Which AWS Service Provides a SAML 2.0 SSO Portal for Third-Party Apps?

CLF-C02 By islever Editorial Last updated

Identify AWS access management capabilities. Understand AWS Cloud security, governance, and compliance concepts.

Short answer

C AWS IAM Identity Center provides a central user portal that grants workforce users SSO access to SAML 2.0 third-party business applications.

Question

A company needs a central user portal so that users can log in to third-party business applications that support Security Assertion Markup Language (SAML) 2.0.
Which AWS service will meet this requirement?
  1. AWS Identity and Access Management (IAM)
  2. Amazon Cognito
  3. AWS IAM Identity Center (AWS Single Sign-On) Correct Answer
  4. AWS CLI

Key Takeaways

The question tests the split between workforce identity (IAM Identity Center) and customer identity (Cognito); the trap is reading "third-party applications" as an automatic signal for Cognito.

AWS IAM Identity Center (formerly AWS Single Sign-On) is the workforce single sign-on service that gives users one portal for third-party business applications that speak SAML 2.0. This page confirms why it, and not Amazon Cognito, satisfies the CLF-C02 requirement.

Common mistake: Learners often pick Amazon Cognito because "third-party application" and "SAML 2.0" sound like federation, but Cognito is customer identity for your own apps — it is not a central employee portal with per-application assignments to business SaaS.

Expert Analysis

Why the Answer Is Correct

AWS IAM Identity Center (the current name for AWS Single Sign-On) is built precisely for the scenario described: a single user portal where workforce users sign in once and then launch assigned business applications. It supports SAML 2.0 applications through a built-in application catalog (Salesforce, Box, Microsoft 365, and others) and through custom SAML 2.0 application entries, and it can also connect to Microsoft AD or an external identity provider as the source of identities. Administrators control which user or group sees which application, so the portal itself becomes the central access point. As petercorn notes, the product page promises "Provide your workforce single sign-on access to AWS managed and SAML 2.0 applications" — exactly the requirement in the question.

Why the Other Options Are Wrong

AWS Identity and Access Management (IAM) governs permissions inside AWS — users, roles, policies, and access to AWS APIs and resources — and does not offer an application portal for third-party SaaS. Amazon Cognito is a customer identity and access management (CIAM) service: identity pools and user pools authenticate the users of your application, and while a user pool can federate with a SAML 2.0 identity provider, that is Cognito acting as a relying party, not Cognito hosting a workforce portal with application assignments. AWS CLI is a command-line tool for calling AWS APIs and has nothing to do with SAML single sign-on portals. Only IAM Identity Center combines a user-facing portal, SAML 2.0 application integration, and centralized assignment management.

Community Comment Notes

Opinions were split, which is why this question is a useful study item. BIGQUERY_ALT_ALT argued for Cognito, quoting the reasoning "The user wants to login to THIRD PARTY APPLICATION" and pointing at Cognito's SAML IdP support, and seetpt echoed "Cognito because third party apps." The opposing camp is more accurate for CLF-C02: deathhellknight01 described IAM Identity Center as "designed to provide a central authentication portal," Harsh152 stressed that it covers "both AWS resources and third-party applications," and alunan12345 drew the same workforce-versus-customer distinction. e5c1bb5 added the IAM Identity Center documentation link for managing applications, which is the decisive reference.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For any identity question, first ask who is signing in: employees of your company (workforce → IAM Identity Center) or end customers of your application (customer → Cognito). Then check whether the requirement mentions a central portal with application assignments — that phrase points to Identity Center every time.

Frequently Asked Questions

Why isn't Amazon Cognito the right choice for a workforce SAML portal?

Cognito manages customer identities for applications you build; it can federate with a SAML IdP but does not provide an employee-facing portal with per-application assignments to SaaS apps.

Can IAM Identity Center sign users in to Salesforce, Box, and Microsoft 365?

Yes. Its application catalog includes SAML 2.0 business apps such as Salesforce, Box, and Microsoft 365, and you can also add custom SAML 2.0 applications.

More CLF-C02 FAQ →

Discussion 54 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 54

  1. BIGQUERY_ALT_ALT 👍 28 Answered B
    B. AWS Cognito is correct answer. The user wants to login to THIRD PARTY APPLICATION Not to AWS SERVICES. Definition of Cognito - Amazon Cognito supports authentication with identity providers (IdPs) through Security Assertion Markup Language 2.0 (SAML 2.0). You can use an IdP that supports SAML with Amazon Cognito to provide a simple onboarding flow for your users. Support page - https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html
  2. raykinngz 👍 6 Answered B
    Cognito allows access by utilizing 3rd party identity provider. Providers include google, Amazon, Facebook. SAML 2.0 PROVIDERS, MICOROSFT Active Directory
  3. deathhellknight01 👍 4 Answered C
    C. AWS IAM Identity Center (AWS Single Sign-On) Explanation: AWS IAM Identity Center (previously AWS Single Sign-On) is designed to provide a central authentication portal for users to access multiple third-party business applications that support SAML 2.0. It allows organizations to manage user identities and permissions centrally while enabling seamless single sign-on (SSO) to various applications. Why not the other options? A. AWS Identity and Access Management (IAM) → IAM is mainly used to manage AWS resources and permissions, not third-party SAML-based authentication. B. Amazon Cognito → Cognito is used for user authentication in custom web and mobile apps, but it is not optimized for central SSO to third-party SAML apps. D. AWS CLI → The AWS CLI is a command-line tool for managing AWS resources and does not provide a user login portal. ChatGPT
  4. alunan12345 👍 4 Answered C
    AWS IAM Identity Center (formerly AWS Single Sign-On) is designed to enable single sign-on access to multiple applications, including those that support SAML 2.0. It allows users to log in once and gain access to various third-party services seamlessly. While Amazon Cognito can also handle user authentication and federate with some identity providers, AWS IAM Identity Center is specifically geared toward SSO and integrates well with SAML applications.
  5. Harsh152 👍 3 Answered C
    AWS IAM Identity Center (formerly AWS Single Sign-On) provides a central user portal for users to access multiple accounts and third-party applications that support Security Assertion Markup Language (SAML) 2.0. It allows organizations to manage single sign-on (SSO) for both AWS resources and third-party applications. Amazon Cognito: Cognito is used primarily for managing authentication and identity for customer-facing applications, not for providing enterprise SSO across multiple third-party apps.
Show 25 more comments
  1. abbey0922 👍 3 Answered C
    Web-based single sign-on (SSO) to the AWS Management Console from your organization. Users can sign in to a portal in your organization hosted by a SAML 2.0–compatible IdP, select an option to go to AWS, and be redirected to the console without having to provide additional sign-in information. You can use a third-party SAML IdP to establish SSO access to the console or you can create a custom IdP to enable console access for your external users.
  2. petercorn 👍 3 Answered C
    Provide your workforce single sign-on access to AWS managed and SAML 2.0 applications, such as Salesforce, Box, and Microsoft 365. https://aws.amazon.com/iam/identity-center/
  3. Anonymous learner 👍 3 Answered B
    The user wants to login to THIRD PARTY APPLICATION Not to AWS SERVICES.
  4. seetpt 👍 3 Answered B
    Cognito because third party apps.
  5. 91ad89c 👍 2 Answered C
    The correct answer is: C. AWS IAM Identity Center (AWS Single Sign-On) Explanation: AWS IAM Identity Center (formerly AWS Single Sign-On) is a service that enables users to access multiple business applications, including third-party applications that support Security Assertion Markup Language (SAML) 2.0, from a central portal. With AWS IAM Identity Center, you can configure single sign-on (SSO) for both AWS applications and third-party SAML-compatible applications, allowing users to log in once and seamlessly access all connected applications. AWS IAM Identity Center (AWS Single Sign-On) is the ideal service to set up a centralized user portal for logging into third-party applications using SAML 2.0.
  6. moadabdou 👍 2 Answered C
    Amazon Cognito is an authentication and identity management service primarily designed for web and mobile applications. While it offers authentication and authorization features, it's optimized for scenarios where developers want to manage user authentication for their own applications, particularly in cases where they need to handle end users directly within AWS. However, when it comes to providing a central user portal for third-party applications that support SAML 2.0, AWS Single Sign-On (SSO) is a more suitable solution. AWS SSO is specifically designed to enable users to sign in to multiple third-party applications using a single set of credentials, using the SAML 2.0 protocol.
  7. RyeBread 👍 2
    Yes, but after it gave you that prompt did you ask it why B wouldn't be the answer. I just tried it after it gave me the same answer it gave you and it apologized and said B was the answer. My point is please don't use ChatGPT as a sole source because it is wrong more times than not. The only time I would maybe trust an answer from it is if I ask it if its sure and it says yes, then ask about the other options to make sure it doesn't change.
  8. nomad421 👍 2 Answered C
    The correct answer is C. You want your AWS users to authenticate to a third party app with their AWS credentials through SAML (AWS SSO), not to allow users from a third party app to access your AWS environment as guests using their third party app credentials (Amazon Cognito). Two completely different scenarios
  9. Jumpy007 👍 2 Answered B
