JA EN
shiichan

IAM Identity Center Makes Identity Source Changes Easier: Move from Active Directory to Okta or Entra ID Without Rebuilding

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, it's Shii-chan!

AWS What's New aws.amazon.com

Today I'm covering an IAM Identity Center update from AWS What's New. Identity source migrations just got a lot lighter.

What was announced?

AWS announced that IAM Identity Center now retains your workforce identities and their assignments when you change your identity source from Active Directory.

You can change to either of these:

  • An external identity provider (IdP) such as Okta or Microsoft Entra ID
  • The Identity Center directory

The story so far

Previously, changing from Active Directory to another identity source required you to recreate users, groups, and related items in IAM Identity Center.

What changes

The change now preserves:

  • Users
  • Groups
  • Group memberships
  • Permission set assignments
  • Application assignments

Your existing identity store stays in place, so users and groups keep the same IDs. Users retain access to AWS accounts and applications, and policies that reference user IDs, group IDs, or the identity store ID continue to work. That means less rebuilding of assignments and less policy rework during a migration.

Dive Deep

Steps and notes

  • Configure the new identity source with the standard setup required for users to sign in
  • After the change, your workforce signs in through your dual-stack AWS access portal URL
  • Changing in the other direction, to Active Directory, works as before

Availability

  • Applies to organization instances of IAM Identity Center
  • Available in all AWS Regions where IAM Identity Center is available
  • IAM Identity Center is provided at no additional cost

To get started, open the IAM Identity Center console and see "Change your identity source" in the User Guide.

Wrap-up

  • Users, groups, and assignments are retained when moving from Active Directory to an external IdP or the Identity Center directory
  • IDs don't change, so policies that reference them keep working
  • Available for organization instances in all Regions, at no additional cost
  • After the change, sign in through the dual-stack access portal URL

This one is for infrastructure folks planning a move from Active Directory to Okta or Entra ID!

Related posts