Which AWS Service Provides a Portal for Assigned AWS Accounts and SaaS Apps?

Why the Answer Is Correct

AWS IAM Identity Center, formerly AWS Single Sign-On, is designed for workforce identities and central access management. It provides a user portal where end users can see and access the AWS accounts and cloud applications assigned to them, including third-party SaaS applications that support SAML federation. The scenario's two requirements—managing access and permissions for third-party SaaS apps and giving end users a portal to assigned AWS accounts and AWS Cloud applications—map directly to IAM Identity Center. It is also the recommended AWS service for centralized workforce access across multiple AWS accounts.

Why the Other Options Are Wrong

Amazon Cognito is for customer-facing identity and access management in web and mobile applications, not for workforce access to AWS accounts and SaaS apps. AWS IAM is the underlying permissions system for AWS resources; it can define policies and roles, but it does not provide the described end-user portal or manage SaaS application assignments. AWS Directory Service for Microsoft Active Directory is a managed Microsoft AD service, useful for directory-aware workloads and domain joins, but it is not the central AWS portal for assigned accounts and SaaS applications. Therefore, A, C, and D do not meet the full requirement.

Community Comment Notes

The comments are unanimous for B: ShaiTay answered "AWS IAM Identity Center (AWS Single Sign-On)", and its_tima described it as a way to "manage their access centrally across AWS accounts and applications." That phrasing aligns with the AWS documentation and with the portal requirement in the question. No comment argues for Cognito, IAM, or Directory Service. The consensus is useful confirmation, but the decisive factor remains the requirement for a central end-user portal plus SaaS application access.