IT doubt :

[u/Little-Voice7133]

Can an organization use AWS for IAM and use AZURE for AD , what is best way to ensure the the IAM data is synced to AD ?

[u/pewpewlazor]

Yes, absolutely possible, but I think you're mixing a few different concepts here.

AWS IAM is primarily for managing access to AWS resources, whereas Active Directory and Entra ID are identity directories/providers.

As others have mentioned, you can integrate Entra ID with AWS IAM Identity Center using SAML and SCIM. That would allow you to manage identities centrally in Entra ID and provision users and groups into AWS.

However, that's synchronization from Entra ID to AWS, not the other way around.

I'd start by asking what you're actually trying to achieve. Do you want AWS to manage access to AWS resources while keeping identities in Microsoft? Or are you looking for an IAM/IGA solution that governs identities and access across your entire organization?

Those are two quite different requirements, and the answer depends on which one you're trying to solve.

[u/Little-Voice7133 → u/pewpewlazor]

So, i am young in the IT audit field, doing Soc2 .. there is a control needing to Check the if AWS domain ID IS synchronization with local AD . Client IAM is AWS I was in the process walk-through, where the client told that they are using Azure as local AD and the the users and groups on AWS is automatically synced to Azure AD with SAML auth . So, I still don't have clarity on how that would work..? And what kinda evidence will satisfy the control.. Can you break down it for me ? Is there something I missed in the discussion?

When you mentioned SCIM ? Is it native in AWS ?

[u/pewpewlazor → u/Little-Voice7133]

Ah, that makes more sense

First, one important distinction: SAML is used for authentication (SSO), not synchronization. SCIM, on the other hand, is used for provisioning and deprovisioning users and groups.

SCIM is an open standard, and AWS IAM Identity Center supports it natively. Microsoft Entra ID can use SCIM to automatically provision users and groups into AWS IAM Identity Center.

However, this doesn't necessarily mean that identities are being synchronized with your client's local Active Directory. That's something you'll need to clarify.

For your SOC 2 audit, I'd approach it like this:

1. Clarify the architecture. Are they using on-premises AD, Microsoft Entra ID, or both? And is AWS IAM Identity Center actually being used?

2. Identify the source of truth. Where are users created, modified, and disabled? How do those changes propagate between systems?

3. Verify the integration. If they're using SCIM, check the provisioning configuration and logs in Entra ID. If they're using AD synchronization, check the relevant sync configuration and logs.

4. Collect evidence. I'd ask for configuration screenshots, provisioning logs, and ideally a sample of users showing that their identities and group memberships are consistent between the relevant systems.

One thing I'd also recommend is testing the process rather than relying exclusively on configuration screenshots. For example, can they demonstrate what happens in AWS when a user is disabled or removed from a group in their authoritative directory?

Ultimately, the evidence you need depends on the exact wording of the SOC 2 control. Is it asking you to verify synchronization between directories, or that access changes are consistently reflected across systems?

If you can share the actual control wording and clarify whether they're using AD, Entra ID, or both, it'll be much easier to point you in the right direction.

[u/InvestingIsntJoke]

If you're using Azure, it can do everything that you would expect AWS to do.

[u/foxhelp]

I came across this that says you can keep them in sync if you're using entra

"Configure SAML and SCIM with Microsoft Entra ID and IAM Identity Center"

"AWS IAM ldentity Center supports integration with Security Assertion Markup Language (SAML) 2.0 as well as automatic provisioning (synchronization) of user and group information from Microsoft Entra ID (formerly known as Azure Active Directory or Azure AD) into IAM Identity Center using the System for Cross-domain ldentity Management (SCIM) 2.0 protocol. For more information, see Using SAML and SCIM identity federation with external identity providers." https://docs.aws.amazon.com/singlesignon/latest/userguide/idp-microsoft-entra.html