SSO Groups

Open Unified Identities › Group, filter Providers to AWS › SSO Group, then select a row to open its details. SSO groups are the groups of AWS IAM Identity Center (formerly AWS SSO).

SSO Groups

SSO Group Details

Details page contains the Risk and Exposure Point of the group, and the Information and Issues panes.

A permission set assigned to a group is inherited by every member. One group assignment can grant many users access to an account, so groups are often the shortest path to broad standing access.

SSO Group Details

Information

Information Pane contains Details, Members, Permission Sets and AWS accounts tabs. The Information Pane shows no badges for SSO groups.

Details

Details tab contains attributes below about the SSO group object.

Attribute	Description
Display Name	The group's display name.
Member Count	The number of SSO users in the group.
Description	The group description, if one is set.
Account ID	The account that hosts the Identity Center instance (management or delegated admin).
Group ID	The Identity Store group identifier.
Identity Store ID	The identity store the group belongs to (e.g., d-1234567890).
Object ID	The unique identifier of the group object.
External ID	The identifier the upstream identity provider assigned to this group, carried over by SCIM provisioning. Empty when the identity store is managed directly in Identity Center.
External ID Issuer	The identity store that issued the External ID, as an ARN.

Members

Members tab contains a list of SSO users that belong to the group. Every member inherits the group's permission set assignments. The list contains the Name, Username and Display Name columns.

Members

Permission Sets

Permission Sets tab contains a list of permission sets assigned to the group. Each one becomes an assumable role for every member in every account it is provisioned to. The list contains the Name, Description and Privileged columns.

Permission Sets

AWS accounts

AWS accounts tab lists the accounts the group can reach through its permission sets, and the role each permission set becomes in that account.

Column	Description
Account	The account the group can access.
Permission Set	The permission set that grants the access in that account.
Assumable Role	The IAM role the permission set provisions in the account.

AWS accounts

Issues

Issues pane contains identified security issues on the SSO group object.