Overview
User Lifecycle Management has eight objectives, the most of any section, even though it carries only 13% of the exam. They cover granting the right access level, getting new users into the correct workspaces and channels, deactivating accounts properly, choosing authentication and provisioning options for a plan, assigning roles, managing identity provider (IdP) groups, setting access for guests and Slack Connect users, and checking whether a user group meets access criteria.
The technical core is identity: SAML single sign-on for authentication, SCIM for automated account creation, updates and deactivation, and just-in-time provisioning as the lighter alternative. On Enterprise Grid, IdP groups can be connected to workspaces and channels so membership follows the directory. Around that core sit the people-facing tasks of onboarding, default channels, user groups for mentions and channel defaults, guest expirations and clean offboarding.
How it's tested
Scenarios describe a person moving through the lifecycle: joining, changing teams, working with an outside company, or leaving. You choose the provisioning method, role, account type or deactivation step. The exam prefers the option that keeps Slack in sync with the identity provider automatically and grants the least access needed.
-
Manual versus automated
A process relies on admins inviting or removing people by hand, and you replace it with SCIM provisioning, IdP groups or default channels.
-
Outsider access
Someone outside the company needs access, and you decide between a single-channel guest, a multi-channel guest or a Slack Connect channel.
-
Offboarding done right
An employee leaves or a contract ends, and you pick the step that removes access everywhere while keeping the records the company needs.
A company on Enterprise Grid with Okta wants new engineers added automatically to the engineering workspace and its on-call channel. Inviting them by hand works but drifts over time. Because Okta already manages an Engineering group, the administrator connects that IdP group to the workspace and the private on-call channel through SCIM, so joining or leaving the group in Okta adds or removes Slack access automatically.
Objectives 8
Official objectives from the Salesforce outline, in outline order.
2.1 Given a use case or scenario, determine the correct level of access to grant to the user.Choosing account type for a specific use case.
- What it means
- Each use case maps to an account type: full members for employees, multi-channel guests for contractors who need several internal channels, single-channel guests for someone who needs only one channel, and admin roles only for people who manage others.
- What to understand
- Read what the person must do and for how long. Temporary access should come with a guest expiration date. Guests cannot see the member directory or browse public channels freely, which is often the reason the exam chooses them. An employee who works across business units on Enterprise Grid may need membership in multiple workspaces rather than an elevated role.
- How it shows up
- A new user's job is described and you choose between member, guest types and roles based on reach and duration.
- Common confusion
- Choosing full membership for a short-term contractor because it is simpler to invite.
2.2 Determine the process for getting new users into the right workspace(s) and channels.Onboarding paths: invitations, SCIM, default channels.
- What it means
- New users can arrive by email invitation, by approved email domain sign-up, by SSO just-in-time creation, or by SCIM from the identity provider. Once inside, default channels, user group default channels and IdP group mappings determine where they land.
- What to understand
- Scalable onboarding is automated: SCIM creates the account and, on Enterprise Grid, IdP groups or default workspace assignments place the user, while default channels and user groups add them to the right conversations. Manual invitations are fine for small teams but do not scale or stay in sync with HR changes.
- How it shows up
- A growing company wants every new hire in the right workspace and team channels on day one, and you choose the automated mechanism.
- Common confusion
- Relying on approved email domain sign-up for an Enterprise Grid org, which does not place people in the right workspaces or channels.
2.3 Given a scenario, determine the correct way to deactivate the user accounts.Offboarding without losing records.
- What it means
- Deactivating an account removes the person's ability to sign in while keeping their messages and files in Slack. With SCIM, deactivating the user in the identity provider deactivates them in Slack automatically. Guests can be given an expiration date so access ends on schedule.
- What to understand
- Deactivation is the standard offboarding action; Slack accounts are not deleted in the normal flow, which preserves history for compliance. On Enterprise Grid, deactivate at the org level so access ends across every workspace. Before deactivating, transfer ownership of items such as workflows, apps or channels managed only by that person.
- How it shows up
- An employee leaves and you pick the step that ends access everywhere while keeping message history.
- Common confusion
- Removing the user from channels one by one instead of deactivating the account, which leaves sign-in possible.
2.4 Assess a scenario to determine the appropriate authentication and user provisioning options based on the Slack plan.SSO, SCIM and JIT by plan.
