Can I connect one Amazon Connect to two Azure AD’s via SAML?

It is kind of possible but this can lead to some unexpected behavior. https://docs.aws.amazon.com/connect/latest/adminguide/configure-saml.html#saml-important-notes

Amazon Connect instance allow only a 1:1 mapping of user roles to SAML authentication.

This means although you can create two IAM Identity Providers in your AWS account connecting to your Azure AD apps, those two providers have to share the same IAM role. Also, users in those two Azure AD apps cannot share the same username/email address as Amazon cannot distinguish this in Connect. You need to make sure each user is unique in both Azure AD apps.

Also, you should never delete the IAM role that are used for authentication in Connect. https://docs.aws.amazon.com/connect/latest/adminguide/configure-saml.html#enable-saml-federation

Replacing this role could cause previously federated users to fail at federation because it breaks existing user logins.

In conclusion, it is not a recommended way of building a call center. It is possible but easy to get things wrong and require maintenance on your side.

No Comments

Leave a Reply