AWS IAM Identity Center Preserves Assignments in Migrations Away From Active Directory
Summary
AWS’s updated IAM Identity Center migration guide describes preserving users, groups, memberships and assignments when moving away from Active Directory, and provides an Okta migration runbook with validation and rollback steps.
Key points
- Migrations from Active Directory to an external identity provider or the Identity Center directory preserve users, groups, memberships and assignments; user and group IDs remain the same.
- Switching to Active Directory deletes users, groups and assignments, which must be recreated or re-provisioned.
- The identity-source change applies to the entire instance, and users may be unable to sign in until the new SAML flow works; AWS recommends testing, a dress rehearsal and emergency access independent of Identity Center.
- The runbook advises matching existing usernames and SAML NameID values, checking required user attributes and group mappings, and testing a pilot user before enabling SCIM provisioning.
- The migration tool can export principals and assignments to CSV and compare live assignments against that baseline to identify drift.
- Rollback is manual: switching back to Active Directory deletes users, groups and assignments, which must then be restored from backups.
Article Details
- Topic
- Identity-source migration in AWS IAM Identity Center, including an Active Directory-to-Okta runbook and guidance for preserving users, groups, and assignments.
Vendors
Amazon Web ServicesAWS IAM Identity Center manages user access to Amazon Web Services (AWS) resources, including both AWS accounts and applications.MicrosoftActive Directory – Integration with an on-premises Microsoft Active Directory or AWS Managed Microsoft AD through AWS Directory Service for Microsoft Active Directory.OktaIt includes architectural guidance and a step-by-step runbook for switching from Active Directory to Okta.
Products
AWS IAM Identity CenterAWS IAM Identity Center manages user access to Amazon Web Services (AWS) resources, including both AWS accounts and applications.Microsoft Active DirectoryOctober 20, 2026: This post was republished to reflect the new migration capability from Active Directory to an external identity provider (IdP) or the Identity Center directory, now available in IAM Identity Center.