Skip to main content
Important: IAM Identity Center is managed in the US East (N. Virginia) region — us-east-1. If your AWS Console is set to another region (for example, Ohio), the console will prompt you to switch to us-east-1 before you can manage Identity Center. Make sure your region is set to us-east-1 before continuing.
IAM Identity Center (formerly AWS Single Sign-On) is a centralized workforce identity service. You use it to manage users and permission sets in one place, and Identity Center provisions IAM roles into target AWS accounts based on those permission sets. This allows centralized access control across multiple AWS accounts without creating IAM users in each account. Recommended reading:

​
Quick overview: Typical workflow

  1. Create a user in IAM Identity Center.
  2. Create a permission set (predefined or custom).
  3. Assign the user (or group) to an AWS Account with the permission set.
  4. Identity Center provisions an IAM role in the target account that maps to the permission set.
  5. The user signs in to the AWS Access Portal, configures MFA, and assumes the assigned role to access the account.

​
Getting started — create a user

  1. Open the IAM Identity Center console in us-east-1, choose Users, and click Add user.
  2. Provide the username, email address (Identity Center sends an invitation to this email), and first/last name for display.
  3. Choose how the user will receive credentials (typically an email with setup instructions). Optionally assign the user to groups at this time; groups are useful for bulk assignments but are not required.
A screenshot of the AWS IAM Identity Center "Users" page showing a single listed user and controls to search, add, or delete users. The left menu and account/region header are also visible.
When you finish, the user receives an invitation email with a link to set up their password and access the AWS Access Portal.
A screenshot of the AWS IAM Identity Center "Add user" form with email, confirm-email and name fields filled in. The browser toolbar and AWS organization header are visible along the top.

​
Create a permission set

A permission set defines the AWS permissions Identity Center grants when a user assumes the role in the target account. Each permission set maps to an IAM role that Identity Center creates in the account.
  1. In IAM Identity Center, under Multi-account permissions, choose Permission sets and click Create permission set.
  2. Select a predefined AWS managed policy or build a custom permission set. For this demo, choose the predefined ReadOnlyAccess permission set (grants read-only access to AWS services and resources).
  3. Enter a permission set name and an optional description, review the configuration, and create it.
A screenshot of the AWS IAM Identity Center console on the "Create permission set" page, showing the "Specify permission set details" form with the permission set name set to "ReadOnlyAccess" and the step progress on the left.

​
Assign the user to an AWS account

  1. In the left menu, choose AWS accounts.
  2. Select the target account checkbox (for example, an account under Root or your organization).
  3. Click Assign users or groups, choose the user(s) you created, and select the permission set (for example, ReadOnlyAccess).
  4. Review and submit the assignment.
Identity Center then provisions the corresponding IAM role in the selected account and maps the permission set to that role. The console will list assigned users and their permission sets.
A screenshot of the AWS IAM Identity Center (AWS Organizations) console showing the "Assigned users and groups" page with listed accounts like DevUser and AWSControlTowerAdmins and their permission sets (e.g., ReadOnlyAccess, AWSAdministratorAccess).
The account overview displays details for the selected account, including the account ID, contact email, and which permission sets are assigned to users and groups.
A screenshot of the AWS IAM Identity Center page for the "CloudWithDjango-Org" account. It shows the account overview with account ID and contact email, plus tabs for users/groups and permission sets.

​
User onboarding — accept invite, set password, and enable MFA

  1. The invited user opens the email invite and clicks the link to join IAM Identity Center.
  2. On the AWS Access Portal sign-up page they set and confirm a new password.
A screenshot of the AWS "New user sign up" page with fields to enter and confirm a new password for the username "DevUser." The form includes a "Show password" checkbox and an orange "Set new password" button.
  1. After setting the password, the user is usually prompted to configure multi-factor authentication (MFA).
    • If the portal shows a different username (for example, a cached session), choose Not you and sign in with the newly created credentials.
    • Choose Authenticator app, scan the QR code with an authenticator app on the mobile device, and enter the six-digit code to register MFA.
A screenshot of an AWS sign-in page titled "Set up the authenticator app" for the username "DevUser." It shows step-by-step MFA setup instructions: install an authenticator app, scan a QR code, and enter the six‑digit authenticator code.
Once MFA is registered, the user is taken to the AWS Access Portal. The portal lists accounts and assigned applications. The user clicks into an account and chooses a role backed by the assigned permission set to sign into that account’s console.
A screenshot of the AWS Access Portal showing the "Accounts" tab with one listed account named "CloudWithDjango-Org," its account ID, and an email contact. The page includes a search/filter bar and a "Create shortcut" button.

​
Reference summary

​
Key takeaways & exam tip

  • IAM Identity Center centralizes workforce access across AWS accounts and provisions IAM roles in target accounts automatically.
  • Workflow: create User → create Permission set → assign User (or Group) to AWS Account → Identity Center creates IAM role in account.
  • Use permission sets to maintain least-privilege access and avoid creating IAM users in every account.
Exam tip: Remember the three main entities in IAM Identity Center — User, Permission Set, and AWS Account — and that Identity Center provisions the IAM role in the account to enforce the permission set. Keep us-east-1 in mind as the management region.

Watch Video

Practice Lab