- [Syed] Hi, my name is Syed Ahmad,
a senior solutions architect at AWS.
In this video,
I'll show you how to configure Active Directory
users and groups sync in AWS single sign-on.
As a new customer using AWS single sign-on,
You have the option to select
a SCIM supported external identity provider,
an on premises Active Directory,
or Managed AD as your identity source.
You can also use AWS SSO's identity store
as your identity source.
If you choose to use on-premises Active Directory
or Managed AD, you'll be able
to use configurable synchronization for AD,
which is a synchronization mechanism that AWS SSO provides
to AD customers for provisioning identities
from AD into AWS SSO.
These identities can then be used
for assigning access to AWS accounts or applications.
With configurable synchronization for AD,
you can synchronize users and groups consistent
with your data sovereignty requirements.
You can add or remove users and groups
to change the scope of the sync at any time.
Assign and synchronize users and groups
with access to AWS accounts.
And control the synchronization process
by pausing and resuming the sync as needed.
In this demo, I'll show you how to provision
and manage AD identities in AWS SSO.
Here we are in the AWS single sign-on dashboard.
To begin this demo,
I need to change my identity source
from AWS SSO to Active Directory.
Note that I will be leveraging
an AWS Managed Microsoft AD as my directory.
However, the steps you'll see apply
to both the self-managed AD as well as the Managed AD.
So to make the change,
I'll click on settings on the left
and then click on the actions button,
and then change identity source on the right here.
I'll click on Active Directory as my identity source
and click next.
I'll choose my Active Directory from the dropdown list here
under existing directories and click next.
And here I can review my changes,
and I want to confirm them,
so I'll scroll down here and type accept,
and then I'll click on change identity source.
This change may take a moment.
Now that I've selected Active Directory
as my identity source,
AWS SSO will allow me to configure AD Sync.
I can do so by clicking on
the start guided setup near the top.
This will allow me to configure
which AD users and groups that I wanna sync into AWS SSO.
First, I'll be directed
to a review attributes mapping page for AWS SSO.
That is which AD attribute values will be mapped
to which corresponding AWS SSO attributes.
You can view the mappings for both users and groups.
You can also edit or update mutable attribute mappings
to the AD attribute of your choice.
For this demo, I'm gonna leave the defaults,
and I'm gonna click next.
After reviewing the attribute mappings,
I'll be directed to a setup page that will allow me
to set up my sync scope or the subset of AD users and groups
that I want to sync into AWS SSO.
I can perform an exact match
as part of my lookup for users and groups
and add them to the sync scope.
Once added they will automatically be synchronized
on a regular basis from Active Directory to AWS SSO.
I can also remove users and groups from the sync scope.
So for example,
if I wanna add a user name Sahmad into this group,
I can type in the username and then add them right here.
I can also do the same for groups.
So I can click on groups and type in the group name,
and it has to be an exact match.
So here I'll be looking
for an all AWS SSO user groups group and click add.
So now both the Sahmad user
and the all AWS SSO users group will be synced
over into AWS SSO.
We recommend that you set up a parent group
in Active Directory like this group here,
all AWS SSO users group,
and set your AWS SSO sync scope to this parent group.
This helps optimize the sync process
and streamline managing the sync scope
in the Active Directory side
with minimal need to make updates in AWS SSO.
I'll click on next.
The final step is to review the configurations
for attribute mappings in the sync scope
and start the automated synchronization process.
Once I confirm and start the sync,
the Active Directory identities will be updated
in AWS SSO every few hours.
You can also access the manage sync option
in the setting page to edit the sync scope
or attribute mappings at any time.
You can also pause and resume sync from this page
whenever this is necessary.
So I'll scroll down and click on save configuration.
After saving the configuration, we can see that our user,
the Sahmad user, has now been configured for sync
as well as the all AWS SSO users group is synced as well.
And there are other users within this group as well.
So any users or any nested groups that reside
within this group will all be synced
over through this AD sync configuration.
I can click on resume sync
and this should resume any sync activities
that were taking place.
And if I wanna pause them,
I can simply click on pause anytime I need to.
I can also view all
of my attribute mappings by clicking here,
and I can see the previously defined attributes
for both users and groups and modify them as needed.
Thank you for your time.