories from the community.
LUNARTECH Academy has been the most empowering learning experience of my life, giving me a clear, structured path from the absolute basics to building real-world AI systems with confidence.
Your page is fantastic. As a bachelor’s student in Data Science now accepted for a master’s at UConn, your work has been a real source of motivation.
The programme’s clear, bite-sized content and practical projects dramatically improved my speed from fuzzy idea to MVP and my ability to communicate AI value. I followed the system, and it works.
I really appreciate your teaching style and the way you break down complex topics. It has been incredibly helpful.
After years working mainly with R for econometrics, I found your Python machine learning course a refreshing and engaging way to learn Python.
As a Data Science graduate, I want to thank you for the effort you put into making videos to support growing data scientists.
I’ve been following your work since taking your machine learning course, and I’m impressed by your practical approach to applying AI.
Why choose us
Built around how you actually learn.
One standard behind every course, from the first lesson to long after the last.
Hands-on practice
Apply every idea to real problems, so it becomes something you have used, not only seen.
Industry-aligned curriculum
We keep courses current with the tools, techniques and skills the field asks for.
Flexible learning
Study at your own pace, from anywhere, at any hour.
Certificate of completion
Finish the course and earn a certificate that shows what you have learned.
Focus on your success
Personalized learning plans and support structures carry you through the hard parts.
Lifetime alumni network
Stay connected after you finish, with ongoing support, opportunities and industry insight.
Your certificate
It doesn’t raise its voice. Neither will you.
Finish a LUNARTECH course and its certificate is issued in your name, under our signature. Salesforce’s credential comes from Salesforce, when you pass its exam.
Certificate of completion
Your Name
Platform Identity and Access Management Architect course
LUNARTECH RISE Academy
Pricing
This course comes with the membership.
This course comes with the membership.
So does everything else.
One membership opens every course, certification, workshop and masterclass in the Academy. Every plan starts with a 3-day free trial. You register and book the exam directly with Salesforce.
3 days free, then $29.97 a month. Your card is only charged once the trial ends.
Included in every plan
- Every course in the Academy
- Every certification course
- Workshops and masterclasses
- A certificate of completion
- A 3-day free trial
- Learning at your own pace
- The lifetime alumni network
- Upgrades at any time
In practice
Eight roles.
Eight roles.
One credential across them all.
No single job owns it. Here’s where each role leans hardest, and where its work ends up.
- 01Concepts
- 023rd-party identity
- 03Identity provider
- 04Access
- 05Salesforce Identity
- 06Communities
-
Single sign-on breaks at the seams between systems. Knowing the flows tells you where.
3rd-party identity, Identity provider, Concepts
Security teams, Enterprise IT
-
MFA and sessions are policy, not just settings. The exam asks you to choose them.
Access, Concepts
Security teams, Enterprise IT
-
Customers log in through the identity they already have. Salesforce has to accept it safely.
3rd-party identity, Communities
Customer and partner portals, Salesforce partners
-
Roles and permission sets must follow the user. SSO provisioning is where that happens.
Access, Salesforce Identity
Enterprise IT, Salesforce partners
-
A weak login flow is a weak front door. Access controls decide what a login can reach.
3rd-party identity, Identity provider, Access
Security teams, Enterprise IT
-
Apps sign in through OAuth and SAML flows. You choose the flow and who issues the token.
3rd-party identity, Identity provider, Salesforce Identity
Customer and partner portals, Enterprise IT
-
Partners and customers expect one login that works. Community design decides who reaches what.
Communities, Salesforce Identity
Customer and partner portals
-
Auditors ask who can reach which system. Access design gives you something to show them.
Access, Concepts
Security teams, Enterprise IT
- Customer and partner portals
- Enterprise IT
- Security teams
- Salesforce partners
Identity Architect
Single sign-on breaks at the seams between systems. Knowing the flows tells you where.
Over 10,000 students trust LUNARTECH
LUNARTECH gives you the skills
to learn, build, create and lead.
Engineers
Understand systems all the way down. Build the ones others rely on.
Scientists
Understand what the data says. Build models that hold up.
Researchers
Understand the papers. Build on them, and take the work further.
The field
Anyone can use AI.
Anyone can use AI.
Few can engineer it. This is where that starts.
+340%growth in open roles requiring AI skills
Roles and pay
~35,000 open roles right now
Open roles: Built In, Greenhouse, LinkedIn.
Typical salaries: Glassdoor, Levels.fyi, Payscale, Indeed, Ravio, JobRise, U.S. BLS. Military: 2026 U.S. basic pay, drone officers with aviation incentive pay.
Updated November 2026.
FAQ
Frequently asked questions.
Need help? These answers cover most of what people ask before they start.
No. Salesforce issues it. LUNARTECH is independent of Salesforce, and its names and marks belong to it. When you finish a course of ours, you earn a LUNARTECH certificate of completion for that course.
No. We design this course ourselves, around what the exam covers. Salesforce has no part in it, and you still register and book the exam directly with Salesforce.
60 questions, 120 minutes, test center or online, in English, Japanese. The passing score is 65%.
Salesforce describes 1 or more years designing identity on Salesforce Customer 360 and 2 or more years in identity or security technology. No prerequisite.
We last reviewed it on 5 November 2026, from Salesforce’s own pages. Details change, so check the official page before you book.
Our 3-day free trial gives you access to a selection of content in the bootcamps, courses and materials, so you can experience the value of our content first-hand. This includes comprehensive learning materials and interactive sessions. You won’t be charged during this period, though we require your credit card details at the start to ensure a seamless transition should you choose to continue.
Yes, entering your credit card details is a necessary step to begin your free trial. The process is entirely secure, and we ask for it to provide a seamless transition to a paid subscription if you decide to continue beyond the trial. You will only be charged after the trial period ends, with full access to our content based on the plan you choose.
After your 3-day free trial you gain access to the full breadth of our content, depending on the subscription plan you choose. We offer free trials for our monthly, bi-annual and annual plans, and each plan provides a different scope of access and benefits.
If your employer has agreed to fund your learning, in part or in full, please contact us at info@lunartech.ai. We’ll work with you and your employer to set up everything needed for your subscription.
Yes. Our support remains strong both during your free trial and after you subscribe. Reach the team at info@lunartech.ai with any question, whether you’re onboarding, navigating your trial, or need help as a member. Subscribers to the yearly plan also receive dedicated support in one-on-one sessions.
You can upgrade your plan at any time during your subscription. Downgrading is not available for bi-annual or annual plans, but you can cancel and then choose a new plan that suits you better. For bi-annual and annual plans we also offer payment in instalments; please reach out to learn more.
The course
Build the skills behind Platform Identity and Access Management Architect.
Prove you can design who gets in, and how, across systems. Start with a free trial, or enroll in a plan and work through the course at your own pace. Salesforce runs the exam and issues the credential.
LUNARTECH is independent of the vendors and certifying bodies listed here. Their names, exam titles and marks belong to them, exams are run by them, and credentials are issued by them. Reviewed 5 November 2026. Catalogues change often, so confirm the details on the official page before you book.
