SSO For Extra Accounts Added under Root

Question

This may or may not be simple. I have been reading several articles on how to implement SSO for an account; however, I have not seen one which explains how to do this for multiple accounts without using the new AWS Identity Manager (I will use this in the future, but I am not sure of the implications of using this without causing some access issues to our users). I inherited this environment not to long ago.
Scenario:
 I was tasked with adding two brand new AWS account to our root account, We currently have SSO setup for the root accoun in Azure. When I navigate to the AWS Access portal (SSO), I thought that the new account would show up there, but it does not. When I try to create another shortcut for the account, it does not show in the drop down. Do I have to create another Azure app and configure SSO in order for it to work properly with the new account? I thought that the sub account acquired SSO permissions from the root account. See images:
![Accessportal](/media/postImages/original/IM3L3kYFHvQYGpUMPbjjPyYA)
![Shortcut-Creation](/media/postImages/original/IMdLfAj9TSSoyxdG5oN-gNEA)

Riku_Kobayashi · Accepted Answer

Hello.

Since sign-in via SSO has already been successful, integration with Azure AD should be possible.  
The answer from AWS re:Post Agent is useful for troubleshooting if integration with Azure AD is not possible, but I don't think it's useful in your case.  
Have you linked your AWS account to your user by following the steps in the document below?  
If you do not do this, your AWS account will not be displayed on the SSO dashboard.  
https://docs.aws.amazon.com/singlesignon/latest/userguide/get-started-assign-account-access-user.html

re:Post Agent · Answer

Based on the scenario you've described, it appears that you're using Azure AD for Single Sign-On (SSO) with your AWS root account, but the newly added AWS accounts are not automatically appearing in your AWS Access portal. This is because simply adding new accounts to your AWS Organization does not automatically extend the SSO configuration to those accounts.

To enable SSO access for the new accounts, you'll need to take a few additional steps:

1. You don't need to create a new Azure app for each AWS account. Instead, you should update your existing Azure AD enterprise application for AWS.

2. In your Azure AD configuration for AWS SSO, you'll need to add the new AWS account IDs to the list of accounts that can be accessed via SSO. This is typically done by updating the SAML claims or attributes sent by Azure AD to AWS.

3. On the AWS side, you'll need to configure the trust relationship between the new AWS accounts and the Identity Provider (IdP), which in this case is Azure AD. This usually involves updating IAM roles in the new accounts to trust the Azure AD IdP.

4. After updating the Azure AD configuration and AWS IAM roles, you should be able to see the new accounts in your AWS Access portal and add shortcuts for them.

5. Finally, ensure that you've assigned the appropriate users or groups in Azure AD the permission to access these new AWS accounts.

Remember, the SSO configuration is not automatically inherited by sub-accounts from the root account. Each account needs to be explicitly included in the SSO setup, although this can be managed centrally through your existing Azure AD application for AWS.

For future reference, using AWS IAM Identity Center (formerly AWS SSO) could simplify this process significantly, as it's designed to manage access across multiple AWS accounts more seamlessly. However, transitioning to it would require careful planning to avoid disrupting your current users' access.  
**Sources**  
[How as a root or IAM user do I access multiple organizations under my AWS hierarchy with one single user login | AWS re:Post](https://repost.aws/questions/QUIHv5UHcIRW-kVQTpWce_mQ/how-as-a-root-or-iam-user-do-i-access-multiple-organizations-under-my-aws-hierarchy-with-one-single-user-login)  
[Create an SSO and Identity Store using Cloudformation | AWS re:Post](https://repost.aws/questions/QU60GfqVnPR5SnHOa4_Gp8cQ/create-an-sso-and-identity-store-using-cloudformation)  
[Implementing Federated SSO with IAM Identity Center and Google Workspace for Linked Accounts | AWS re:Post](https://repost.aws/questions/QU-b4nIZPLT0GvsJWD2aHSRQ/implementing-federated-sso-with-iam-identity-center-and-google-workspace-for-linked-accounts)

SSO For Extra Accounts Added under Root

Relevant content