A 4,000-employee manufacturer uses Microsoft Entra ID as its identity source and operates 60 AWS accounts in Organizations. HR requires new hires to gain AWS access automatically, leavers to be deprovisioned within hours, and users to sign in once with existing credentials. Which identity federation design using standard protocols meets these lifecycle needs?
Select an answer to reveal the explanation.
Short Explanation
You're tying HR truth to AWS access automatically, not by spreadsheet. SAML handles the sign-in while SCIM creates and removes users for you. Manual sync just can't keep up with joiners and leavers.
Full Explanation
The correct design is right because IAM Identity Center integrated with Entra ID as the external identity provider centralizes access for all 60 Organization accounts, using SAML 2.0 to authenticate users with existing Entra credentials for single sign-on and SCIM to synchronize identities automatically so HR-driven joins are provisioned before first login and leaves are revoked within hours without per-account user management. The on-premises Active Directory integration fails by concept of authoritative source because the scenario explicitly states Entra ID is the identity source, so even with automated sync it creates a parallel directory, splits lifecycle ownership and leaves Entra joins and leaves unsynchronized. The Entra federation relying on just-in-time creation at first sign-in fails by concept of lifecycle automation because JIT only creates the user during authentication and provides no pre-provisioning for new hires nor timely suspension for leavers who never sign in again, violating the within-hours deprovisioning requirement despite offering correct SSO. The direct Entra to IAM role federation in each account fails by concept of centralized management at scale because while SAML single sign-on works, there is no single provisioning plane and no automated propagation and revocation across 60 accounts, forcing repetitive trust and role-mapping maintenance and making consistent joiner-mover-leaver enforcement impractical. For exams, remember SAML handles authentication while SCIM handles provisioning synchronization, and JIT is not a substitute for SCIM when automatic provisioning and deprovisioning are required. Practically, validate the design by confirming successful SCIM cycles in Entra and testing a hire creation and a termination to verify appearance and removal in Identity Center within the required window.