Article · Part 2

Azure AD Config for AWS SSO

By Kabir Vaderaa · Published 22nd August 2020 · Updated 20th January 2022 · 7 min read · Azure AD AWS SSO SAML SCIM Identity

Azure Config

Log in to your Azure portal, go to Active Directory → Enterprise Applications → New Application. Select Non-Gallery Application.

Non-Gallery Application selection

Click Single Sign-on → SAML, then Upload Metadata File (the file from Part 1). Download the Azure Metadata XML and upload it back in AWS.

Upload metadata file
AWS SSO metadata upload confirmation

Provisioning (SCIM)

In AWS SSO, click Enable Automatic Provisioning. Copy the SCIM URL and Token generated.

SCIM URL and Token

In Azure AD, go to Provisioning → Automatic. Enter the SCIM URL and Token, then click Test Connection.

Azure provisioning configuration
Attribute mapping changes required:
  1. All users must have First name, Last name, and Display name filled in.
  2. Delete mappings for facsimileTelephoneNumber and mobile.
  3. Change mailNickname source attribute from mailNickname to objectId.

Turn on Provisioning Status and save. Azure AD syncs every 40 minutes.

Users replicated in AWS SSO
AWS accounts and permissions list
← Previous
Part 1. AWS-SSO Integrated with Azure AD
Next →
I-SEM Project