Which AWS Service Provides a SAML 2.0 SSO Portal for Third-Party Apps?
Identify AWS access management capabilities.
Understand AWS Cloud security, governance, and compliance concepts.
Answer
Correct answer: C — AWS IAM Identity Center provides a central user portal that grants workforce users SSO access to SAML 2.0 third-party business applications.
A company needs a central user portal so that users can log in to third-party business applications that support Security Assertion Markup Language (SAML) 2.0. Which AWS service will meet this requirement?
Community Insight
The question tests the split between workforce identity (IAM Identity Center) and customer identity (Cognito); the trap is reading "third-party applications" as an automatic signal for Cognito.
AWS IAM Identity Center (formerly AWS Single Sign-On) is the workforce single sign-on service that gives users one portal for third-party business applications that speak SAML 2.0. This page confirms why it, and not Amazon Cognito, satisfies the CLF-C02 requirement.
Learners often pick Amazon Cognito because "third-party application" and "SAML 2.0" sound like federation, but Cognito is customer identity for your own apps — it is not a central employee portal with per-application assignments to business SaaS.
Community Discussion (58 comments)
xxjbloxx
👍 1
Selected: C
AWS IAM Identity Center is the correct choice:Central User Portal: AWS IAM Identity Center (formerly known as AWS Single Sign-On) provides a centralized portal where workforce users can log in once and gain single sign-on (SSO) access to multiple AWS accounts and external business applications.SAML 2.0 Integration: It natively supports SAML 2.0, allowing you to easily federate and connect to third-party Software-as-a-Service (SaaS) business applications like Salesforce, Microsoft 365, Box, or Slack.
Jess20
👍 1
Selected: C
Central user portal: C. AWS IAM Identity Center (AWS Single Sign-On) IAM is related to AWS accounts, not a central SSO portal for third-party applications.
Zii
👍 1
Selected: C
The requirement is for: A central user portal Users to log in once Access third-party business applications Applications support SAML 2.0 AWS IAM Identity Center is designed specifically for this. It provides: Single Sign-On (SSO) to AWS accounts and applications. A centralized user portal where users can access all assigned applications. Support for SAML 2.0 applications such as Salesforce, Microsoft 365, ServiceNow, Slack, and many others. Integration with external identity providers like Microsoft Active Directory, Okta, and Azure AD.
dragossky
👍 1
Selected: B
AWS Cognito is correct answer. 3rd party!
Malik88
👍 1
Selected: C
chatgpt
e5c1bb5
👍 2
Selected: C
https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-applications.html
deathhellknight01
👍 4
Selected: C
C. AWS IAM Identity Center (AWS Single Sign-On) Explanation: AWS IAM Identity Center (previously AWS Single Sign-On) is designed to provide a central authentication portal for users to access multiple third-party business applications that support SAML 2.0. It allows organizations to manage user identities and permissions centrally while enabling seamless single sign-on (SSO) to various applications. Why not the other options? A. AWS Identity and Access Management (IAM) → IAM is mainly used to manage AWS resources and permissions, not third-party SAML-based authentication. B. Amazon Cognito → Cognito is used for user authentication in custom web and mobile apps, but it is not optimized for central SSO to third-party SAML apps. D. AWS CLI → The AWS CLI is a command-line tool for managing AWS resources and does not provide a user login portal. ChatGPT
Mydam
👍 1
Selected: C
ANSWER : C. AWS IAM Identity Center (AWS Single Sign-On) Explanation: AWS IAM Identity Center (formerly AWS Single Sign-On) is designed to provide a centralized user portal for users to log in and access multiple third-party business applications that support SAML 2.0. It allows organizations to manage user authentication and authorization efficiently across various applications, including AWS accounts, SAML-based applications, and SaaS providers.
Sidh123
👍 1
Selected: C
Its Option c
anitaexam
👍 1
Selected: C
AWS IAM Identity Center (formerly AWS Single Sign-On) is a service that enables users to access multiple business applications, including third-party applications that support Security Assertion Markup Language (SAML) 2.0, from a central portal. With AWS IAM Identity Center, you can configure single sign-on (SSO) for both AWS applications and third-party SAML-compatible applications, allowing users to log in once and seamlessly access all connected applications.
MephiboshethGumani
👍 1
Selected: C
AWS IAM Identity Center (AWS SSO) provides a centralized user portal for accessing various applications, including third-party business applications, and supports SAML 2.0 for single sign-on (SSO). It enables users to log in once to the AWS SSO portal and access a variety of SAML-based applications without needing to log in separately to each one. AWS SSO integrates with existing identity providers or can manage user identities natively, making it an ideal solution for managing access to multiple SAML-supported applications.
Arvindpareek
👍 1
Selected: C
AWS IAM Identity Center (AWS Single Sign-On) provides a central user portal for single sign-on access to multiple AWS accounts, business applications, and third-party services that support SAML 2.0. It is specifically designed to simplify user access management and enables seamless integration with SAML-enabled applications. B. Amazon Cognito: While Cognito supports user authentication and federation, it is better suited for custom-built apps and not a centralized SSO solution for multiple third-party apps.
Doaws
👍 1
Selected: C
B as Amazon Cognito does NOT provide a central user portal
mel101
👍 2
Selected: C
read up on it again
Amin_013
👍 2
Selected: B
B. Amazon Cognito
5MT
👍 1
Selected: C
Amazon Web Services (AWS) IAM Identity Center is a cloud-based service that allows users to sign in to AWS accounts and third-party applications using a central user portal:
Oezge
👍 1
Selected: B
Amazon Cognito is correct. It's a managed service that enables you to handle authentication and aspects of authorization for your custom web and mobile applications through AWS. You provide users with IAM-equivalent permissions, without granting them full IAM access.
Yak_Yeti
👍 1
Selected: B
AWS IAM Identity Center (formerly AWS Single Sign-On) is a service that simplifies the management of user identities and access across multiple AWS accounts and applications. The key is AWS accounts and applications. AWS Cognito is not specific to AWS, and provides Third Party and SAML support
Svishn1
👍 1
Selected: B
B. AWS Cognito is a correct answer
familyrijen
👍 1
Selected: C
on single portal for all account SAML2.0 Third party application access.
davide.314c
👍 1
Selected: C
A company needs a central user portal --> AWS IAM identity center
peace_of_stone
👍 1
Selected: C
Based on copilot: "To meet the requirement of providing a central user portal for logging into third-party business applications that support SAML 2.0, the appropriate AWS service is AWS IAM Identity Center (AWS Single Sign-On). This service allows users to access multiple applications with a single set of credentials, simplifying the login process and enhancing security. Amazon Cognito, on the other hand, is primarily used for user authentication and management for web and mobile apps, but it does not provide the same centralized SSO capabilities for third-party SAML applications as AWS IAM Identity Center does."
91ad89c
👍 2
Selected: C
The correct answer is: C. AWS IAM Identity Center (AWS Single Sign-On) Explanation: AWS IAM Identity Center (formerly AWS Single Sign-On) is a service that enables users to access multiple business applications, including third-party applications that support Security Assertion Markup Language (SAML) 2.0, from a central portal. With AWS IAM Identity Center, you can configure single sign-on (SSO) for both AWS applications and third-party SAML-compatible applications, allowing users to log in once and seamlessly access all connected applications. AWS IAM Identity Center (AWS Single Sign-On) is the ideal service to set up a centralized user portal for logging into third-party applications using SAML 2.0.
Raksha11
👍 1
Cognito is 3rd party application users Central portal
Rockey_Bhai
👍 1
B. Amazon Cognito
Abhinay_001
👍 1
Selected: C
C is correct
MorganFreeInQatar
👍 1
Selected: B
Its B. https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html
alunan12345
👍 4
Selected: C
AWS IAM Identity Center (formerly AWS Single Sign-On) is designed to enable single sign-on access to multiple applications, including those that support SAML 2.0. It allows users to log in once and gain access to various third-party services seamlessly. While Amazon Cognito can also handle user authentication and federate with some identity providers, AWS IAM Identity Center is specifically geared toward SSO and integrates well with SAML applications.
Kilobay1
👍 1
Selected: C
Cognito does not support SAML
Saudi
👍 1
Selected: C
C correct
TryNErr
👍 1
Selected: C
C is correct
Harsh152
👍 3
Selected: C
AWS IAM Identity Center (formerly AWS Single Sign-On) provides a central user portal for users to access multiple accounts and third-party applications that support Security Assertion Markup Language (SAML) 2.0. It allows organizations to manage single sign-on (SSO) for both AWS resources and third-party applications. Amazon Cognito: Cognito is used primarily for managing authentication and identity for customer-facing applications, not for providing enterprise SSO across multiple third-party apps.
moadabdou
👍 2
Selected: C
Amazon Cognito is an authentication and identity management service primarily designed for web and mobile applications. While it offers authentication and authorization features, it's optimized for scenarios where developers want to manage user authentication for their own applications, particularly in cases where they need to handle end users directly within AWS. However, when it comes to providing a central user portal for third-party applications that support SAML 2.0, AWS Single Sign-On (SSO) is a more suitable solution. AWS SSO is specifically designed to enable users to sign in to multiple third-party applications using a single set of credentials, using the SAML 2.0 protocol.
d675329
👍 1
Selected: C
AWS Single Sign-On (SSO) is a service that makes it easy to centrally manage access to multiple AWS accounts and business applications and provides users with single sign-on access to these resources. AWS SSO supports integration with SAML 2.0-enabled third-party applications, allowing users to authenticate through a central user portal using their existing corporate credentials.
chalaka
👍 2
Selected: C
While Cognito could potentially be used to authenticate users for custom applications, AWS SSO is better suited for managing access to third-party applications that support SAML 2.0, offering features like centralized access management, user provisioning, and single sign-on capabilities.
chalaka
👍 1
B. Amazon Cognito
Frank3108
👍 1
C - IAM Identity center. IAM identity center enable users to access with SSO for AWS account in AWS organizations, Business cloud applications, SAML-2.0 enabled applications, EC2 windows instances.
nomad421
👍 2
Selected: C
The correct answer is C. You want your AWS users to authenticate to a third party app with their AWS credentials through SAML (AWS SSO), not to allow users from a third party app to access your AWS environment as guests using their third party app credentials (Amazon Cognito). Two completely different scenarios
Jumpy007
👍 2
Selected: B
B. Amazon Cognito https://aws.amazon.com/cognito/?p=pm&c=cog&z=4 With Amazon Cognito, you can add user sign-up and sign-in features and control access to your web and mobile applications. Federate sign-in by using OpenID Connect or SAML 2.0 and connect to a broad group of AWS services and products.
👍 3
Selected: B
The user wants to login to THIRD PARTY APPLICATION Not to AWS SERVICES.
DrakuAngel
👍 1
I think B,C are the right answers, not just one. Explanation : Standards-based, federated sign-in capabilities Federate sign-in by using OpenID Connect or SAML 2.0 and connect to a broad group of AWS services and products. (AWS)
DrakuAngel
👍 2
Selected: C
Source AWS>>> Streamline single sign-on access on AWS Provide your workforce single sign-on access to AWS managed and SAML 2.0 applications, such as Salesforce, Box, and Microsoft 365.
DrakuAngel
👍 1
I think B,C are the right answers, not just one. A company plans to migrate to the AWS Cloud. The company is gathering information about its on-premises infrastructure and requires information such as the hostname, IP address, and MAC address. Which AWS service will meet these requirements ? A. AWS DataSync B. AWS Application Migration Service C. AWS Application Discovery Service D. AWS Database Migration Service (AWS DMS)
Ruffyit
👍 1
4. Cognito allows access by utilizing 3rd party identity provider. Providers include google, Amazon, Facebook. SAML 2.0 PROVIDERS, MICOROSFT Active Directory
Notmeforsure
👍 2
Selected: B
B is the right answer "Third Party" is the key here
Annkurrrr
👍 1
Selected: C
AWS IAM Identity Center allows organizations to centrally manage access to multiple AWS accounts and provide users with single sign-on access to all their assigned accounts and cloud applications from one place
seetpt
👍 3
Selected: B
Cognito because third party apps.
raykinngz
👍 6
Selected: B
Cognito allows access by utilizing 3rd party identity provider. Providers include google, Amazon, Facebook. SAML 2.0 PROVIDERS, MICOROSFT Active Directory
petercorn
👍 3
Selected: C
Provide your workforce single sign-on access to AWS managed and SAML 2.0 applications, such as Salesforce, Box, and Microsoft 365. https://aws.amazon.com/iam/identity-center/
VikJo1978
👍 2
Selected: C
The correct answer is C. AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (AWS Single Sign-On) is a service that enables companies to provide centralized access to multiple applications and services for their users. This includes applications and services that support SAML 2.0.
azhrhsn
👍 2
AWS Single Sign-On - Option C To create a central user portal for users to log in to third-party business applications that support Security Assertion Markup Language (SAML) 2.0, the most suitable AWS service would be AWS IAM Identity Center.
