A regional hospital group with 1,200 clinicians uses Microsoft Entra ID as its HR-backed identity source. Doctors need short-term AWS console and CLI access scoped to their department, with joiner and leaver updates applied automatically and no long-lived IAM users to manage. What identity design meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Ever wish onboarding handled itself when HR updates a record? You get that with provisioning that pushes identity changes into AWS automatically. SAML handles the login, SCIM handles the lifecycle, so no stale accounts linger.
Full Explanation
IAM Identity Center integrated with an external IdP using SAML 2.0 provides centralized workforce authentication where the IdP remains the source of truth for credentials and MFA while Identity Center manages permission sets mapped to department groups for least-privilege console and CLI access via short-term credentials. Adding SCIM closes the lifecycle gap by pushing create, update, and deactivate events from Entra ID to Identity Center, satisfying the joiner-mover-leaver requirement without manual provisioning or long-lived IAM users. Creating individual IAM users fails the operational overhead and security constraint because keys must be rotated and deprovisioned manually. A Cognito user pool is designed for customer-facing application authentication, not workforce federation to the AWS management plane, and CSV sync cannot provide timely automated deprovisioning. Using raw OpenID Connect with IAM roles alone can enable federation but lacks centralized assignment and automated provisioning, leaving lifecycle management unsolved. For the exam, remember Identity Center plus SAML plus SCIM is the workforce pattern, while Cognito is the app-user pattern, and always verify SCIM sync status and group mappings in Identity Center before testing permission sets.