Employees using IAM Identity Center federated to AWS Managed Microsoft AD report intermittent Access Denied when assuming a permission set, while others succeed. Directory health checks pass. Which troubleshooting approach isolates the authentication failure for federated permission set assumptions?

The correct approach works because intermittent Access Denied for a federated permission set can stem from federation authentication, group mapping, or IAM authorization, and only joint correlation separates those layers; CloudTrail AssumeRole events give timestamp, principal, error and request context, Identity Center sign-in events in CloudTrail show whether federation succeeded and which directory identity was asserted, and AD group membership proves authorization at that exact moment, revealing stale sync, UPN mismatch, or conditional denial even when health checks pass since health only validates controller reachability. Inspecting permission set assignments and inline policies to confirm authorization scope is authorization review but fails because it checks what the role can do after assumption, not whether federation authenticated the user to assume it, so cannot explain intermittency among similarly assigned users. Reviewing domain controller logs and replication status to validate authentication attempts is AD validation but fails because passing health checks plus others succeeding already proves controller function, pointing to assertion mapping not availability. Examining CloudTrail AssumeRole events with request IDs without sign-in logs is failure tracing but fails because without sign-in context you cannot tell if the SAML assertion was never issued, rejected, or mis-mapped, leaving authentication versus policy denial ambiguous. For exams, distinguish federated authentication failure from IAM policy denial before changing permissions. As a practical check, compare timestamps for one failed and one successful assumption across all three sources and verify sign-in status aligns with group effective time.