- What it means
- SAML SSO lets people sign in with company credentials, SCIM keeps accounts created, updated and deactivated from the identity provider, and just-in-time provisioning creates an account the first time someone signs in through SSO. Business+ and Enterprise+ include SSO and SCIM; Free and Pro get them only with a connected Salesforce org.
- What to understand
- JIT creates accounts but cannot deactivate them, so it leaves offboarding manual; SCIM handles the full lifecycle and is the stronger answer when offboarding or attribute sync matters. SSO can be optional or required, and requiring it removes password sign-in. Google OAuth sign-in is a lighter authentication option for Google Workspace customers.
- How it shows up
- A company names its plan and identity provider and asks how to automate sign-in and account management, and you choose SSO plus SCIM or a lighter option.
- Common confusion
- Assuming SSO alone handles deprovisioning; SSO controls sign-in, while SCIM is what deactivates accounts.
2.5 Identify the appropriate permission or role to give a user based on a scenario.Roles for people who help administer Slack.
- What it means
- Beyond account types, people can hold roles that grant administrative powers: Workspace Admin or Owner, Org Admin or Owner on Enterprise Grid, Channel Manager, and system roles that cover a single area such as channels, users, roles, analytics or compliance.
- What to understand
- Pick the role whose scope matches the request. An HR coordinator who manages accounts fits a Users Admin system role, a compliance analyst fits a compliance-related system role, and a team lead who wants to run membership for one channel fits Channel Manager. Full admin roles are the answer only when the person must manage broadly.
- How it shows up
- A person needs to perform one administrative function, and you choose the narrowest role that grants it.
- Common confusion
- Treating system roles as add-ons to Admin rather than as narrow replacements for full admin access.
2.6 Given a scenario, determine how to manage identity provider (IdP) groups after configuration for workspace access.Directory groups that control Slack membership.
- What it means
- On Enterprise Grid with SCIM, groups from the identity provider can be connected to workspaces and to private channels. Membership in the IdP group then drives membership in the connected Slack space, and the group also appears as a user group for mentions.
- What to understand
- After connection, change membership in the identity provider, not in Slack. Removing a person from the IdP group removes them from the connected workspace or channel, and adding them grants access. Admins can choose whether an IdP group is required or optional for a workspace. Editing the synced user group directly in Slack conflicts with the directory as the source of truth.
- How it shows up
- Someone was added to a Slack workspace manually but keeps losing access, and you recognize that the IdP group controls membership.
- Common confusion
- Fixing membership inside Slack when the IdP group is the source of truth and will overwrite the change.
2.7 Identify and assign the appropriate access level for users provisioned using Slack Connect or Guest accounts.External people: guests versus Slack Connect.
- What it means
- Guests are accounts inside your workspace with limited reach, either single-channel or multi-channel. Slack Connect lets people from another organization join shared channels or DMs while keeping their own account, managed by their own admins.
- What to understand
- Use guests when the outsider has no Slack of their own or needs several of your internal channels. Use Slack Connect for company-to-company collaboration, where each side controls its own members and policies. Admins can restrict who may send Slack Connect invitations, require admin approval for new connections, and limit file uploads in external channels.
- How it shows up
- A vendor needs to work with your team, and you choose a guest account or a Slack Connect channel and set the right controls.
- Common confusion
- Thinking Slack Connect users are guests in your workspace; they stay members of their own organization.
2.8 Given a scenario, assess if the created user group and its permissions meet the required access criteria.User groups for mentions, defaults and permissions.
- What it means
- User groups are named sets of members, such as @design, that can be mentioned together and given default channels. On Enterprise Grid they can be org-wide or IdP-synced, and some permissions, such as who can post in a channel or who can create channels, can be limited to a user group.
- What to understand
- Evaluate a user group against the scenario: does it include exactly the people needed, does it add them to the right default channels, and does the permission tied to it grant only what was asked? Check who can create and edit user groups, since that setting can be restricted to admins.
- How it shows up
- A team configured a user group to control posting or channel defaults, and you decide whether it meets the stated access rule.
- Common confusion
- Assuming mentioning a user group adds its members to a channel; it notifies them, but default channels or IdP sync add membership.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
SAML SSO
Single sign-on that authenticates Slack users through the company identity provider.
