Identity and Access Management Designer Identity-and-Access-Management-Architect Updated Exam

In Experience Cloud B2B patterns, a partner identity in Salesforce is represented by a User that is related to a Contact, which in turn belongs to an Account. Delegated administration for partners assumes that account-contact-user relationship because partner users operate within a business account structure. A contact by itself is not a login identity, and a contactless user is associated with different external identity patterns. A Person Account is generally a B2C model rather than the normal B2B partner representation. The architect should therefore provision both the contact and the user record. This is consistent with how Salesforce partner communities model business relationships, sharing, delegated administration, and partner account ownership. This is why option A is the best answer in Salesforce terms.

To populate custom fields on the User record during SSO, Salesforce expects the architect to use the SAML Just-in-Time handler pattern. That means implementing the appropriate JIT interface and supplying create and update methods that map incoming assertion data into Salesforce user attributes. Session management classes and generic registration-handler interfaces solve different problems. The JIT handler exists specifically so that user creation and user updates can occur at login time based on federation data. This is useful when the identity provider is the source of truth for workforce attributes and those values must be refreshed without manual administration. In short, the interface gives Salesforce the entry point, and the create/update methods carry out the field population logic. This is why options A, C work together as the correct solution.

To integrate an external application with Salesforce by using OAuth 2.0, the architect generally needs a connected app and the right OAuth scopes. The connected app defines the trust relationship and client identity, while the scopes specify what access the app can request, such as API access or refresh-token capability. Authentication providers solve inbound sign-in from an external identity source, which is a different use case. A vague “OAuth token” is the result of the configuration, not the administrative construct you build first. The important architecture principle is that OAuth access to Salesforce starts with a connected app. Without that, the external order-fulfillment application has no registered client identity or scope model for calling Salesforce APIs. This is why option D is the best answer in Salesforce terms.

For guest checkout scenarios that later convert a shopper into a registered customer, Salesforce self-registration is the natural starting point because it gives the site a controlled way to create an external user account. The self-registration experience can be customized so that the user enters just enough order information for the site to locate the previously collected guest data and then complete the registration. SAML and social login don’t solve the core problem, which is linking an existing guest transaction to a newly created community identity. A Connected App Handler is also not the standard Experience Cloud tool for this registration pattern. The right design is to keep registration in Salesforce and tailor the page to reconcile the new user with the known order record. This is why option A is the best answer in Salesforce terms.