Salesforce Certified Identity and Access Management Practice

What action should be avoided when enabling SSO for Salesforce administrators?

1. Testing in a developer edition first

2. Allowing access from any location

3. Enabling SSO for Salesforce administrators

4. Mapping internal usernames to Salesforce usernames

The correct answer is: Enabling SSO for Salesforce administrators

When enabling Single Sign-On (SSO) for Salesforce administrators, it is vital to consider the security implications associated with administrative access. Enabling SSO for administrators can pose significant risks, particularly if the SSO implementation is not tightly controlled. Administrators have elevated privileges that allow them to make changes to the system, access sensitive data, and perform actions that other users cannot. Therefore, allowing them to access the system through SSO could potentially expose the organization to security vulnerabilities, especially if the SSO mechanism itself lacks strong security measures. Best practices often suggest that administrators should have a separate and stringent authentication process to ensure that their access is protected. This reduces the risk of unauthorized access, as anyone with the credentials to the SSO system could gain administrative rights in Salesforce. It's also important to consider the implications of changes to SSO configurations and how they could affect administrators' access in critical situations, such as when troubleshooting or needing access to the Salesforce environment without being tied to potentially vulnerable SSO processes.