Updated October 25, 2026
· ~2 min read
Every AWS organization should give people access through IAM Identity Center: short-lived credentials, permission sets per account, one place to remove someone. Identity Center itself has no charge. The decision is which identity provider it trusts, and that is usually decided by what the company already uses for email.
Provision groups, not individuals, and map groups to permission sets per account. Turn on SCIM so leavers lose AWS access when their IdP account is disabled, not when someone remembers. Require phishing-resistant MFA (passkeys or security keys) for anyone with administrator permission sets. Keep two break-glass users that do not depend on the IdP, with credentials in a safe and alarms on their use.
Question 1 of 1
What does the company use for email and productivity?
**Entra ID:** you are on Microsoft 365. Conditional access, device compliance and SCIM provisioning to Identity Center; P1 is included in Microsoft 365 E3 and costs $7 a user a month standalone since July 2026. **Okta:** you want an independent identity layer across many SaaS products and clouds, with strong lifecycle workflows. A separate subscription. **Google Workspace:** you run on Google Workspace. SAML federation and automatic provisioning to Identity Center. **Identity Center's own directory:** a small team without a company IdP yet. Move to a real IdP before you have more than a handful of people.
AWS Control Tower & Account Vending
Enterprise AWS account governance using Control Tower: automated account vending, preventive and detective guardrails, and a scalable multi-account foundation.
AWS Landing Zone Foundation
Enterprise-grade AWS account structure designed for security, scalability, and compliance from day one.
SOC 2 Accelerator on AWS
Production-ready AWS architecture and controls designed to pass SOC 2 quickly and safely.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.