# IAM Identity Center Published articles for IAM Identity Center. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing AWS account access manager: IAM role flexibility with centralized workforce access DevFeed: [Introducing AWS account access manager: IAM role flexibility with centralized workforce access]() Original publisher: [Read original article]() Author: Moumita Saha Published: 2026-11-05T19:21:56Z Content type: release Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM](), [AWS IAM Identity Center](), [identity and access management](), [rbac](), [Amazon Web Services](), [Single sign-on (SSO)](), [okta](), [AWS CloudTrail](), [Duo](), [Entra ID]() Tags: [access-control](), [access-management](), [aws](), [aws-cli](), [aws-cloudformation](), [aws-cloudtrail](), [aws-command-line-interface-aws-cli](), [aws-iam](), [aws-iam-identity-center](), [aws-identity-and-access-management-iam](), [aws-key-management-service](), [aws-key-management-service-aws-kms](), [aws-management-console](), [aws-sdk](), [aws-tools-for-powershell](), [best-practices](), [beyondtrust](), [iam](), [iam-identity-center](), [intermediate-200](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [workforce]() ### AI overview Account access manager lets an organization assign existing IAM roles in individual AWS accounts to IAM Identity Center users and groups through a centralized federation point, while retaining role-specific trust policies, tags, and paths and adding user-level audit context. Setup requires an organization instance of IAM Identity Center, eligible IAM roles with a trust policy allowing the service, and management-account enablement in the Identity Center primary Region. Administrators create per-user or per-group entitlements; each role assignment is created individually, and the console cannot discover roles, so administrators must know their names. Users can access assigned roles in the portal or obtain CLI credentials with `aws login` (AWS CLI v2.36.0 or newer); IAM Identity Center commands such as `aws sso configure` do not work for these assignments. Role sessions use the underlying role's configured maximum duration, up to 12 hours. The text says the service is available at no additional cost in Commercial Regions except opt-in Regions, and excludes GovCloud (US), China, and other non-commercial Regions. ### Source excerpt AWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts. This combines the IAM role flexibility your teams already rely on, delivered through the centralized federation of AWS IAM Identity Center, with user-level visibility built-in. Account access manager streamlines [...] ## Deploy Amazon WorkSpaces across Regions with Entra ID and IAM Identity Center DevFeed: [Deploy Amazon WorkSpaces across Regions with Entra ID and IAM Identity Center]() Original publisher: [Read original article]() Author: Haneesh Kotha Published: 2026-10-23T14:26:01Z Content type: tutorial Language: en Sources: [Desktop and Application Streaming]() Topics: [AWS IAM Identity Center](), [Amazon WorkSpaces](), [Entra ID](), [Single sign-on (SSO)]() Tags: [active-directory](), [amazon-workspaces](), [architecture](), [aws](), [aws-iam-identity-center](), [azure](), [best-practices](), [customer-solutions](), [deploy](), [entra-id](), [euc](), [iam](), [iam-identity-center](), [identity](), [identity-management](), [microsoft](), [microsoft-entra-id](), [organizations](), [personal](), [region](), [regions](), [runtime](), [workspaces]() ### AI overview IAM Identity Center multi-Region replication lets organizations connect one Microsoft Entra ID tenant to Amazon WorkSpaces Personal across Regions while each Region authenticates locally against its own replica. The setup synchronizes users and groups to a primary Identity Center instance, encrypts and replicates identity data with a customer-managed multi-Region KMS key, and configures Entra ID SAML/SCIM, Intune, and Windows Autopilot for Entra-joined desktops. Each Region also needs local Secrets Manager credentials and a WorkSpaces directory tied to its replica; directory names must match Autopilot OrderID rules exactly. Local authentication can continue during an outage in another Region, but identity-change propagation depends on the primary. The source also notes UPN length and change constraints, manual replication of KMS key policy updates, and the need to plan Entra client-secret rotation. ### Source excerpt Organizations with a globally distributed workforce often need to deploy Amazon WorkSpaces Personal across multiple AWS Regions while maintaining centralized identity management with Microsoft Entra ID (formerly Azure Active Directory). Until recently, this required a tradeoff: either a single AWS IAM Identity Center instance with cross-Region calls at runtime, or separate Identity Center instances per [...] ## Scale your team's use of AWS IAM account access manager with Pulumi DevFeed: [Scale your team's use of AWS IAM account access manager with Pulumi]() Original publisher: [Read original article]() Author: Tatiana Cooke Published: 2026-10-14T00:00:00Z Content type: tutorial Language: en Sources: [Pulumi]() Topics: [pulumi](), [AWS IAM](), [Access Control](), [Single sign-on (SSO)](), [Security, Identity, & Compliance](), [CI/CD]() Tags: [administrator](), [aws](), [aws-iam](), [aws-iam-identity-center](), [iam](), [iam-identity-center](), [iam-roles](), [infrastructure-as-code](), [partner](), [product](), [pulumi](), [sdks](), [security]() ### AI overview This tutorial explains how to manage AWS IAM account access manager (AAM) with Pulumi. It covers defining IAM roles, applications, and entitlements as code, scaling group-to-role assignments across AWS accounts, and using policy checks and review workflows. A digital bank is described as adopting AAM to move workforce access to IAM Identity Center while managing roles and entitlements in Pulumi. ### Source excerpt In September 2026, AWS launched AWS IAM account access manager (AAM), which lets administrators assign IAM roles to workforce users and groups in AWS IAM Identity Center. AAM combines IAM Identity Center's single federation point and user awareness with the flexibility of IAM roles. Today, as part of our partner launch enablement, we're pleased to share that you can manage AAM as code with Pulumi. The accountaccess resources ship in the Pulumi AWS provider (v7.45.0 and later) and in the Pulumi AWS Cloud Control provider, AWS Native (v1.75.0 and later), with SDKs generated for every Pulumi language: TypeScript, Python, Go, C#, Java, HCL, and YAML. Teams that already manage their AWS organization with Pulumi can adopt AAM in the same stacks, languages, and review workflows they use today. If you're not using Pulumi today, this post demonstrates how infrastructure as code can help you adopt new AWS services and securely scale them out to your organization faster. In this post, we explain where AAM fits alongside permission sets. We walk through defining roles, applications, and entitlements as code, and we describe how one financial services customer is using this pattern to move its workforce access to IAM Identity Center. The challenge: flexible roles vs. centralized access Until now, organizations managing human access across many AWS accounts have had to choose between two approaches. IAM Identity Center permission sets provide a single sign-on experience and centralized user awareness. IAM Identity Center provisions a permission set into each account as a uniform role. That works well for baseline access, such as read-only or administrator access that looks the same everywhere. But many enterprises need roles that differ from account to account. These roles carry account-specific policies, tags for attribute-based access control (ABAC), custom trust policies, or role paths that encode team and environment. As organizations add accounts, teams, and specialized role ## Connect Amazon SageMaker Unified Studio to Microsoft Power BI - Part 1: IAM Identity Center (IDC)-based domains DevFeed: [Connect Amazon SageMaker Unified Studio to Microsoft Power BI - Part 1: IAM Identity Center (IDC)-based domains]() Original publisher: [Read original article]() Author: Ramesh H Singh Published: 2026-09-15T20:55:26Z Content type: tutorial Language: en Sources: [AWS Big Data Blog]() Topics: [AWS IAM Identity Center](), [Authentication](), [Amazon SageMaker](), [business-intelligence](), [Data visualization](), [Amazon Web Services]() Tags: [amazon](), [amazon-athena](), [amazon-sagemaker](), [amazon-sagemaker-unified-studio](), [announcements](), [athena](), [authentication](), [aws](), [aws-iam-identity-center](), [business-intelligence](), [data-visualization](), [iam-identity-center](), [integration](), [intermediate-200]() ### AI overview This tutorial explains how to connect Microsoft Power BI directly to governed data in Amazon SageMaker Unified Studio using new authentication modes in the Amazon Athena ODBC driver. It focuses on IAM Identity Center-based domains and describes DSN-based and DSN-less connection methods without a third-party ODBC-JDBC bridge. ### Source excerpt Connect Microsoft Power BI directly to governed data in Amazon SageMaker Unified Studio using new authentication modes in the Amazon Athena ODBC driver, with no third-party ODBC-JDBC bridge. Part 1 covers IAM Identity Center (IDC)-based domains with both DSN-based and DSN-less connection methods. ## Automate IAM Identity Center governance with continuous discovery and reporting DevFeed: [Automate IAM Identity Center governance with continuous discovery and reporting]() Original publisher: [Read original article]() Author: Jonathan Nguyen Published: 2026-08-31T17:18:31Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS IAM](), [CSV]() Tags: [advanced-300](), [authentication](), [aws](), [aws-iam-identity-center](), [aws-organizations](), [compliance](), [iam](), [iam-identity-center](), [identity](), [integration](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview The article explains how to plan identity governance for AWS IAM Identity Center and use an automated discovery and reporting sample solution to track application access assignments across an organization. ### Source excerpt AWS IAM Identity Center integrates with external identity provider (IdP) to provide customers with a centralized authentication and authorization solution for AWS resources across AWS Organizations. AWS continues to invest into IAM Identity Center with a growing number of AWS services that natively integrate with IAM Identity Center. As your AWS organization scales, maintaining visibility [...] ## Modernize VB.NET applications to .NET 10 with AWS Transform DevFeed: [Modernize VB.NET applications to .NET 10 with AWS Transform]() Original publisher: [Read original article]() Author: David Pallmann Published: 2026-03-11T20:28:53Z Content type: tutorial Language: en Sources: [.NET on AWS Blog]() Topics: [AWS Transform](), [.NET](), [.NET Framework](), [WinForms](), [Visual Studio](), [AWS IAM Identity Center]() Tags: [aws-transform](), [c-sharp](), [forms](), [iam-identity-center](), [net](), [net-10](), [net-framework](), [studio](), [transformation](), [uncategorized]() ### AI overview This tutorial demonstrates using the preview AWS Transform feature in Visual Studio 2026 to modernize a Visual Basic .NET Framework Windows Forms application to .NET 10. It covers setup, prerequisites, authentication with IAM Identity Center, and the initial transformation workflow. ### Source excerpt AWS Transform is an agentic service that accelerates modernization, including .NET applications. With it, you can transform various types of .NET Framework projects to modern versions of .NET including .NET 10. Until recently that support was limited to projects written in C#, the most-used .NET language. AWS Transform can now transform projects written in Visual [...] ## Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO) DevFeed: [Automating Multi-Account Permission Management with AWS IAM Identity Center (previously AWS SSO)]() Original publisher: [Read original article]() Author: Niko Jernejsek Published: 2022-12-22T10:32:09Z Content type: article Language: en Sources: [Homegate Engineering Blog - Medium]() Topics: [AWS IAM Identity Center](), [AWS Organizations](), [Single sign-on (SSO)](), [Authorization](), [identity and access management](), [CI/CD]() Tags: [aws](), [aws-eventbridge](), [aws-iam](), [aws-iam-identity-center](), [aws-organizations](), [cicd](), [cloudformation](), [iam-identity-center](), [least-privilege](), [saml](), [security](), [sso]() ### AI overview This article describes Homegate's multi-account AWS strategy and its use of AWS IAM Identity Center, formerly AWS SSO, to centrally manage permissions for engineers across AWS accounts. It explains the use of permission matrices, least-privilege access, AWS Organizations, external identity providers through SAML 2.0, and SCIM. ### Source excerpt Background Homegate was founded in 2001 and is now the leading property marketplace in Switzerland. Few years ago we decided to re-architect our monolithic real estate platform towards micro services on top of AWS cloud. At the moment, Homegate workloads are running almost exclusively on server-less compute model with teams organised around micro services. We are utilising so called multi-account strategy where we structure our AWS accounts around individual micro services further breaking them down into different accounts according to software lifecycle, and organising them into the AWS Organizational Units. We've structured our AWS Organizations Units & AWS accounts according to the recommendations provided by AWS (https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/basic-organization.html#basic-organization-with-cicd-as-a-separate-function). Apart from having product workload accounts we also have accounts which are necessary to operate security, governance and platform related workloads. Access to accounts is governed by a permission matrix which is based on least privilege principles. The permission matrix classifies who (internally defined personas, e.g.: engineers/managers/security officers, etc) has what type of access (e.g. read-only or admin), and to what category of AWS accounts (e.g. production workloads, shared infra accounts, etc). Group of accounts in our Permission Matrix are at the same time AWS Organisational Units that we implement. As we have to manage permissions for hundreds of engineers to about hundred of AWS accounts accordingly, this way of grouping makes it easier for us to manage it at scale. IAM Identity Center PrimerIAM Identity Center Intro Note that I will be using AWS IAM Identity Center and AWS SSO interchangeably as even some services (such as CloudFormation) are still using the previous name AWS SSO. AWS IAM Identity Center is a single sign-on (SSO) service that allows AWS users to centrally manage acces