    B. Amazon Cognito https://aws.amazon.com/cognito/?p=pm&c=cog&z=4 With Amazon Cognito, you can add user sign-up and sign-in features and control access to your web and mobile applications. Federate sign-in by using OpenID Connect or SAML 2.0 and connect to a broad group of AWS services and products.
  10. VikJo1978 👍 2 Answered C
    The correct answer is C. AWS IAM Identity Center (AWS Single Sign-On). AWS IAM Identity Center (AWS Single Sign-On) is a service that enables companies to provide centralized access to multiple applications and services for their users. This includes applications and services that support SAML 2.0.
  11. chalaka 👍 2 Answered C
    While Cognito could potentially be used to authenticate users for custom applications, AWS SSO is better suited for managing access to third-party applications that support SAML 2.0, offering features like centralized access management, user provisioning, and single sign-on capabilities.
  12. azhrhsn 👍 2
    AWS Single Sign-On - Option C To create a central user portal for users to log in to third-party business applications that support Security Assertion Markup Language (SAML) 2.0, the most suitable AWS service would be AWS IAM Identity Center.
  13. DrakuAngel 👍 2 Answered C
    Source AWS>>> Streamline single sign-on access on AWS Provide your workforce single sign-on access to AWS managed and SAML 2.0 applications, such as Salesforce, Box, and Microsoft 365.
  14. e5c1bb5 👍 2 Answered C
    https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-applications.html
  15. Notmeforsure 👍 2 Answered B
    B is the right answer "Third Party" is the key here
  16. reddy187 👍 2
    Agreed, KeyWord, Third Party and SAML support.
  17. mel101 👍 2 Answered C
    read up on it again
  18. Amin_013 👍 2 Answered B
    B. Amazon Cognito
  19. Tampokomiks 👍 1
    from ChatGPT To provide a central user portal for users to log in to third-party business applications that support Security Assertion Markup Language (SAML) 2.0, the most appropriate AWS service is AWS Identity and Access Management (IAM) ¹. IAM supports identity federation through SAML 2.0, which allows users to access AWS resources and third-party applications using a single sign-on (SSO) experience ¹. With IAM, you can create a SAML identity provider (IdP) that represents your organization's identity management system, and configure it to establish trust between your organization and AWS ¹. You can then use IAM roles to grant permissions to your users to access AWS resources and third-party applications, and use SAML assertions to authenticate users and provide them with temporary security credentials ¹. I hope this helps!
  20. peace_of_stone 👍 1 Answered C
    Based on copilot: "To meet the requirement of providing a central user portal for logging into third-party business applications that support SAML 2.0, the appropriate AWS service is AWS IAM Identity Center (AWS Single Sign-On). This service allows users to access multiple applications with a single set of credentials, simplifying the login process and enhancing security. Amazon Cognito, on the other hand, is primarily used for user authentication and management for web and mobile apps, but it does not provide the same centralized SSO capabilities for third-party SAML applications as AWS IAM Identity Center does."
  21. Zii 👍 1 Answered C
    The requirement is for: A central user portal Users to log in once Access third-party business applications Applications support SAML 2.0 AWS IAM Identity Center is designed specifically for this. It provides: Single Sign-On (SSO) to AWS accounts and applications. A centralized user portal where users can access all assigned applications. Support for SAML 2.0 applications such as Salesforce, Microsoft 365, ServiceNow, Slack, and many others. Integration with external identity providers like Microsoft Active Directory, Okta, and Azure AD.
  22. MephiboshethGumani 👍 1 Answered C
    AWS IAM Identity Center (AWS SSO) provides a centralized user portal for accessing various applications, including third-party business applications, and supports SAML 2.0 for single sign-on (SSO). It enables users to log in once to the AWS SSO portal and access a variety of SAML-based applications without needing to log in separately to each one. AWS SSO integrates with existing identity providers or can manage user identities natively, making it an ideal solution for managing access to multiple SAML-supported applications.
  23. Arvindpareek 👍 1 Answered C
    AWS IAM Identity Center (AWS Single Sign-On) provides a central user portal for single sign-on access to multiple AWS accounts, business applications, and third-party services that support SAML 2.0. It is specifically designed to simplify user access management and enables seamless integration with SAML-enabled applications. B. Amazon Cognito: While Cognito supports user authentication and federation, it is better suited for custom-built apps and not a centralized SSO solution for multiple third-party apps.
  24. xxjbloxx 👍 1 Answered C
    AWS IAM Identity Center is the correct choice:Central User Portal: AWS IAM Identity Center (formerly known as AWS Single Sign-On) provides a centralized portal where workforce users can log in once and gain single sign-on (SSO) access to multiple AWS accounts and external business applications.SAML 2.0 Integration: It natively supports SAML 2.0, allowing you to easily federate and connect to third-party Software-as-a-Service (SaaS) business applications like Salesforce, Microsoft 365, Box, or Slack.
  25. anitaexam 👍 1 Answered C
    AWS IAM Identity Center (formerly AWS Single Sign-On) is a service that enables users to access multiple business applications, including third-party applications that support Security Assertion Markup Language (SAML) 2.0, from a central portal. With AWS IAM Identity Center, you can configure single sign-on (SSO) for both AWS applications and third-party SAML-compatible applications, allowing users to log in once and seamlessly access all connected applications.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide