I hope this isn't against the rules in some way, but this question is about an example question in the official Integration & Access Management exam guide.

The question is as follows:

Universal Containers (UC) has chosen to implement a hub-and-spoke Salesforce org
strategy where a subset of users in the hub org should be able to access resources in
any of the spoke orgs. The IT team at UC has decided they would like to manage
users in the hub org and automatically create those users in the spoke orgs, as
needed, to reduce administrative burden. They will configure the hub org as an
Identity Provider and use SAML to authenticate users in the spoke orgs.
What is the recommended solution for automatically creating users in the spoke

Two of the answers are:

A. Use an IdP-initiated SAML flow and Custom SAML JIT Provisioning to create
users in the spoke orgs.
B. Use an IdP-initiated SAML flow and Salesforce SAML JIT Provisioning to
create users in the spoke orgs. 

According to the exam guide, the correct answer is A, but I don't understand why? What part of the question specifies that it should be custom JIT Provisioning and not 'standard' SAML JIT provisioning? I can't seem to find anything in the docs that would prevent regular provisioning from covering this particular scenario.

1 Answer 1


I had a read of the documentation, such as Configure SSO Across Multiple Salesforce Orgs which covers the hub-and-spoke architecture from the question.

I can't find any reference to "Salesforce SAML JIT Provisioning".

The valid options are Standard or Custom SAML JIT with Apex handler - Source

  1. In SAML Single Sign-On Settings, select User Provisioning Enabled.

    • Standard - This option allows you to provision users automatically using attributes in the assertion.

    • Custom SAML JIT with Apex handler - This option provisions users based on logic in an Apex class.

This might be what they are testing you on. There is no such thing as Salesforce SAML JIT Provisioning. That said, questions that rely on subtle word play like that aren't ideal.

The only other option I can think of is that the integration will require something specially in the class that implements the SamlJitHander interface that the standard attributes can't handle.

For instance, the User.ProfileId and User.UserRoleId attributes will need to be adjusted between orgs as the ID's will differ.

  • 2
    This is the correct answer. There's no such thing as "Salesforce SAML JIT Provisioning". The word play is indeed confusing and misses the point of examining applicants. Someone who has mastered Identity could still interpret the use of "Salesforce SAML JIT Provisioning" as a reference to the Standard option of user provisioning.
    – Jan Julian
    Commented Apr 30, 2018 at 21:07
  • @jmrjulian, this is the issue that so many people have with the exams. I've come across so many questions like this that seem designed to purposefully confuse test-takers and make the exam seem harder, rather than trying to test knowledge
    – brezotom
    Commented May 1, 2018 at 13:34
  • 1
    Thank you! That question had me doubting everything I had studied so far
    – Valyrion
    Commented May 1, 2018 at 15:41
  • It's more to do with the custom logic that is needed for provisioning. One spoke can be a sales org other a service org. Users from hub may need to have different profiles assigned in each spoke based on the custom attributes sent in the SAML from the hub. Profile name passed from the hub may not be resolved in the spoke.
    – user682217
    Commented Jan 5, 2019 at 23:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .