SSO: AWS + Entra ID
- 7 hours ago
- 1 min read
Most people can't explain what actually happens between "click login" and "you're in the AWS console" when SSO is involved.
Broke down the full AWS + Entra ID federation flow, step by step 👇
→ Entra handles authentication (password, MFA, conditional access)
 → AWS never sees a password — only a signed SAML assertion
 → Group claims in that assertion decide which AWS role you land in
 → STS trades the assertion for short-lived credentials — nothing long-lived, nothing stored
Swipe through for the full breakdown, including where this setup actually breaks in practice (clock skew, audience mismatch, missing group claims — the stuff that shows up as a vague "Access Denied" with no useful error).