Rinkans
👍 1
C - Centralized access management and log in to third-party business applications(not for social media )
Tampokomiks
👍 1
from ChatGPT To provide a central user portal for users to log in to third-party business applications that support Security Assertion Markup Language (SAML) 2.0, the most appropriate AWS service is AWS Identity and Access Management (IAM) ¹. IAM supports identity federation through SAML 2.0, which allows users to access AWS resources and third-party applications using a single sign-on (SSO) experience ¹. With IAM, you can create a SAML identity provider (IdP) that represents your organization's identity management system, and configure it to establish trust between your organization and AWS ¹. You can then use IAM roles to grant permissions to your users to access AWS resources and third-party applications, and use SAML assertions to authenticate users and provide them with temporary security credentials ¹. I hope this helps!
RyeBread
👍 2
Yes, but after it gave you that prompt did you ask it why B wouldn't be the answer. I just tried it after it gave me the same answer it gave you and it apologized and said B was the answer. My point is please don't use ChatGPT as a sole source because it is wrong more times than not. The only time I would maybe trust an answer from it is if I ask it if its sure and it says yes, then ask about the other options to make sure it doesn't change.
BIGQUERY_ALT_ALT
👍 28
Selected: B
B. AWS Cognito is correct answer. The user wants to login to THIRD PARTY APPLICATION Not to AWS SERVICES. Definition of Cognito - Amazon Cognito supports authentication with identity providers (IdPs) through Security Assertion Markup Language 2.0 (SAML 2.0). You can use an IdP that supports SAML with Amazon Cognito to provide a simple onboarding flow for your users. Support page - https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html
reddy187
👍 2
Agreed, KeyWord, Third Party and SAML support.
abbey0922
👍 3
Selected: C
Web-based single sign-on (SSO) to the AWS Management Console from your organization. Users can sign in to a portal in your organization hosted by a SAML 2.0–compatible IdP, select an option to go to AWS, and be redirected to the console without having to provide additional sign-in information. You can use a third-party SAML IdP to establish SSO access to the console or you can create a custom IdP to enable console access for your external users.
asdfcdsxdfc
👍 2
Selected: C
C is correct
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS IAM Identity Center (the current name for AWS Single Sign-On) is built precisely for the scenario described: a single user portal where workforce users sign in once and then launch assigned business applications. It supports SAML 2.0 applications through a built-in application catalog (Salesforce, Box, Microsoft 365, and others) and through custom SAML 2.0 application entries, and it can also connect to Microsoft AD or an external identity provider as the source of identities. Administrators control which user or group sees which application, so the portal itself becomes the central access point. As petercorn notes, the product page promises "Provide your workforce single sign-on access to AWS managed and SAML 2.0 applications" — exactly the requirement in the question.
Why the Other Options Are Wrong
AWS Identity and Access Management (IAM) governs permissions inside AWS — users, roles, policies, and access to AWS APIs and resources — and does not offer an application portal for third-party SaaS. Amazon Cognito is a customer identity and access management (CIAM) service: identity pools and user pools authenticate the users of your application, and while a user pool can federate with a SAML 2.0 identity provider, that is Cognito acting as a relying party, not Cognito hosting a workforce portal with application assignments. AWS CLI is a command-line tool for calling AWS APIs and has nothing to do with SAML single sign-on portals. Only IAM Identity Center combines a user-facing portal, SAML 2.0 application integration, and centralized assignment management.
Community Comment Notes
Opinions were split, which is why this question is a useful study item. BIGQUERY_ALT_ALT argued for Cognito, quoting the reasoning "The user wants to login to THIRD PARTY APPLICATION" and pointing at Cognito's SAML IdP support, and seetpt echoed "Cognito because third party apps." The opposing camp is more accurate for CLF-C02: deathhellknight01 described IAM Identity Center as "designed to provide a central authentication portal," Harsh152 stressed that it covers "both AWS resources and third-party applications," and alunan12345 drew the same workforce-versus-customer distinction. e5c1bb5 added the IAM Identity Center documentation link for managing applications, which is the decisive reference.
Official Reference
Exam Strategy
For any identity question, first ask who is signing in: employees of your company (workforce → IAM Identity Center) or end customers of your application (customer → Cognito). Then check whether the requirement mentions a central portal with application assignments — that phrase points to Identity Center every time.
Frequently Asked Questions
Why isn't Amazon Cognito the right choice for a workforce SAML portal?
Cognito manages customer identities for applications you build; it can federate with a SAML IdP but does not provide an employee-facing portal with per-application assignments to SaaS apps.
Can IAM Identity Center sign users in to Salesforce, Box, and Microsoft 365?
Yes. Its application catalog includes SAML 2.0 business apps such as Salesforce, Box, and Microsoft 365, and you can also add custom SAML 2.0 applications.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →