AWS SSO Integration with On-Premises Active Directory
A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?
Quick Answer
The correct integration method is to set up an AWS Managed Microsoft AD directory and sync with the on-premises Active Directory using AD Connector. This works because AWS SSO cannot directly connect to an on-premises identity source; it requires an AWS Directory Service domain as an intermediary. AD Connector acts as a proxy, forwarding authentication requests from AWS SSO to your on-premises Active Directory without storing any credentials in the cloud, enabling seamless single sign-on across multiple AWS accounts. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of hybrid identity architectures and the distinction between direct federation and directory-based integration. A common trap is assuming AWS SSO can natively integrate with on-premises AD via SAML 2.0, but that requires a separate identity provider like ADFS. Remember the memory tip: “AD Connector is the bridge, not the destination”—your on-premises AD stays the source of truth, while AWS Managed AD provides the required cloud-side endpoint.
⚠ Common exam trap
The trap is that many candidates think they need to set up AWS Managed Microsoft AD or AD Connector, but the simplest integration is to use SAML 2.0 federation with an existing on-premises AD.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SAML 2.0 federation between AWS SSO and the on-premises AD.
AWS IAM Identity Center (formerly AWS SSO) can integrate with an on-premises Active Directory using SAML 2.0 federation. This involves configuring a SAML 2.0 identity provider (such as Active Directory Federation Services) to federate with IAM Identity Center. Option C is incorrect because it describes combining AWS Managed Microsoft AD and AD Connector, which is not a valid integration method. The correct approaches are either using AD Connector alone or AWS Managed Microsoft AD with a trust, not both together. Other options are not viable direct integration methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use SAML 2.0 federation between AWS SSO and the on-premises AD.
Why this is correct
Correct. AWS IAM Identity Center supports SAML 2.0 federation with an external identity provider, such as ADFS, which can use the on-prem Active Directory as the identity source.
- ✗
Use AWS IAM Identity Center with an external identity provider that supports SCIM.
Why it's wrong here
Incorrect. While IAM Identity Center can integrate with an external IdP via SCIM, this requires an IdP that supports SCIM synchronization, which is not directly the on-prem AD. This adds complexity and is not the primary integration method.
- ✗
Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.
Why it's wrong here
Incorrect. Combining AWS Managed Microsoft AD and AD Connector is not a standard integration. The correct methods are either AD Connector alone or AWS Managed Microsoft AD with a trust, not both together.
- ✗
Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.
Why it's wrong here
Incorrect. AWS SSO cannot directly connect to on-prem AD via LDAP; it requires a directory service (AD Connector or AWS Managed Microsoft AD) or an external IdP via SAML.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts and business applications. The company uses Microsoft Active Directory on-premises. Which AWS service should be used to integrate with the existing directory?
easy- A.Amazon Cognito user pools
- B.AWS Organizations
- C.AWS Identity and Access Management (IAM)
- ✓ D.AWS IAM Identity Center (AWS SSO) with an AWS Managed Microsoft AD directory
Why D: AWS IAM Identity Center (formerly AWS SSO) can be integrated with an AWS Managed Microsoft AD directory to provide a single sign-on experience across multiple AWS accounts and business applications. This integration allows users to authenticate using their existing on-premises Active Directory credentials via AD Connector or a two-way forest trust, enabling seamless access to the AWS Management Console, command-line interface, and supported SAML 2.0 applications.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.