- Remember
- SSO controls sign-in only; it does not deactivate accounts.
- Tested as
- Plan and authentication questions.
- Trap
- Expecting SSO to handle offboarding.
-
SCIM provisioning
Directory-driven creation, update and deactivation of Slack accounts.
- Remember
- SCIM is what makes deprovisioning automatic.
- Tested as
- Every scalable onboarding or offboarding scenario.
- Trap
- Choosing JIT when offboarding automation is required.
-
Just-in-time provisioning
An account is created when someone first signs in through SSO.
- Remember
- JIT does not deactivate or update accounts later.
- Tested as
- Lighter option for small teams with SSO.
- Trap
- Treating JIT as full lifecycle management.
-
IdP groups
Directory groups connected to Enterprise Grid workspaces and private channels.
- Remember
- Membership is managed in the identity provider once connected.
- Tested as
- Questions about access drifting or being removed.
- Trap
- Editing membership in Slack instead of the directory.
-
Deactivation
Ends sign-in while preserving messages and files.
- Remember
- Deactivate at the org level on Enterprise Grid.
- Tested as
- Offboarding scenarios.
- Trap
- Removing a user from channels instead of deactivating.
-
Guest expiration
A date after which a guest account is deactivated automatically.
- Remember
- Set it for temporary contractors and auditors.
- Tested as
- Short-term access scenarios.
- Trap
- Relying on someone to remember to remove the guest.
-
Multi-channel guest
A guest who can access specified channels in a workspace.
- Remember
- Billed like a member and limited to assigned channels.
- Tested as
- Contractors working across a few internal channels.
- Trap
- Using a single-channel guest when two channels are needed.
-
Slack Connect
Shared channels and DMs between separate Slack organizations.
- Remember
- Each organization manages its own users and policies.
- Tested as
- Partner and vendor collaboration.
- Trap
- Creating guests for an organization that already uses Slack.
-
User group
A named set of members for mentions, default channels and some permissions.
- Remember
- Mentioning a group does not add people to a channel.
- Tested as
- Access-criteria evaluation questions.
- Trap
- Assuming the group restricts access on its own.
-
Default channels
Channels every new member, or every member of a user group, joins automatically.
- Remember
- Useful for onboarding consistency.
- Tested as
- Getting new users into the right channels.
- Trap
- Making every channel a default and flooding new users.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Authentication and provisioning options
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SAML SSO | Company identity provider handles sign-in | Authentication only | Expecting it to deactivate users |
| SCIM | Directory syncs accounts into Slack | Create, update and deactivate | Forgetting the plan or Salesforce org requirement on Free and Pro |
| Just-in-time | Account created at first SSO sign-in | No later updates or deactivation | Choosing it when offboarding must be automatic |
| Google OAuth | Sign in with Google accounts | Lighter authentication for Google Workspace customers | Treating it as full SAML SSO with provisioning |
Ways to give outsiders access
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Single-channel guest | Access to one channel in your workspace | Narrowest reach | Using it for someone who needs two channels |
| Multi-channel guest | Access to selected channels in your workspace | Billed like a member | Using it for a whole partner company |
| Slack Connect | Shared channel with another organization | Partner keeps own account and admin | Assuming partners become your guests |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
SSO solves offboarding
- What candidates pick
- Enable SAML SSO so departed staff cannot sign in.
- Why it looks right
- Disabling the user in the identity provider blocks new SSO sign-ins.
- Why it's wrong
- Existing Slack sessions and the account itself remain until deactivated; SCIM deactivates the account directly when the directory changes.
Clue to watch for The scenario says access must end immediately and automatically.
-
JIT is enough
- What candidates pick
- Turn on just-in-time provisioning for a 5,000-person company.
- Why it looks right
- Accounts appear without admin work.
- Why it's wrong
- JIT only creates accounts and never deactivates or updates them, leaving offboarding manual at scale.
Clue to watch for The requirement mentions updates, role changes or leavers.
-
Fix it in Slack
- What candidates pick
- Re-add the user to the workspace manually.
- Why it looks right
- It restores access in seconds.
- Why it's wrong
- When an IdP group controls the workspace, the next sync removes the user again; membership has to change in the identity provider.
Clue to watch for The user keeps losing access after being re-added.
-
Guests for partners
- What candidates pick
- Invite a partner's twenty employees as multi-channel guests.
- Why it looks right
- Guests can be added quickly with limited access.
- Why it's wrong
- The partner already uses Slack, so Slack Connect keeps them in their own organization and avoids paid guest seats you must manage.
Clue to watch for The partner company has its own Slack.
-
User group as security
- What candidates pick
- Create a user group to restrict who can read a channel.
- Why it looks right
- User groups look like access groups.
- Why it's wrong
- User groups notify and add defaults; reading access comes from channel membership, private channels or IdP-group connections.
Clue to watch for The requirement is about who can see content, not who is notified.
-
Delete the account
- What candidates pick
- Delete the departing user's account to remove access.
- Why it looks right
- Deleting sounds more final than deactivating.
- Why it's wrong
- Slack's offboarding action is deactivation, which ends access and keeps message history needed for compliance.
Clue to watch for The company must retain records.
Answer framework
Work through these steps for any onboarding, access change or offboarding scenario.
- Identify where the person is in the lifecycle: joining, changing role or team, collaborating from outside, or leaving.
- Check the plan and identity provider named, then decide whether SSO, SCIM, JIT or invitations are available and appropriate; SCIM handles provisioning and deprovisioning from the IdP automatically.
- Choose the narrowest account type or role, using guests or Slack Connect for outsiders and system roles for single admin tasks.
- Place users through automation where possible: IdP groups, default workspaces, default channels and user groups rather than manual invites, so new hires land in the right places on day one.
- For offboarding, deactivate at the highest level, set guest expirations for temporary access, and reassign anything only that person owned.
Practice question
Want more like this? The Slack-Admn-201 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Draw the lifecycle as a timeline with four stops: provisioning, placement, change and deprovisioning. Under each stop, write the Slack mechanism that automates it and the plan that includes it. That single page covers most of the eight objectives and keeps you from mixing up SSO, SCIM and JIT.
Complete the Identity Management in Slack badge on Trailhead and read Slack's help articles on SAML SSO, SCIM provisioning, IdP groups and deactivating a member's account. If you can use a test identity provider such as an Okta developer account, connect it to a sandbox or trial so you can watch an account appear and then deactivate when you change the directory.
Highest priority are the SCIM versus JIT difference, deactivation behavior and the guest versus Slack Connect decision. Most underestimated is the rule that IdP groups own membership once they are connected, which turns many troubleshooting questions into a single clear answer. In practice questions, ask whether the proposed fix will survive the next directory sync; if it will not, it is probably a distractor.
FAQ
How much of the exam is User Lifecycle Management?
User Lifecycle Management is 13% of the Slack Administrator exam, about eight of the 60 scored questions as a planning estimate, spread over eight official objectives.
Which identity providers do I need to know?
No single provider is required. Know the SAML SSO and SCIM concepts, and recognize common providers such as Okta, Microsoft Entra ID and Google Workspace in scenarios.
Does deactivating a user delete their messages?
No. Deactivation ends access but keeps the user's messages and files, subject to the workspace's retention settings.
Can Free or Pro customers use SCIM?
Under the 2025 plan changes, SAML SSO and SCIM on Free and Pro are available only to customers who have connected a Salesforce org to Slack. Business+ and Enterprise+ include them.
Are Slack Connect users guests in my workspace?
No. They remain members of their own organization and join shared channels or DMs. Their own admins manage their accounts.
How do user groups relate to IdP groups?
On Enterprise Grid, a connected IdP group also appears as a Slack user group, but its membership comes from the identity provider and should be changed there.
Is this section mostly memorization?
It is scenario-based. You will rarely be asked for a definition; instead you pick the provisioning, role or offboarding step that fits a described situation.
Other CRM & Business Applications certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- HubSpot Inbound Marketing Certification Study guide
- Salesforce Certified Platform Developer I Study guide
- Google Ads Search Certification Study guide
- ServiceNow Certified System Administrator Study guide
- Salesforce Certified Platform Administrator Study guide
- ServiceNow Certified Application Developer Study guide
Test your Domain 2 knowledge
You have covered access levels, onboarding paths, SSO and SCIM by plan, IdP groups, guests, Slack Connect access and deactivation. See how you do on timed lifecycle scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Slack-Admn-201 AI tutor Get any concept explained your way