{"id":5196,"date":"2024-11-15T11:33:52","date_gmt":"2024-11-15T11:33:52","guid":{"rendered":"https:\/\/www.liainfraservices.com\/blog\/?p=5196"},"modified":"2025-03-14T10:32:28","modified_gmt":"2025-03-14T10:32:28","slug":"microsoft-entra-sso-integration-with-aws-single-account-access","status":"publish","type":"post","link":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/","title":{"rendered":"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access"},"content":{"rendered":"<span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\"><\/span> <span class=\"rt-time\"> 5<\/span> <span class=\"rt-label rt-postfix\">min read<\/span><\/span><div class='epvc-post-count'><span class='epvc-eye'><\/span>  <span class=\"epvc-count\"> 5,534<\/span><\/div>\n<h2 class=\"wp-block-heading\">Enabling SSO for AWS with Azure Entra ID: A Step-by-Step Guide<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In today&#8217;s digital era, Single Sign-On (SSO) is an essential feature for secure access to resources across other platforms. Implementing SSO between platforms like AWS and Azure Entra ID (previously it was named as Azure Active Directory) enables the organization users to access AWS resources using their Azure credentials. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we will configure an AWS account as an SSO application within Microsoft Entra ID.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What we would need to perform this activity<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>An Azure Account<\/strong> with a valid subscription.<\/li>\n\n\n\n<li><strong>An AWS Account<\/strong> with admin access to configure roles and identity providers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What we are aiming to achieve?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Let`s imagine a scenario where students from one school can access resources (like books) from another school without enrolling there directly. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This setup is similar: we will create a trust relationship between AWS and Azure so that users in Azure can access AWS resources without being added to AWS&#8217;s IAM user list.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Overview of Steps<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To achieve this integration, we\u2019ll go through these main steps:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Set Up AWS as an Enterprise Application in Microsoft Entra ID<\/strong><\/li>\n\n\n\n<li><strong>Enable SSO with SAML in Azure<\/strong><\/li>\n\n\n\n<li><strong>Create Identity Provider in AWS and Upload SAML XML<\/strong><\/li>\n\n\n\n<li><strong>Create Specific AWS Roles for Azure Users<\/strong><\/li>\n\n\n\n<li><strong>Provision AWS Application in Azure with Automated Access Control<\/strong><br><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Set Up AWS as an Enterprise Application in Azure Entra ID<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Log into the Azure Portal<\/strong> and go to <strong>Azure Active Directory > Enterprise applications<\/strong>.<\/li>\n\n\n\n<li><strong>Create an AWS Enterprise Application<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Click <strong>New application<\/strong> <\/li>\n\n\n\n<li>AWS would be automatically listed under cloud platforms. <\/li>\n\n\n\n<li>If its not listed, then click on &#8220;Create your own application&#8221; and search for AWS<\/li>\n\n\n\n<li>Select the AWS (<strong>AWS Single-Account Access<\/strong>) <\/li>\n\n\n\n<li>Enter a name, like &#8220;AWS SSO,&#8221; (I kept name as &#8220;partho-aws-account&#8221;)<\/li>\n\n\n\n<li>Click <strong>Create<\/strong> to generate the application in Azure.<\/li>\n\n\n\n<li><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configure Basic SAML SSO Settings<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Once the application is created, go to <strong>Single sign-on<\/strong> and choose <strong>SAML<\/strong>.<\/li>\n\n\n\n<li>Keep the default values<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"771\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-ent-app-1-1024x771.png\" alt=\"\" class=\"wp-image-5201\" style=\"width:545px;height:auto\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-ent-app-1-1024x771.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-ent-app-1-300x226.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-ent-app-1-768x578.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-ent-app-1-1536x1156.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-ent-app-1.png 1996w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li> <strong>Download the Federation Metadata XML<\/strong> file from Azure under the <strong>SAML Signing Certificate<\/strong> section. This XML contains the SAML configurations that AWS will use to trust Azure as an Identity Provider.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"721\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/saml-1024x721.png\" alt=\"\" class=\"wp-image-5202\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/saml-1024x721.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/saml-300x211.