A county workforce must sign in to many AWS accounts using Microsoft Entra ID without creating long-lived IAM users in each account. Which approach best meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Nobody wants a separate badge printer in every county building. IAM Identity Center plus Entra ID gives one workforce login and permission sets into many accounts. Cloning IAM users everywhere is the password-sprawl special.
Full Explanation
AWS IAM Identity Center (successor to AWS SSO) integrates with external IdPs such as Microsoft Entra ID so workforce identities authenticate centrally and receive short-term credentials via permission sets mapped into Organization accounts. That avoids per-account IAM users and long-lived access keys. Root sharing and per-account local users contradict least privilege and multi-account workforce identity best practices for SAP-C02-scale organizations.