Salesforce Identity-and-Access-Management-Architect Exam With Confidence Using Practice Dumps

The Identity Only license is designed for users who need Salesforce Identity services without broad CRM object access. Salesforce documentation positions it for scenarios where employees or other internal users need to authenticate with Salesforce credentials and access connected applications, but they do not require the full set of standard Salesforce business objects. That makes it a good fit for benefits portals, employee hubs, or third-party workforce apps that rely on Salesforce for identity rather than for CRM usage. External Identity is aimed at external audiences such as customers or partners, while Identity Connect is synchronization software rather than an end-user license. The licensing decision follows the user population and the scope of application access more than the authentication protocol itself. This is why option A is the best answer in Salesforce terms.

When multiple identity providers must coexist in one Salesforce org, the standard pattern is to surface them through My Domain authentication settings so users can authenticate against the correct IdP. That is particularly important when generated email links bring users back into Salesforce and the org has to present the proper login options consistently. Rather than modifying every email with custom query logic or relying on IdP-initiated links, Salesforce can expose multiple login services at the domain level. This keeps the experience aligned with the org’s authentication service configuration. In multi-IdP organizations, the identity architecture should steer users through the My Domain login service so the correct SSO path is available when they arrive from system-generated links. This is why option C is the best answer in Salesforce terms.

When a service provider needs to continue making calls back to Salesforce on behalf of the user after login, OpenID Connect is usually the more natural choice because it sits in the OAuth family and aligns well with token-based delegated access. SAML is excellent for browser-based federation, but it is not as naturally suited to modern API token usage after the interactive sign-in event. The question is not simply “which protocol is more secure.” It is about post-login application behavior. If the downstream application needs identity plus a token-friendly pattern for additional calls, that use case pushes the architect toward OIDC. In other words, the deciding factor is what the service provider must do after the initial authentication succeeds. This is why option B is the best answer in Salesforce terms.