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/saml-768x541.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/saml-1536x1082.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/saml-2048x1443.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Enable SSO on the Azure AWS Application<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With the application set up, the next step is to enable SSO on the application:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Ensure Unique Identifier<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Confirm that the Identifier is unique and not shared with any other application in your Azure AD instance.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Save Settings<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Save these settings so Azure Entra ID can recognize the AWS account through SAML.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Set Up AWS Identity Provider with Azure SAML Metadata<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"658\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-xml-upload-1024x658.png\" alt=\"\" class=\"wp-image-5203\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-xml-upload-1024x658.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-xml-upload-300x193.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-xml-upload-768x493.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-xml-upload-1536x986.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-xml-upload.png 1850w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Now, let\u2019s configure AWS to recognize Azure as a trusted SAML provider.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Log in to the AWS Console<\/strong> with an admin account.<\/li>\n\n\n\n<li><strong>Navigate to IAM > Identity Providers<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Click <strong>Add Provider<\/strong>, select <strong>SAML<\/strong>, and give it a name (e.g., &#8220;AzureEntra_SAML&#8221;).<\/li>\n\n\n\n<li><strong>Upload the XML<\/strong> file downloaded from Azure, which provides AWS the necessary information about your Azure configuration.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Save the SAML Provider<\/strong>:\n<ul class=\"wp-block-list\">\n<li>This step completes the SAML trust between AWS and Azure Entra ID, allowing Azure to act as the Identity Provider for AWS.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>This makes both Azure and AWS connected through SAML authentication.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Now, to do the test, if the Entra user can access AWS resources using their entra ID. We have to create a role in AWS and assign that role to a user in Azure. Let`s see that in action.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Create Specific AWS IAM Roles for Azure Users<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With trust established, now set up AWS roles that Azure users will assume based on their permissions.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Create Two Roles in AWS<\/strong>:\n<ul class=\"wp-block-list\">\n<li>One role for <strong>Full EC2 Access<\/strong> and another for <strong>Full S3 Access<\/strong>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Role Setup<\/strong>:\n<ul class=\"wp-block-list\">\n<li>When creating each role, select <strong>SAML 2.0 Federation<\/strong> as the trusted entity.<\/li>\n\n\n\n<li>Choose the <strong>Identity Provider<\/strong> you created (e.g., &#8220;AzureEntra_SAML&#8221;).<\/li>\n\n\n\n<li>Rest, assigning the appropreate policy remain as usual<\/li>\n\n\n\n<li>Attach policies to each role (e.g., <code>AmazonEC2FullAccess<\/code> for the EC2 role and <code>AmazonS3FullAccess<\/code> for the S3 role).<\/li>\n\n\n\n<li>Name the roles appropriately, such as &#8220;AzureEntra_EC2FullAccess&#8221; and &#8220;AzureEntra_S3FullAccess.&#8221;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"580\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-saml-role-1024x580.png\" alt=\"\" class=\"wp-image-5204\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-saml-role-1024x580.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-saml-role-300x170.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-saml-role-768x435.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-saml-role-1536x869.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/aws-saml-role-2048x1159.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Provision the AWS Application in Azure Entra ID<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This step allows the azure to identify the roles that are created into the AWS, and for that we need to enable an automated provisioning. But, for that we need a service account who needs to list all the AWS Roles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Provisioning allows Azure to manage AWS role assignments for users automatically. <\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Create a Service Account in AWS<\/strong>: (Its like a normal IAM user with policy attached to list only the IAM Roles)\n<ul class=\"wp-block-list\">\n<li>Create an IAM user in AWS with permissions to list roles.<\/li>\n\n\n\n<li>Attach an IAM policy like <code>IAMReadOnlyAccess<\/code> to allow Azure to view IAM role information.<\/li>\n\n\n\n<li>Generate <strong>Access Key ID and Secret Access Key<\/strong> for this user and note these credentials.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"866\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/azure-provision-1024x866.png\" alt=\"\" class=\"wp-image-5205\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/azure-provision-1024x866.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/azure-provision-300x254.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/azure-provision-768x650.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/azure-provision-1536x1299.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/azure-provision.png 1894w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Configure Provisioning in Azure<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Azure Active Directory > Enterprise applications<\/strong>, open the <strong>AWS SSO application<\/strong>, and go to <strong>Provisioning<\/strong>.<\/li>\n\n\n\n<li>Set the <strong>Provisioning mode<\/strong> to <strong>Automatic<\/strong>.<\/li>\n\n\n\n<li>Under <strong>Admin Credentials<\/strong>, add the Access Key ID and Secret Access Key for the service account.<\/li>\n\n\n\n<li>Save your settings to enable Azure to sync users and groups to AWS automatically.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Assign Azure Users to AWS Roles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, add users or groups in Azure who need AWS access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example : In our Azure we have more than 500 users, but only few users are assigned to perfrom some actions on aws, so we need to add those users on the enterprise application, like this.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"826\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1024x826.png\" alt=\"\" class=\"wp-image-5206\" style=\"width:573px;height:auto\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1024x826.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-300x242.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-768x620.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user.png 1140w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Assign Users to AWS Application in Azure<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Go to <strong>AWS SSO Application > Users &amp; Groups<\/strong> in Azure.<\/li>\n\n\n\n<li>Click <strong>Add User\/Group<\/strong>, select the users\/groups from Azure Entra ID, and map each to their designated AWS roles (e.g., EC2 or S3 access roles).<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"287\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1-1024x287.png\" alt=\"\" class=\"wp-image-5208\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1-1024x287.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1-300x84.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1-768x215.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1-1536x431.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/ent-app-user-1-2048x574.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Step 7: Test the Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To verify everything is set up correctly, perform these steps:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"443\" src=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/my-app-1024x443.png\" alt=\"\" class=\"wp-image-5209\" style=\"width:411px;height:auto\" srcset=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/my-app-1024x443.png 1024w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/my-app-300x130.png 300w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/my-app-768x332.png 768w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/my-app-1536x664.png 1536w, https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/my-app.png 2004w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <a href=\"https:\/\/myapps.microsoft.com\">myapps.microsoft.com<\/a> and log in with an Azure Entra ID account.<\/li>\n\n\n\n<li>You should see AWS as an available application. Click the icon to access AWS.<\/li>\n\n\n\n<li>You\u2019ll be logged into AWS with the appropriate permissions, based on the role mappings.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the way, we enable SSO to Entra for a single point for authentication for any application that an organization need. We follow similar approach to enable SSO for Jenkins as well. <\/p>\n","protected":false},"excerpt":{"rendered":"<p><span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\"><\/span> <span class=\"rt-time\"> 5<\/span> <span class=\"rt-label rt-postfix\">min read<\/span><\/span>5,534 Enabling SSO for AWS with Azure Entra ID: A Step-by-Step Guide In today&#8217;s digital era, Single Sign-On (SSO) is an essential feature for secure access to resources across other<\/p>\n","protected":false},"author":1,"featured_media":5301,"comment_status":"open","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[971],"tags":[],"class_list":["post-5196","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access - Blog | Liainfraservices<\/title>\n<meta name=\"description\" content=\"Learn how to enable Single Sign-On (SSO) for AWS using Azure Entra ID (formerly Azure AD) with a step-by-step guide. Configure SAML authentication, set up identity providers, create IAM roles, and automate user provisioning for seamless access.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access - Blog | Liainfraservices\" \/>\n<meta property=\"og:description\" content=\"Learn how to enable Single Sign-On (SSO) for AWS using Azure Entra ID (formerly Azure AD) with a step-by-step guide. Configure SAML authentication, set up identity providers, create IAM roles, and automate user provisioning for seamless access.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog | Liainfraservices\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-15T11:33:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-14T10:32:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2240\" \/>\n\t<meta property=\"og:image:height\" content=\"1260\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Partho\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Partho\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/\"},\"author\":{\"name\":\"Partho\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#\\\/schema\\\/person\\\/b5a729cb152dd3bc7f07550ca9d223e4\"},\"headline\":\"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access\",\"datePublished\":\"2024-11-15T11:33:52+00:00\",\"dateModified\":\"2025-03-14T10:32:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/\"},\"wordCount\":1031,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png\",\"articleSection\":[\"devops\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/\",\"url\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/\",\"name\":\"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access - Blog | Liainfraservices\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png\",\"datePublished\":\"2024-11-15T11:33:52+00:00\",\"dateModified\":\"2025-03-14T10:32:28+00:00\",\"description\":\"Learn how to enable Single Sign-On (SSO) for AWS using Azure Entra ID (formerly Azure AD) with a step-by-step guide. Configure SAML authentication, set up identity providers, create IAM roles, and automate user provisioning for seamless access.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png\",\"contentUrl\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png\",\"width\":2240,\"height\":1260,\"caption\":\"Microsoft Entra SSO Integration with AWS single-account access\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/microsoft-entra-sso-integration-with-aws-single-account-access\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"devops\",\"item\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/category\\\/devops\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/\",\"name\":\"Blog | Liainfraservices\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#organization\",\"name\":\"Blog | Liainfraservices\",\"url\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/lia-logo-b-e1635340384244.png\",\"contentUrl\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/lia-logo-b-e1635340384244.png\",\"width\":308,\"height\":96,\"caption\":\"Blog | Liainfraservices\"},\"image\":{\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.liainfraservices.com\\\/blog\\\/#\\\/schema\\\/person\\\/b5a729cb152dd3bc7f07550ca9d223e4\",\"name\":\"Partho\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6c5fc8918cc5dbc844eccbeaaf854eef27d2c79ab17ff0022304f712805d6959?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6c5fc8918cc5dbc844eccbeaaf854eef27d2c79ab17ff0022304f712805d6959?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6c5fc8918cc5dbc844eccbeaaf854eef27d2c79ab17ff0022304f712805d6959?s=96&d=mm&r=g\",\"caption\":\"Partho\"},\"description\":\"Partho Das, founder of Lia Infraservices, has 15+ years of expertise in cloud solutions, DevOps, and infrastructure security. He provides consultation on architecture planning, DevOps setup, Kubernetes, and cloud migrations. Partho holds multiple AWS and Azure certifications, along with CISCO CCNA &amp; CCNP. Connect on LinkedIn\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/partho-dev\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access - Blog | Liainfraservices","description":"Learn how to enable Single Sign-On (SSO) for AWS using Azure Entra ID (formerly Azure AD) with a step-by-step guide. Configure SAML authentication, set up identity providers, create IAM roles, and automate user provisioning for seamless access.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access - Blog | Liainfraservices","og_description":"Learn how to enable Single Sign-On (SSO) for AWS using Azure Entra ID (formerly Azure AD) with a step-by-step guide. Configure SAML authentication, set up identity providers, create IAM roles, and automate user provisioning for seamless access.","og_url":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/","og_site_name":"Blog | Liainfraservices","article_published_time":"2024-11-15T11:33:52+00:00","article_modified_time":"2025-03-14T10:32:28+00:00","og_image":[{"width":2240,"height":1260,"url":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png","type":"image\/png"}],"author":"Partho","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Partho","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#article","isPartOf":{"@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/"},"author":{"name":"Partho","@id":"https:\/\/www.liainfraservices.com\/blog\/#\/schema\/person\/b5a729cb152dd3bc7f07550ca9d223e4"},"headline":"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access","datePublished":"2024-11-15T11:33:52+00:00","dateModified":"2025-03-14T10:32:28+00:00","mainEntityOfPage":{"@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/"},"wordCount":1031,"commentCount":0,"publisher":{"@id":"https:\/\/www.liainfraservices.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#primaryimage"},"thumbnailUrl":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png","articleSection":["devops"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/","url":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/","name":"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access - Blog | Liainfraservices","isPartOf":{"@id":"https:\/\/www.liainfraservices.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#primaryimage"},"image":{"@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#primaryimage"},"thumbnailUrl":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png","datePublished":"2024-11-15T11:33:52+00:00","dateModified":"2025-03-14T10:32:28+00:00","description":"Learn how to enable Single Sign-On (SSO) for AWS using Azure Entra ID (formerly Azure AD) with a step-by-step guide. Configure SAML authentication, set up identity providers, create IAM roles, and automate user provisioning for seamless access.","breadcrumb":{"@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#primaryimage","url":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png","contentUrl":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2024\/11\/Microsoft-Entra-SSO-Integration-with-AWS-single-account-access_1-.png","width":2240,"height":1260,"caption":"Microsoft Entra SSO Integration with AWS single-account access"},{"@type":"BreadcrumbList","@id":"https:\/\/www.liainfraservices.com\/blog\/microsoft-entra-sso-integration-with-aws-single-account-access\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.liainfraservices.com\/blog\/"},{"@type":"ListItem","position":2,"name":"devops","item":"https:\/\/www.liainfraservices.com\/blog\/category\/devops\/"},{"@type":"ListItem","position":3,"name":"Microsoft\u00a0Entra\u00a0SSO\u00a0integration\u00a0with AWS\u00a0single-account Access"}]},{"@type":"WebSite","@id":"https:\/\/www.liainfraservices.com\/blog\/#website","url":"https:\/\/www.liainfraservices.com\/blog\/","name":"Blog | Liainfraservices","description":"","publisher":{"@id":"https:\/\/www.liainfraservices.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.liainfraservices.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.liainfraservices.com\/blog\/#organization","name":"Blog | Liainfraservices","url":"https:\/\/www.liainfraservices.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.liainfraservices.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2021\/10\/lia-logo-b-e1635340384244.png","contentUrl":"https:\/\/www.liainfraservices.com\/blog\/wp-content\/uploads\/2021\/10\/lia-logo-b-e1635340384244.png","width":308,"height":96,"caption":"Blog | Liainfraservices"},"image":{"@id":"https:\/\/www.liainfraservices.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.liainfraservices.com\/blog\/#\/schema\/person\/b5a729cb152dd3bc7f07550ca9d223e4","name":"Partho","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6c5fc8918cc5dbc844eccbeaaf854eef27d2c79ab17ff0022304f712805d6959?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6c5fc8918cc5dbc844eccbeaaf854eef27d2c79ab17ff0022304f712805d6959?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6c5fc8918cc5dbc844eccbeaaf854eef27d2c79ab17ff0022304f712805d6959?s=96&d=mm&r=g","caption":"Partho"},"description":"Partho Das, founder of Lia Infraservices, has 15+ years of expertise in cloud solutions, DevOps, and infrastructure security. He provides consultation on architecture planning, DevOps setup, Kubernetes, and cloud migrations. Partho holds multiple AWS and Azure certifications, along with CISCO CCNA &amp; CCNP. Connect on LinkedIn","sameAs":["https:\/\/www.linkedin.com\/in\/partho-dev\/"]}]}},"_links":{"self":[{"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/posts\/5196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/comments?post=5196"}],"version-history":[{"count":11,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/posts\/5196\/revisions"}],"predecessor-version":[{"id":5219,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/posts\/5196\/revisions\/5219"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/media\/5301"}],"wp:attachment":[{"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/media?parent=5196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/categories?post=5196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.liainfraservices.com\/blog\/wp-json\/wp\/v2\/tags?post=5196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}