Can I keep existing IAM users and add SSO to our accounts

Question

Hi,  
  
We currently have several accounts all using IAM - users, roles policies. We would like to improve how we manage our users by using SSO with our active directory account so that we have a centralised location for our users.  
  
We also have users that are for external service providers (people) and applications that are not in our active directory.  
  
Are we able to use the SSO for our users and then manage our other users in IAM or is having both SSO users and IAM users incompatible?  
  
What happens to our existing IAM users if we active the SSO?  
  
Kind Regards  
David

Answer

SSO and IAM users can coexist. Nothing happens to your existing IAM users, groups, roles or policies when you provision SSO into your accounts.  
  
SSO appears as a new identity provider in your IAM config and manages its own roles (permission sets) alongside your normal IAM roles. Users coming in via SSO roles can also assume other IAM roles (with the right permissions), though watch out for condition strings in policies as things like MFA constraints don't work for SSO users.  
  
Overall AWS SSO is a benefit, but be prepared for a small learning curve and extra work on the governance side as AWS SSO is less mature than IAM and seems to be taking a while to catch up.

Can I keep existing IAM users and add SSO to our accounts

Relevant content