Introduction
This blog provides step-by-step instructions to implement AWS IAM Identity Center with Microsoft Entra ID as the identity source. Authentication is handled via SAML 2.0. User and group provisioning is handled via SCIM 2.0. IAM Identity Center is administered from a dedicated Identity account using Delegated Administration.
Prerequisites
- AWS Organization active with All Features enabled.
- IAM Identity Center enabled in the Management account.
- Dedicated Identity account available and enrolled in the Security OU ( Optional ).
- AdministratorAccess will be required in the Management account for delegation registration.
- AdministratorAccess will be required in the Identity account for all IAM IC configuration.
- Global Administrator or Application Administrator role in Azure Microsoft Entra ID.
- AWS CLI v2 installed for CLI steps.
Phase 1 — Enable IAM Identity Center
Step 1: Enable IAM Identity Center
Sign in to the Management account.
- Open AWS Console > IAM Identity Center.
- Click Enable.
- Select the region where IAM IC will run (e.g., eu-west-1). This cannot be changed later.
- Click Enable IAM Identity Center.
Step 2: Create the IAM Identity Center Access Portal Domain
In IAM Identity Center > Settings > Identity source tab.
- Under IAM Identity Center URL, click Customize.
- Enter a subdomain for the portal: like blog (or blog-aws if already taken). The full URL will be: https://blog.awsapps.com/start
- Click Save.
Step 3: Register Identity Account as IAM IC Delegated Administrator
Run from the Management account.
- aws organizations register-delegated-administrator –account-id <IDENTITY-ACCOUNT-ID> –service-principal sso.amazonaws.com
Step 4: Verify IAM Identity Center Management Access from Identity Account
- Log in to the Identity account console.
- Open IAM Identity Center.
- Confirm the full management interface is visible: Dashboard, Users, Groups, Permission sets, AWS accounts.
- Confirm all organisation accounts are listed under AWS accounts.
Phase 2 — Entra ID Enterprise Application Setup
All steps in this phase are performed in the Microsoft Entra ID admin portal at https://entra.microsoft.com unless stated otherwise.
Step 5: Create the AWS IAM Identity Center Enterprise Application
- Entra ID > Enterprise Applications > New application.
- Search: AWS IAM Identity Center.
- Select AWS IAM Identity Center.
- Click Create.
Step 6: Get SAML Values from IAM Identity Center
- In the Identity account, IAM Identity Center > Settings > Identity source tab > Actions > Change identity source > External identity provider.
- Copy and save these two values:
- IAM Identity Center ACS URL – e.g., https://eu-west-1.signin.aws/platform/saml/acs/…
- IAM Identity Center issuer URL – e.g., https://eu-west-1.signin.aws/platform/saml/…/metadata
- Keep this tab open. These are needed in the next step.
Step 7: Configure SAML in Entra ID Application
In the enterprise application – Single sign-on > SAML > Basic SAML Configuration > Edit.
| Field | Value |
| Identifier (Entity ID) | Paste the IAM IC issuer URL from Step 6. |
| Reply URL (ACS URL) | Paste the IAM IC ACS URL from Step 6. |
| Sign-on URL | Leave blank. |
- Save the Basic SAML Configuration.
- Scroll to SAML Certificates > Federation Metadata XML > Download.
- Save the XML file — needed in Step 8.
Step 8: Upload Entra ID Metadata to IAM Identity Center
Back in IAM Identity Center, on the Change identity source screen from Step 6.
- Under IdP SAML metadata, click Choose file.
- Upload the Federation Metadata XML downloaded in Step 7.
- Click Next.
- Type ACCEPT in the confirmation field.
- Click Change identity source.
Phase 3 — SCIM Provisioning
Step 9: Enable SCIM in IAM Identity Center
Identity account – IAM Identity Center > Settings > Identity source tab.
- Under Automatic provisioning, click Enable.
- Copy both values immediately — shown only once:
- SCIM endpoint URL
- Access token
- Store securely before closing.
SCIM endpoint format: https://scim.eu-west-1.amazonaws.com/<tenant-id>/scim/v2/
Step 10: Configure Provisioning in Entra ID Application
Entra ID enterprise application – Provisioning > Get started.
- Set Provisioning Mode to Automatic.
- Admin Credentials:
- Tenant URL: Paste SCIM endpoint URL from Step 9.
- Secret Token: Paste access token from Step 9.
- Click Test Connection. Expected: “The supplied credentials are authorised to enable provisioning.”
- Click Save.
If Test Connection fails — check SCIM URL has no trailing spaces and the token is complete.
Step 11: Set Provisioning Scope
Provisioning section > Settings.
- Set Scope to Sync only assigned users and groups.
- Save.
Step 12: Assign Entra ID Groups to the Enterprise Application
- Entra ID enterprise application — Users and groups > Add user/group > Add assignment.
- Add all AWS access groups.
- Example – for a single group setup:
| Group | Purpose |
| AWS-Prod-Admin | Production admin access |
| AWS-Dev-Developer | Developer access on dev accounts |
- Click Assign after selecting all groups.
Step 13: Start Initial SCIM Provisioning Cycle
Entra ID enterprise application – Provisioning > Overview.
- Click Start provisioning.
- Initial sync: 20–40 minutes.
- Monitor at: Provisioning > Provisioning logs.
Phase 4 — Permission Sets
Step 14: Create Permission Sets
Identity account – IAM Identity Center > Permission sets > Create permission set.
Example – creating AWSAdministratorAccess:
- Select AWS managed policy.
- Choose AdministratorAccess.
- Session duration: 1 hour.
- Name: AWSAdministratorAccess.
- Create.
Phase 5 — Account Assignments
Step 15: Assign Groups to AWS Accounts
Identity account – IAM Identity Center > AWS accounts > select account > Assign users or groups.
Example – assign AWS-Prod-Admin to a production account:
- Select the production account.
- Click Assign users or groups.
- Select group: AWS-Prod-Admin.
- Select permission set: AWSAdministratorAccess.
- Click Assign.
Step 16: Verify IAM Roles Created in Target Accounts
List SSO-created roles in a target account
- aws iam list-roles –query “Roles[?starts_with(RoleName, ‘AWSReservedSSO_’)].RoleName”
Phase 7 – MFA
MFA is enforced at the Entra ID level via Conditional Access policies. Verify the existing policy covers AWS before configuring anything in IAM IC.
Step 17: Verify Entra ID Conditional Access Covers AWS
- Entra ID > Protection > Conditional Access > Policies.
- Confirm the MFA policy scope includes All cloud apps or the AWS IAM Identity Center enterprise application explicitly.
- Test login via the IAM IC portal – Entra ID MFA prompt should appear during the SAML redirect.
Step 18: Configure MFA in IAM IC (Only if Conditional Access Does Not Cover AWS)
- Identity account > IAM IC > Settings > Authentication.
- MFA enforcement: Required.
- Allowed MFA types: Authenticator app (TOTP) and FIDO2 security key.
- Device prompt: Every time they sign in.
- Save.
Conclusion
AWS IAM Identity Center has been successfully configured with Microsoft Entra ID as the identity provider. SAML 2.0 authentication and SCIM 2.0 provisioning are active, with users and groups syncing automatically from Entra ID. The DeveloperPermissionBoundary policy is deployed across all target accounts to prevent privilege escalation. All AWS access is now managed through the IAM Identity Center portal at https://blog.awsapps.com/start using existing Entra ID credentials – no separate AWS IAM users or access keys are required.