#Trailhead Challenges1,780 discussing

Hey Akshath, 

Per the official steps, when creating the VPs group, you select Roles (not "Roles and Subordinates") from the search picklist, then select ALL the VPs shown in that list and add them, not manually pick four specific role names one by one. 

If you added them via "Roles and Subordinates" instead of plain "Roles," the group membership type stored is technically different even though it looks the same in the UI, and that mismatch can cause this "can't find members" verification failure. 

Fix: 

1. Edit the VPs group 

2. In the search dropdown, confirm it's set to "Roles" (not "Roles and Subordinates") 

3. Remove the four roles and re-add them from that exact list 

4. Save, then recheck the challenge 

Also double-check the four roles are created directly under CEO with exact naming (e.g., "VP, Marketing" not "VP Marketing"), naming mismatches also break the checker. 

Reference:

Hi Rishav, 

This means the underlying DMO (Lead_Data_for_Training__dlm) that the module expects hasn't actually been created/deployed in your org yet, even though it's showing as selectable in the picker (a stale UI list vs. real DMO existence is common here). 

Check: 

1. Go to Data Cloud > Data Model, and search for Lead_Data_for_Training. If it's missing, an earlier step in the module (creating this custom Data Model Object or mapping a data stream to it) wasn't completed or didn't finish deploying. 

2. If it exists but Model Builder still can't find it, check its deployment/activation status — a DMO can show in the object list before it's fully "live" for consumption by Model Builder. 

3. Go back to the module step just before Model Builder and confirm you completed and saved the DMO/data stream setup fully (including any "Deploy" or "Save" action), not just created a draft. 

4. If everything looks correct, wait 15-20 minutes and retry — DMO propagation to dependent services like Model Builder can lag slightly after creation. 

Hi Prathyusha, I recently went through this certification myself and completely understand the frustration with outdated Udemy content. Here is a comprehensive, up-to-date study guide that actually reflects the current Spring '26 state of Agentforce: 

OFFICIAL SALESFORCE RESOURCES (Most Important - Always Current) 

1. Agentforce Specialist Exam Guide:

- search "Agentforce Specialist exam guide" - study every topic listed 

2. Trailhead Trail: "Get Ready for Agentforce" - this is THE official prep trail, updated regularly 

3. Trailhead Trail: "Design and Implement AI Agents with Agentforce" - covers building, testing, deploying 

4. Trailhead Module: "Agentforce for Admins" - foundational concepts 

5. Trailhead Module: "Prompt Builder" - critical for the exam 

KEY EXAM TOPICS TO MASTER (Based on Exam Guide): 

- Agentforce architecture: Agents, Topics, Actions, Instructions 

- Types of agents: Service Agent, Sales Agent, SDR Agent, Internal Agents 

- Agent Builder vs Agentforce Studio 

- How Topics and Actions work together 

- Prompt Templates (Standard, Flex, Sales Email types) 

- Grounding: what it is, how Data Cloud and Knowledge ground agents 

- Testing agents in Agent Builder Preview pane 

- Agentforce for Slack and Agentforce for Mobile 

- Einstein Trust Layer: data masking, toxicity detection, audit trail 

- Agent Analytics and monitoring 

DEV ORG AVAILABILITY ISSUE (Your Main Problem) 

Many Agentforce features require specific Einstein/Agentforce add-on licenses that the standard Developer Edition org does NOT include. Here is how to get proper hands-on access: 

- Request a free Agentforce Developer Edition from:

(look for "Agentforce Dev Org" - these have Einstein licenses included) 

- Use Trailhead Playground orgs created specifically from Agentforce badges/superbadges - these provision the right licenses automatically 

- Look for the "Quick Start: Agentforce" Trailhead project - it provisions a properly licensed scratch org 

SUPERBADGES TO COMPLETE: 

- "Quick Start: Build Your First Agent with Agentforce" (beginner) 

- "Agentforce Service Agent" superbadge 

- "Build Agents with Agentforce" trail 

FREE LIVE RESOURCES: 

- Salesforce Ben's Agentforce certification guide on

(free, very current) 

-

- official community for Agentforce practitioners 

- TDX (Salesforce TrailblazerDX) session recordings on YouTube - March 2026 content is very relevant 

Avoid Udemy entirely for this cert - the platform moves too fast. Stick to official Trailhead and Salesforce Help documentation. 

Good luck with the exam - it is very achievable with the right resources!

Hi @Yurii Osypov

 This isn't something you can fix on your side the 

SalesforceDX Namespace Registry

 connected app is a Salesforce-owned system app (not one in your org's App Manager), so the read-only PKCE checkbox and "contact Support" message are accurate: there's no admin-level override available to you. 

What's going on:

Salesforce has been rolling out mandatory PKCE enforcement across connected apps/ECAs as part of its 2026 OAuth security push (the ISV-facing version of this had a May 11, 2026 compliance deadline for partner-owned apps). It looks like this got applied to Salesforce's own internal Namespace Registry connected app, but the 

Link Namespace button's OAuth kickoff flow on the Namespace Registries page itself isn't sending a code_challenge, So the connected app rejects its own login flow. That's a Salesforce side implementation bug, not a config issue in your Dev Hub.

The community thread you found (posted yesterday, still 0 replies) confirms this is recent and unresolved publicly.

