To provide "instant access" for new customers via an external IAM system using SAML, Salesforce provides a declarative feature called Just-in-Time (JIT) provisioning.
When a customer attempts to log in to the Community (Experience Cloud) through the IAM system, the IAM system (acting as the Identity Provider) sends a SAML assertion to Salesforce. If JIT provisioning is enabled, Salesforce parses the user information contained in that assertion-such as name, email, and federation ID. If a corresponding User record does not exist, Salesforce automatically creates one on-the-fly and then logs the user in. This eliminates the need for a manual registration step or pre-provisioning accounts.
Option A is slightly incorrect because Registration Handlers are specifically associated with Authentication Providers (which use OpenID Connect/OAuth), not SAML SSO. Option C is incorrect because JIT provisioning is a feature of SAML, while Authentication Providers use the Registration Handler class to achieve the same result. For a "self-service" scenario where speed to market and standard protocols are key, SAML SSO with JIT provisioning is the architect's primary choice for automating user management and providing a seamless single-entry point for subscribers.

Managing identity across a global enterprise with diverse user personas (Employees, Customers, Partners) requires a centralized Identity and Access Management (IAM) strategy. In a landscape involving multiple local Active Directories, social logins (Google), and a central ERP system, attempting to manage authentication natively within Salesforce or through custom-built local silos would result in high technical debt and security vulnerabilities.
The architect should recommend a third-party Single Sign-On (SSO) solution, acting as a central Identity Provider (IdP). This IdP serves as the orchestration layer for all authentication requests.
* For Internal Users: The IdP can federate with the various local Active Directories, allowing users to log in with their existing corporate credentials.
* For Customers: The IdP can handle "Social Sign-On" (OpenID Connect) with Google and manage self-registration.
* For Partners: It provides the "central system" required for their authentication.
By using a central SSO solution, Salesforce acts as a Service Provider (SP). When a user attempts to access Salesforce, the request is redirected to the IdP via the SAML 2.0 or OpenID Connect protocol. Once the IdP validates the user against the appropriate backend (AD, Google, or its own directory), it sends a secure assertion back to Salesforce to grant access.
Furthermore, this central IdP can facilitate access to the ERP system and other internal systems. If these systems support SAML, the same SSO session used for Salesforce can be extended to them, providing a true single sign-on experience. This architecture centralizes security auditing, simplifies user de-provisioning (the
"kill switch" effect), and ensures a consistent user experience across the global manufacturing landscape.
Implementing a thir2d-party IdP is the industry-standard approach for complex integrations where security, scalabi3lity, and multi-protocol support are primary requirements.

When designing a solution that requires Salesforce to receive and display updates from a back-end ERP (such as order status changes), message durability is a critical factor for ensuring data consistency. In an event- driven architecture using Platform Events or Change Data Capture (CDC), Salesforce utilizes an event bus to handle these incoming notifications.
For high-volume event messages, the Salesforce platform provides a native 72-hour (3-day) retention window. This is a significant architectural advantage for several reasons:
* System Resilience: If the Salesforce org or the integration middleware experiences a temporary disruption or is undergoing maintenance, the event messages published by the ERP remain stored in the bus for up to 3 days.
* Data Recovery: Once the connection is restored, the subscribing system (Salesforce) can use the Replay ID to catch up on any missed events from the last 72 hours, ensuring that order stages like
"Order Shipped" or "Order Paid" are not missed.
* SLA Management: This 3-day window exceeds the 24-hour limit of older technologies like PushTopics or Outbound Messaging (Option A), providing more breathing room for disaster recovery scenarios.
While ReplayID -1 (Option C) is used to subscribe only to new events published after the subscription starts, it does not address the durability or retention of historical events needed for recovery. By highlighting the 72- hour retention window, the integration architect provides a design that is robust against outages and guarantees that the "System of Engagement" (Salesforce) stays synchronized with the "System of Record" (ERP).

In the world of Salesforce SOAP APIs, the choice of WSDL depends on the nature of the application being built. When an architect needs to build an integration that is org-agnostic-meaning it can work across multiple different Salesforce organizations with varying custom objects and fields-the Partner WSDL is the correct choice.
The Partner WSDL is loosely-typed. It does not contain information about an org's specific custom metadata; instead, it uses a generic sObject structure. This allows a single client application (like a third-party integration tool or a mobile app) to connect to any Salesforce org and dynamically discover its schema at runtime. Because it is not tied to a specific org's metadata, it does not need to be regenerated every time a custom field is added to one of the target orgs.
In contrast, Option A (Enterprise WSDL) is strongly-typed. It is generated specifically for one org and contains hard-coded references to that org's custom objects and fields. While this provides better compile-time safety for internal, single-org integrations, it is unsuitable for an application intended for "more than one Salesforce org" because the WSDL would be invalid for any org that doesn't have the exact same metadata.
Option C is a general term; the actual choices provided by Salesforce for integration are the Partner or Enterprise WSDLs. Therefore, for maximum flexibility and reusability across a multi-org landscape, the Partner WSDL is the industry standard.