Question

A large enterprise runs 40 AWS accounts under AWS Organizations. The security team wants employees to authenticate using the company's existing Microsoft Entra ID (Azure AD) as the identity provider and access assigned accounts through a single portal. Access to specific accounts must be governed by the employee's group membership in Entra ID, and permissions must be defined once and reused across many accounts. Which approach meets these requirements with the least ongoing operational overhead?

Accepted Answer

Enable IAM Identity Center, configure Entra ID as an external SAML identity provider with SCIM provisioning, create permission sets, and assign groups to accounts.

Answer

Create individual IAM users in each of the 40 accounts and configure a SAML 2.0 identity provider in each account pointing to Entra ID, mapping groups to IAM roles per account.

Answer

Deploy a self-managed Active Directory in a shared services account, establish a trust with Entra ID, and use cross-account IAM roles assumed via the AWS CLI.

Answer

Configure Amazon Cognito user pools federated with Entra ID and use identity pools to vend temporary credentials into each member account.