--- title: Mantalus | AWS | Blog | Azure AD AWS SSO and Amazon Connect description: Mantalus Blog | How do I use AWS Single sign on (SSO) with Azure AD as the identity provider (IdP)? Tips & tricks to walk through it. --- # [Mantalus | AWS | Blog | Azure AD AWS SSO and Amazon Connect](https://hstest.mantalus.com/mantalus-blog/blog/azure-ad-with-aws-sso-and-amazon-connect) Written by [Stojan Veselinovski](https://hstest.mantalus.com/mantalus-blog/author/stojan-veselinovski) | Oct 12, 2026, 5:08:36 AM Recently I was having a look at [Amazon Connect](https://aws.amazon.com/connect/) and configuring a demo for a client. One of the things I wanted to get working was single sign on (SSO) with Azure AD as the identity provider (IdP). My search for blog posts and documentation on how to do this uncovered some good starting points but they didn't cater for all my requirements. [The Next Evolution in AWS Single Sign-On](https://aws.amazon.com/blogs/aws/the-next-evolution-in-aws-single-sign-on/) is a great blog post on getting Azure AD identities into AWS SSO but is missing the integration into Connect. [Enabling federation with AWS Single Sign-On and Amazon Connect](https://aws.amazon.com/blogs/contact-center/enabling-federation-with-aws-single-sign-on-and-amazon-connect/) is another great blog post but uses AWS Managed Microsoft AD as its user base. Between those two blog posts and the AWS documentation I thought I had everything I needed to get it working quickly. The first little hurdle I encountered was my users in Azure AD did not have all the mandatory fields set for [automatic provisioning](https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html). As per the documentation: > For SCIM synchronization to work, every user must have a First name, Last name, Username and Display name value specified. If any of these values are missing from a user, that user will not be provisioned. The Azure AD account I was using for this demo wasn't properly maintained so I had to go in there and update all the missing fields. Once these were updated the identities all came across to AWS SSO. A word of warning though, automatic provisioning on Azure syncs [every 40 minutes](https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user#how-long-will-it-take-to-provision-users). There were times it took almost an hour to sync across. It can be a long day waiting for users to come across especially if you don't get your settings right from the start and have to make changes and then wait for them to sync across again. Once I had my users in AWS SSO I moved on to the Connect blog post setup steps. I created a user [stojan.veselinovski@mantalus.com](mailto:stojan.veselinovski@mantalus.com) in my Amazon Connect instance and for attribute mappings I was using the configuration options as outlined in Step 4. Now that everything was configured it was time to run my first test and to try login. I grabbed my SSO url from the SSO console. Its configured in the [initial setup of SSO](https://docs.aws.amazon.com/singlesignon/latest/userguide/prereqs.html) and in the format of: **https://.awsapps.com/start#/** The logon screen is shown below. I clicked on Amazon Connect and it popped up the Microsoft login box and a list of accounts I could use. I authenticated with the appropriate account and then I got the error – `$ is empty`. Looking at the documentation I could see the following [supported attributes](https://docs.aws.amazon.com/singlesignon/latest/userguide/attributemappingsconcept.html). I checked the synced identities in AWS SSO and noticed that "Primary Email" was blank. The [documentation](https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html) says auto provisioning uses System for Cross-domain Identity Management (SCIM) v2.0 protocol. The core schema specification can be found at [https://tools.ietf.org/html/rfc7643](https://tools.ietf.org/html/rfc7643). It wasn't completely obvious as to what fields I needed to map but my first inclination was to set the source attribute in Azure AD to be userPrincipalName and dest attribute to be email\[type = "work"\].value. See below. I waited the obligatory 40 odd minutes for the sync to come across and found that the email field had been populated. So I ran my test login into Amazon Connect again and this time it all worked and we had success. #### **Key Takeaways** - Follow [The Next Evolution in AWS Single Sign-On](https://aws.amazon.com/blogs/aws/the-next-evolution-in-aws-single-sign-on/) to setup Azure AD integration into AWS SSO - Make sure First name, Last name, Username and Display name are populated in Azure AD for all users. - Make sure you set source userPrincipalName to dest email\[type = "work"\].value for primary email to come across. You could possibly set other attributes depending on requirements but read through [rfc7623](https://tools.ietf.org/html/rfc7643) to find what works for you. - Follow [Enabling federation with AWS Single Sign-On and Amazon Connect](https://aws.amazon.com/blogs/contact-center/enabling-federation-with-aws-single-sign-on-and-amazon-connect/) to setup AWS SSO integration into Amazon Connect - Watch out for the 40 odd minute sync from Azure. There is no button or method to trigger a sync and it can be a long day waiting when you are testing different mappings. - Even though its single sign on you still have to manually create a user in Amazon Connect with the same username as the attribute passed in for RoleSessionName from the IdP. [View full post](https://hstest.mantalus.com/mantalus-blog/blog/azure-ad-with-aws-sso-and-amazon-connect) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Stojan Veselinovski" }, "dateModified" : "2026-10-19T02:33:03.537Z", "datePublished" : "2026-10-12T05:08:36Z", "headline" : "Amazon Connect SSO: Solve Azure AD Setup Snags", "image" : { "@type" : "ImageObject", "height" : 570, "url" : "https://442934832.fs1.hubspotusercontent-ap1.net/hubfs/442934832/Website%20images/Home/Home_img_1_1080.jpg", "width" : 1080 }, "mainEntityOfPage" : "https://hstest.mantalus.com/mantalus-blog/blog/azure-ad-with-aws-sso-and-amazon-connect", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "name" : "Mantalus blog" } } ```