Tools / ForgeRock IAM interview questions
What is ForgeRock Identity Cloud and how does it relate to ForgeRock Server?
ForgeRock Identity Cloud, now branded as PingOne Advanced Identity Cloud, is ForgeRock's fully managed SaaS IAM platform. It provides the same core ForgeRock capabilities — Access Management (AM), Identity Management (IDM), and Directory Services (DS) — delivered as a cloud-native, multi-tenant service hosted by ForgeRock/Ping Identity on AWS. Customers access the platform without managing the underlying infrastructure, patching, scaling, or upgrades.
Key differences between Identity Cloud and self-managed ForgeRock Server:
| Aspect | Identity Cloud (SaaS) | ForgeRock Server (Self-Managed) |
|---|---|---|
| Infrastructure | Managed by ForgeRock/Ping on AWS | Customer-managed (on-prem, AWS, Azure, GCP) |
| Upgrades | Automatic, rolling upgrades by ForgeRock | Customer-controlled, manual upgrade process |
| Customisation | Limited by SaaS governance; scripts and journeys only | Full access to all configuration files, custom OSGi bundles |
| Identity Gateway | Not included in cloud; self-hosted IG connects to cloud AM | IG deployed alongside AM/IDM |
| Tenant environments | Development, UAT, and Production environments per tenant | Separate deployments per environment |
| Service SLA | 99.99% SLA managed by ForgeRock | Customer-defined based on their infrastructure |
Identity Cloud uses an environment model — each customer gets Dev, UAT, and Prod tenants. Configuration changes (journeys, scripts, OAuth2 clients) are promoted between environments using a CICD pipeline-friendly configuration export/import mechanism. IG, if used, is deployed by the customer and configured to point its OAuth2 validation at the cloud AM endpoints.
More Related questions...