What to actually do:

1. Check the Known Issues site first  
   Search
   issues.salesforce.com for "Namespace Registry" or "Link Namespace PKCE" if Salesforce has already logged this as a known issue, you'll get a status and any workaround/ETA without opening a duplicate case.
2. Open a Salesforce Support case  
   Since the Connected App policy is Salesforce-managed and read only, only Salesforce Support/Engineering can adjust or fix it. File under Platform/DX or ISV Partner Support if you have a Partner account reference the exact error (error=invalid_request&error_description=missing required code challenge) and that the Connected App shows PKCE as checked and read only.

3. Flag business impact clearly in the case  
   State explicitly that this is blocking namespace linking for a managed 2GP package intended for AppExchange that framing tends to get ISV-blocking bugs prioritized faster than a generic "error message" report.

4. Try from a different org/browser session as a sanity check  
   Not a real fix, but worth ruling out: confirm it's not a stale OAuth session or cached Connected App config in your specific Dev Hub by attempting Link Namespace from a fresh incognito session or a different System Admin user. If it fails identically, that confirms it's server side, not local state.

5. Hold off on other 2GP/namespace work in this org until resolved  
   Don't try to work around it with manual namespace assignment or an unlocked package as a substitute namespace linking is foundational for 2GP and AppExchange listing, and a workaround here could create a mess to unwind once Salesforce fixes the underlying bug.  
     
   Bottom line: there's no client side or admin side fix here this needs a Salesforce Support case, since you can't touch the Connected App policy on a system app that's flagged read-only. If you have a Partner/ISV support tier, use that channel rather than standard support; ISV-blocking bugs like this (can't link namespace → can't ship a 2GP/AppExchange package) tend to get escalated faster there.  
     
   I hope you find the above information helpful. If it does, please mark it as Best Answer to help others too.  
    

Hi , 

Your Trailhead Playground comes with (2) full Salesforce licenses. If you've already used up both licenses and you try to create the new System Administrator user, it will look like this:

Profiles other than admins also use Salesforce licenses.

If you do not find the "Salesforce" license in the drop-down, please check for the other user who's active with that license and deactivate them, please follow the below steps to deactivate.

Goto setup--> users-->click view users drop down and then select "Active users" option.  

Here you can find the list of active users. Please deactivate the "salesforce" license user.

NOTE: Salesforce License can be assigned to other Profiles too, hence please check out all your active user who has Salesforce license and then proceed accordingly. 

The wording can not find a permission set that grants... is the clue — the grader looks the set up by API name first, then checks the field pattern. Two things trip most people here: 

1. The API name must be exactly Manage_Job_Applications (underscores, not spaces). If it is even slightly different the grader cannot find it and reports exactly that message. Open the permission set and confirm the API Name reads Manage_Job_Applications. 

2. Position and Candidate must be Read-only, meaning Read checked and Edit unchecked — not hidden. If you unchecked Read as well they count as not readable and the all-fields-readable check fails. Verify both show Read on, Edit off. 

Also worth a quick pass: 

- Every other Job Application field needs BOTH Read and Edit checked. Scroll the entire field list — a single field left without Edit fails it. (Any formula field can only be Read, and that is expected.) 

- Object permissions: Read and Edit only, which you have — no Create, Delete, View All, or Modify All. 

Nine times out of ten on this one it is the API name, or Position/Candidate being hidden instead of read-only. Fix that and recheck. 

if this helps, please mark it as the Best Answer so it helps the next person — thanks 🙂

Hey Melanie, 

Your setup in the screenshot matches the official steps exactly (Name, Action: Add, Product: Laptop Pro Bundle), so the immediate fields look correct. A few things worth checking given the exact wording of the checker error: 

1. Confirm the record actually saved, not just appears in the panel. Go back to the main Laptop Pro Master Orchestration workspace view (close the side panel entirely) and check if "Scenario Laptop Pro Invoicing" shows up in the Scenarios list under Invoicing there, not just inside the panel you had open when creating it. 

2. Double-check exact spelling/capitalization, "Scenario Laptop Pro Invoicing" needs to match character-for-character (the checker is typically case- and space-sensitive). 

3. Per the official steps, this same pattern (create a scenario per fulfillment step group) needs to be repeated across other lanes too, not just Invoicing. If the challenge checker validates all expected scenarios together and one from another lane is missing or misnamed, it can sometimes surface the error against a different scenario name than the one actually missing. Worth confirming all your lanes (Inventory Management, etc.) have their expected scenarios created too, not just Invoicing. 

4. Refresh the page fully after saving, sometimes the panel doesn't reflect a true save until a hard refresh. 

Reference:

Hey Bernadette, 

This error means Trailhead couldn't retrieve an access token for your hands-on org, not a generic connection blip. The real fix confirmed by others hitting this exact message: 

1. Confirm you can log into your hands-on org directly (outside Trailhead) first 

2. Go to your Trailhead account, find "Launch your hands-on org," and disconnect/unlink the org (look for an "x" next to it) 

3. Reconnect it fresh (re-authenticate) 

4. Try the challenge again 

If disconnecting doesn't show an option, or you only have one org listed with no visible "x," try creating a completely new Trailhead Playground instead, that resets the token relationship cleanly. 

If this still doesn't work after unlinking/relinking, log a case with Trailhead Support, this exact error has been reported as an ongoing token-refresh issue for some accounts that isn't user-side fixable. 

Reference: