QuickSight - Update auth method from Standard to Enterprise edition

Question

Customer is asking:

we setup using standard edition with local IAM authentication methods, but we want to switch it to use our AWS IDC. looks like this is only supported in Enterprise edition so our thought was we can upgrade our standard to enterprise and then switch the authentication over but we tested it in a QA account and didnt seem like we could change the auth method after sign up. do you know if there's a way to accomplish this? we dont want to disrupt and have to rebuild all the dashboards and stuff that was originally setup. the goal is to switch this over to IDC without having to re-setup their data sources and dashboard

Hugh Castle · Answer

Hello Anish,

Unfortunately, updating the authentication method after for your Quicksight account after creating it isn't possible based on the following sources:

> Configure QuickSight and IAM Identity Center so that you can sign up for a new QuickSight account with an IAM Identity Center configured identity source. With IAM Identity Center, you can configure your external identity provider as an identity source. You can also use IAM Identity Center as an identity store if you don't want to use a third-party identity provider with QuickSight. **Identity methods can't be changed after your account is created.**
- https://docs.aws.amazon.com/quicksight/latest/user/sec-identity-management-identity-center.html

This is a limitation of the QuickSight architecture. Additionally, you are correct in regards to AWS IDC (Identity Center) being available only in Enterprise Edition.

> IAM Identity Center is supported in QuickSight Enterprise Edition subscriptions.

- https://docs.aws.amazon.com/quicksight/latest/user/identity-management-options.html

Although it is possible to upgrade from Standard edition to Enterprise edition, the authentication method cannot be changed after the initial setup as described in this document.

> Upgrading to Enterprise edition to use Active Directory connectivity isn't supported. This is because of the differences in the user identity mechanisms between Amazon QuickSight password-based users and existing Active Directory users. However, you can upgrade to Enterprise and still use password-based users. If you want to upgrade and change how users sign in, you can unsubscribe and start a new subscription.
- https://docs.aws.amazon.com/quicksight/latest/user/upgrading-subscription.html

Due to this, the only method that is currently available is migrating the resources. My recommendation is as follows:

1. Create a new Quicksight Enterprise subscription in the same account.
2. Use the same Quicksight Migration APIs to migrate your assets. 
3. Deactivate the old subscription once the migration is complete.

While this requires more effort than a direct authentication method switch, it's currently the most reliable way to transition from IAM to IAM Identity Center while preserving your QuickSight assets. I hope this was helpful. Please let me know if you need any additional help.

QuickSight - Update auth method from Standard to Enterprise edition

Relevant content