What you are evaluating
Identity Center can use an external identity provider and support customer-managed SAML applications. Scope account access, application assignments and provisioning separately; it is not a complete customer-identity or identity-governance product.
A useful evaluation context
An AWS-centered team can evaluate account and SAML application access integrated with an existing workforce identity provider.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Workforce users federate from Entra, Okta, Ping, or Active Directory and receive temporary credentials into AWS accounts and AWS-managed applications.
- System for Cross-domain Identity Management provisioning keeps Identity Center users aligned with the upstream identity provider.
- Customer-managed SAML applications can be added so Identity Center covers selected software-as-a-service apps, not only the AWS console.
Where it fits in the work
- In an isolated AWS organization, enable Identity Center and connect a lab identity provider rather than creating long-lived IAM users.
- Assign an account permission set to a synthetic user, then separately assign an application and configure its SAML connection.
- Disable the user upstream and measure new-login denial, provisioning delay and the remaining lifetime of issued AWS credentials and application sessions.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Federate a synthetic user into a sandbox account and SAML application, obtain temporary role credentials, then disable the identity upstream.
Evidence to look for
The record distinguishes denial of new federation from provisioning delay, existing application sessions and already-issued credentials, documenting when each access path actually stops.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which applications in the Identity Center catalog and which customer-managed SAML applications will you actually assign in the lab?
- Which permission sets and account assignments provide required access without unnecessary standing administrator privilege?
- If you also need customer identity or identity governance, which products remain outside Identity Center?
Names you may encounter: AWS Single Sign-On · AWS SSO. Historical names do not establish current availability or feature equivalence.