Readers asked: “Can you set up SSO with an external app in your homelab?” Yes. And by the end of this guide, you will have done exactly that.
In Post 2, you built a hybrid identity environment — Active Directory synced to Entra ID via Entra Connect, with Conditional Access and MFA enforced. That was the foundation.
This post adds the feature that enterprise IAM teams configure most often: Single Sign-On (SSO). You will configure SAML-based SSO between your Entra ID tenant and AWS IAM Identity Center, assign your homelab users, and test federated authentication — the exact workflow I have configured hundreds of times for Fortune 500 clients.
Why AWS? Because it is free (AWS free tier), it is the second most common cloud platform after Azure, and configuring cross-cloud SSO between Microsoft and AWS is one of the most sought-after skills in enterprise IAM. This single lab project tells interviewers: “I understand federated identity across cloud providers.”
You need the working homelab from Post 2 — Active Directory, Entra Connect, and Entra ID with synced users. If you have not built it yet, start there first. You also need a free AWS account (aws.amazon.com/free).
SAML vs OIDC — What You Need to Know
Before configuring anything, understand the two protocols that power SSO in enterprise environments.
SAML 2.0 (Security Assertion Markup Language) is the older, more established protocol. It uses XML-based assertions to exchange authentication data between an Identity Provider (IdP — your Entra ID) and a Service Provider (SP — the application). SAML is the standard for enterprise SSO. If you configure SSO at work, it will almost certainly be SAML.
OpenID Connect (OIDC) is the newer protocol built on top of OAuth 2.0. It uses JSON Web Tokens (JWTs) instead of XML. It is lighter, more developer-friendly, and common in modern SaaS applications and custom-built apps.
In this guide, we use SAML — because AWS IAM Identity Center uses SAML for external IdP federation, and because SAML is what interviewers ask about most frequently. Understanding SAML deeply is a core IAM skill.
on AWS console
SAML AuthnRequest
MFA if required
User is signed in
Set Up AWS IAM Identity Center
| Step | Action |
|---|---|
| 1 | Create a free AWS account at aws.amazon.com/free. You need a credit card for verification (same as Azure — no charges for what we are doing). |
| 2 | Enable IAM Identity Center — In the AWS Console, search for IAM Identity Center and click Enable. Choose your home region (e.g., us-east-1). |
| 3 | Change the identity source — Navigate to: Settings → Identity source → Actions → Change identity source → Select “External identity provider”. |
| 4 | Download the AWS metadata — On the same page, download the SAML metadata file. Also note the Sign-in URL and ACS URL — you will need both. |
Do not close the AWS console yet. You will need the ACS URL and Issuer URL from this page when configuring the Entra ID side. Keep both browser tabs open — AWS and Entra — side by side.
Register the Enterprise App in Entra ID
| Step | Action |
|---|---|
| 1 | Open Entra Portal — Go to entra.microsoft.com → Applications → Enterprise applications |
| 2 | Add new application — Click “New application” |
| 3 | Search the gallery for AWS IAM Identity Center — Microsoft has a pre-built integration. Click it → Create. |
| 4 | Name it: AWS IAM Identity Center — Homelab |
You now have an Enterprise Application registered in your Entra ID tenant. This is the “bridge” between your identity provider and AWS.
Configure SAML-Based SSO
| Step | Action |
|---|---|
| 1 | In your new Enterprise App, go to Single sign-on → Select SAML |
| 2 | Edit Basic SAML Configuration — enter the values from the code block below |
Edit Attributes & Claims — Ensure these claims are mapped:
Download the Federation Metadata XML from Section 3 (“SAML Certificates”) — you will upload this to AWS.
You are telling Entra ID: “When AWS sends a user to authenticate, here is who they are and how to respond.” The SAML assertion contains the user’s identity claims — name, email, groups — signed by Entra ID’s certificate. AWS trusts this signature because you are about to upload Entra’s metadata to AWS.
Complete the AWS Side
| Step | Action |
|---|---|
| 1 | Go back to your AWS IAM Identity Center tab |
| 2 | Upload the IdP SAML metadata — In the “External identity provider” configuration, upload the Federation Metadata XML you downloaded from Entra ID |
| 3 | Confirm the change — AWS will warn you that changing the identity source will affect all existing users. Type ACCEPT to confirm. |
The trust relationship is now established. Entra ID is the Identity Provider. AWS is the Service Provider. SAML is the protocol connecting them.
Assign Users and Groups
In Entra ID
| Step | Action |
|---|---|
| 1 | Go to your Enterprise App → Users and groups → Add user/group |
| 2 | Assign your homelab security group SG-Cloud-Admins (Priya Sharma, David Lee from Post 2) |
| 3 | Optionally assign individual users like Raj Patel (your IAM Architect test user) |
In AWS IAM Identity Center
| Step | Action |
|---|---|
| 1 | Create matching users — Go to Users → Add user → enter the same email/UPN as in Entra ID |
| 2 | Create a Permission Set — Go to Permission sets → Create → Select ReadOnlyAccess (safe for a lab) |
| 3 | Assign the permission set — Go to AWS accounts → Select your account → Assign users → Select the user → Assign ReadOnlyAccess |
Manually creating matching users in AWS is fine for a lab. In production, you would enable SCIM provisioning to automatically sync users from Entra ID to AWS. We will cover this in the next section.
Test Your SSO
| Step | Action |
|---|---|
| 1 | Go to myapps.microsoft.com and sign in as one of your assigned test users (e.g., psharma@iamlab.local) |
| 2 | You should see the “AWS IAM Identity Center” tile in the My Apps portal |
| 3 | Click the tile — you should be redirected to AWS and signed in automatically without entering AWS credentials |
| 4 | Verify: You are now in the AWS Console with ReadOnlyAccess, authenticated via your Entra ID identity |
That is Single Sign-On. The user clicked one tile. Entra ID authenticated them (with MFA if your Conditional Access policy from Post 2 is active). Entra ID issued a SAML assertion to AWS. AWS accepted it and granted access. One identity, two clouds.
Alternative Test Method
You can also test from the Entra Portal: Go to your Enterprise App → Single sign-on → Scroll to “Test single sign-on” → Click Test. This sends a test SAML assertion and shows you exactly what Entra ID sends to AWS — invaluable for debugging.
Enable SCIM Provisioning (Bonus)
SCIM (System for Cross-domain Identity Management) automates user provisioning. Instead of manually creating users in AWS, SCIM synchronises them from Entra ID automatically. This is how production environments work at scale.
In AWS IAM Identity Center
| Step | Action |
|---|---|
| 1 | Go to Settings → Automatic provisioning → Enable |
| 2 | AWS generates a SCIM endpoint URL and an Access token — copy both |
In Entra ID
| Step | Action |
|---|---|
| 1 | Go to your Enterprise App → Provisioning → Get started |
| 2 | Provisioning Mode: Automatic |
| 3 | Paste the Tenant URL (SCIM endpoint) and Secret Token (access token) from AWS |
| 4 | Click Test Connection — it should say “The supplied credentials are authorised to enable provisioning” |
| 5 | Click Save |
| 6 | Under Mappings, review the attribute mappings (defaults are usually correct for AWS) |
| 7 | Change Provisioning Status to On → Save |
Entra ID will now automatically provision users assigned to this Enterprise App into AWS IAM Identity Center. When you add someone to the SG-Cloud-Admins group in AD and they sync via Entra Connect, they automatically appear in AWS. When you remove them, they are deprovisioned. This is the Joiner-Mover-Leaver automation that enterprises depend on.
You now have a fully automated identity pipeline: create a user in Active Directory → Entra Connect syncs them to Entra ID → SCIM provisions them to AWS → they sign in via SAML SSO. One identity, managed from one place, federated across two cloud providers. This is enterprise-grade IAM.
Document for Your Portfolio
- Architecture diagram — update your diagram from Post 2 to include the SSO flow: AD → Entra Connect → Entra ID → SAML SSO → AWS
- SAML configuration screenshots — capture the Entra ID SAML setup page, the attribute mappings, and the AWS IdP configuration
- Test results — screenshot the successful SSO login, the My Apps portal tile, and the AWS console showing the federated user
- SCIM provisioning log — Entra ID → Provisioning → Provisioning logs — screenshot a successful sync event
- Write a brief summary explaining SAML vs OIDC, what claims were mapped, and how SCIM automates user lifecycle
Your SSO Lab Checklist
- Created free AWS account
- Enabled AWS IAM Identity Center
- Changed identity source to External IdP
- Downloaded AWS SAML metadata
- Registered Enterprise App in Entra ID (gallery)
- Configured SAML — Entity ID, ACS URL, Sign-on URL
- Mapped SAML attributes (UPN, email, name)
- Downloaded Entra Federation Metadata XML
- Uploaded Entra metadata to AWS
- Assigned users and groups in Entra ID
- Created permission set in AWS (ReadOnlyAccess)
- Tested SSO via My Apps portal
- Enabled SCIM provisioning
- Verified automatic user sync to AWS
- Updated architecture diagram
- Documented everything for portfolio
What to Build Next
- Add a second SSO app — Salesforce Developer Edition (free) or GitHub Enterprise — to show you can manage multiple SP integrations
- Configure OIDC-based SSO — register a custom app using OAuth 2.0/OIDC instead of SAML. This teaches you the newer protocol.
- Build an App Proxy — publish an on-premises web app through Entra Application Proxy with SSO
- Add group-based claims — configure group claims in SAML assertions so AWS can assign permissions based on AD group membership automatically
- Implement PIM for AWS access — require approval and time-limited elevation for AWS admin permissions via Entra PIM
Three posts in, your homelab now covers Active Directory, hybrid identity, Conditional Access, MFA, SSPR, SAML SSO, and SCIM provisioning. That is not a hobby project. That is a production-ready skill set.
Keep building. The market rewards builders.
— Masood
IAM Architect · 24+ years · identityfrontline.com