A healthcare company has 800 corporate staff using Microsoft Entra ID and a patient mobile app with 200,000 users needing social login and MFA. Workforce SSO and customer identities must stay separate with centralized workforce access. Which identity design should the architect choose for human authentication?
Select an answer to reveal the explanation.
Short Explanation
You've got two very different crowds needing different doors. Separation keeps your workforce keys and customer logins cleanly divided while each scales properly.
Full Explanation
The correct design matches service to population: IAM Identity Center federated with Entra ID centralizes the 800 staff with SSO, automated provisioning and permission sets across AWS, while Cognito user pools scales to 200,000 patient users with social federation, MFA and mobile app clients, preserving the required workforce-customer separation. The dual Cognito pools approach fails workforce centralization because Cognito handles app authentication well but does not provide centralized multi-account access management, permission assignments and workforce governance that Identity Center provides. The identity-pools-only approach fails customer authentication because identity pools vend temporary AWS credentials for authorization and must consume an authenticated token, so without user pools there is no native directory to enforce social sign-in and MFA. The same-tenant Entra approach fails separation because storing patients alongside staff mixes security boundaries, lifecycle and healthcare compliance controls and violates the explicit stay-separate mandate. Exam caveat: distinguish user pools for sign-in versus identity pools for AWS authorization and Identity Center for workforce versus Cognito for customers before evaluating federation details. Practical check: verify Identity Center trusted IdP and permission sets for staff, then verify the patient app client points to a user pool with social IdPs and MFA enabled.