AWS IAM Identity Center now preserves data during Active Directory migrations

Amazon Web Services updated AWS IAM Identity Center on October 20, 2026, to preserve user data during identity source migrations. Previously, moving away from Active Directory deleted users, groups, and assignments at cutover. The new capability retains these elements when switching to an external identity provider or the native Identity Center directory.

This change aligns Active Directory migrations with existing transitions between external identity providers and the Identity Center directory. Organizations consolidating infrastructure or adopting single sign-on can now migrate without losing access configurations. AWS strongly recommends test validation and dress rehearsals because the change applies to the entire instance simultaneously.

Migration mechanics and identity sources

IAM Identity Center connects to one identity source at a time, serving as the system of record for AWS access. The service supports three main sources: the default Identity Center directory, on-premises or managed Microsoft Active Directory, and external SAML 2.0 providers. External providers include Okta Universal Directory, Microsoft Entra ID, and Ping Identity.

When migrating from Active Directory to an external provider, IAM Identity Center keeps the same identity store, user IDs, and group IDs. The system updates only the external identifier to reflect the new source. This ensures continuity for permission set assignments and assume-role access across AWS accounts.

Impact on administrators and workflows

AWS administrators and identity engineers can now switch sources more safely, according to the AWS Security Blog. The update includes architectural guidance and a step-by-step runbook for switching from Active Directory to Okta. Sample code assists teams in automating the transition process and managing permission sets.

The inclusion of Okta in the example does not constitute an endorsement, AWS noted. It serves as a representative SAML 2.0 provider for the migration guide. Organizations using other external identity providers can adapt the guidance to their specific infrastructure and security requirements.

What should you do?

Review your current IAM Identity Center configuration to determine if you rely on Active Directory as the primary identity source. Evaluate whether migrating to an external provider or the native directory aligns with your security strategy. Plan for the fact that switching to Active Directory will still delete existing users and assignments.

What to do and how to stay safe: AWS

• Audit current IAM Identity Center instances to identify reliance on Active Directory for user and group management.
• Conduct a dress rehearsal of the migration process in a non-production environment to validate data preservation.
• Review permission set assignments to ensure they function correctly after the external identifier updates.
• Consult the AWS Security Blog runbook for specific steps on transitioning to SAML 2.0 providers like Okta or Microsoft Entra ID.

Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does migrating from Active Directory delete my users and groups?

No, the October 2026 update ensures that users, groups, memberships, and assignments are preserved when migrating from Active Directory to an external IdP or the Identity Center directory.

What happens if I switch my identity source to Active Directory?

Switching to Active Directory still removes users, groups, and assignments during the transition, unlike migrations away from Active Directory.

Which external identity providers are supported for migration?

IAM Identity Center supports external providers that use SAML 2.0, including Okta Universal Directory, Microsoft Entra ID, and Ping Identity.