How to Set Up Single Sign-On for Multiple AWS Accounts Using AWS IAM Identity Center
A company manages 20 AWS accounts and wants employees to log in once with their corporate Active Directory credentials and then access any of their authorised AWS accounts without re-entering credentials for each account. Which AWS service provides this centralised single sign-on capability?
Quick Answer
The answer is AWS IAM Identity Center. This service is the correct choice because it provides centralized single sign-on for multiple AWS accounts with Active Directory, allowing employees to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering passwords. It achieves this by integrating with an external identity provider like Active Directory through SAML 2.0 or SCIM, enabling seamless federation across all linked accounts. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of centralized access management versus individual IAM users or roles—a common trap is confusing IAM Identity Center with IAM itself, but remember that IAM handles per-account users, while Identity Center manages cross-account SSO. A helpful memory tip: think of Identity Center as the “one-stop login hub” that connects your corporate directory to many AWS accounts, so you only sign in once.
⚠ Common exam trap
Watch out — candidates often confuse AWS Directory Service (which provides the directory itself) with the SSO service that uses that directory for cross-account access, leading them to pick Option A instead of the correct IAM Identity Center.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Identity Center
AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides centralized single sign-on (SSO) across multiple AWS accounts and business applications. It integrates with an external identity provider (IdP) such as Active Directory via SAML 2.0 or SCIM, allowing users to authenticate once with their corporate credentials and then access any authorized AWS account without re-entering credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Directory Service
Why it's wrong here
AWS Directory Service provides managed Active Directory in AWS. While it supports IAM Identity Center as an identity source, it is not itself the single sign-on portal service.
- ✗
Amazon Cognito
Why it's wrong here
Cognito manages user authentication for customer-facing applications. It is not designed for internal employee access to multiple AWS accounts.
- ✓
AWS IAM Identity Center
Why this is correct
IAM Identity Center provides a single sign-on portal where employees authenticate once with corporate credentials and then access any of their authorised AWS accounts. It integrates with Active Directory and other SAML 2.0 identity providers.
- ✗
AWS Control Tower
Why it's wrong here
AWS Control Tower provides governance for a multi-account AWS environment with guardrails and landing zones. While it works with IAM Identity Center, it is not itself the SSO portal service.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company manages multiple AWS accounts using AWS Organizations. The company has an on-premises Microsoft Active Directory (AD) that contains employee credentials and group memberships. The company wants to grant employees access to the AWS Management Console and command-line interface (CLI) using their existing AD credentials, without creating IAM users for each employee. Additionally, the company wants to centrally manage permissions across all accounts by assigning policies to AD groups. Which AWS service should the company use to meet these requirements?
medium- A.AWS Identity and Access Management (IAM)
- B.AWS Directory Service for Microsoft Active Directory
- ✓ C.AWS IAM Identity Center (AWS Single Sign-On)
- D.AWS Resource Access Manager (AWS RAM)
Why C: AWS IAM Identity Center (formerly AWS Single Sign-On) is the correct service because it allows centralized management of user access to multiple AWS accounts and applications using existing corporate credentials from Microsoft Active Directory. It supports federation with AD via SAML 2.0 or SCIM, enabling employees to sign in to the AWS Management Console and CLI without creating IAM users. Permissions can be assigned to AD groups through permission sets, which map to IAM roles, ensuring consistent policy enforcement across all accounts in AWS Organizations.
Variation 2. A company manages multiple AWS accounts using AWS Organizations. The company wants employees to sign in using their existing corporate credentials from an on-premises Microsoft Active Directory. The company also needs a single sign-on (SSO) experience so that each employee can access the AWS Management Console for any authorized account without needing separate passwords. Additionally, the company wants to centrally manage permissions across all accounts. Which AWS service should the company use to meet these requirements?
medium- A.AWS Identity and Access Management (IAM)
- ✓ B.AWS IAM Identity Center (AWS SSO)
- C.AWS Directory Service
- D.Amazon Cognito
Why B: AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage single sign-on (SSO) access to multiple AWS accounts and applications. It integrates with an on-premises Microsoft Active Directory via the AWS Directory Service or an external identity provider, allowing employees to use their existing corporate credentials. IAM Identity Center also enables you to centrally define and manage permissions across all accounts in AWS Organizations, meeting all stated requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.