Setting up single sign-on for AWS and Contact Center

<body>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Set up single sign-on (SSO) for Amazon Connect and Contact Center using AWS as the SAML identity provider. Configure SAML applications in AWS IAM Identity Center, ensuring they are in the same AWS account as your organization. For Amazon Connect, manage permissions with service control policies. For Contact Center, configure the Cognito UserPool and specify the identity provider for agent authentication.</p>
</div>
<p id="docs-hc-snippet" style="display: none;">You can configure Amazon Connect and Contact Center for SSO with AWS as the SAML-based identity provider. Amazon Connect and Contact Center each require a SAML application. The required SAML applications are created and configured in AWS IAM Identity Center.</p>

<div class="body">
<p class="p">You can configure Amazon Connect and Contact Center for SSO with AWS as the SAML-based
identity provider. Amazon Connect and Contact Center each require a SAML application. The
required SAML applications are created and configured in AWS IAM Identity Center. </p>
<p class="p">This article assumes that AWS organizations and IAM identity center are already set up in a
separate AWS account (and potentially different region) within your AWS organization. The SAML
applications must be created in AWS IAM Identity Center in the same account where your AWS
organization is set up. Before you start, ensure that you either have access to this
environment or that someone with the required access can assist with the creation of the SAML
applications.</p>
<div class="p">This article contains the following topics:<ul class="ul" id="topic_y2g_qnl_yfc__ul_xvl_14l_yfc">
<li class="li"><a class="xref" href="#topic_dlj_b4l_yfc">Configuring SSO for Amazon
Connect</a></li>
<li class="li"><a class="xref" href="#topic_c4c_c4l_yfc">Configuring SSO for Contact
Center</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_dlj_b4l_yfc">
<h2 class="title topictitle2" id="ariaid-title2">Configuring SSO for Amazon Connect</h2>
<div class="body">
<p class="p">To set up single sign-on (SSO) for Amazon Connect, you'll configure a SAML application in
the IAM Identity Center, which is often in a separate AWS account and region. However, the
identity provider, role, and policy must be established within the same AWS account as
Amazon Connect. </p>
<p class="p">You can configure Amazon Connect SSO with AWS as described in <a class="xref" href="https://catalog.workshops.aws/amazon-connect-sso/en-US/6-sso-amazonconnect-aws-iam-identity-center" target="_blank">Configure Amazon Connect SSO with AWS as the identity
provider</a> in the AWS documentation.</p>
<p class="p">It's a good idea to use service control policies (SCPs) to manage permissions regarding
what users and roles can do in Amazon Connect, protecting important resources and making
your system more secure. See <a class="xref" href="https://docs.aws.amazon.com/connect/latest/adminguide/security-best-practices.html" target="_blank">Security Best Practices for Amazon Connect</a>.</p>
<p class="p">The following example SCP can be used to prevent the deletion of the Amazon Connect
instance and associated role.</p>
<div class="p">
<pre class="pre codeblock"><code>&lt;pre&gt;&lt;code class="language-json"&gt;
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonConnectRoleDenyDeletion",
"Effect": "Deny",
"Action": [
"iam:DeleteRole"
],
"Resource": [
"arn:aws:iam::*:role/***Amazon Connect user role***"
]
},
{
"Sid": "AmazonConnectInstanceDenyDeletion",
"Effect": "Deny",
"Action": [
"connect:DeleteInstance"
],
"Resource": [
"***Amazon Connect instance ARN***"
]
}
]
}
&lt;/pre&gt;&lt;/code&gt;</code></pre>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_c4c_c4l_yfc">
<h2 class="title topictitle2" id="ariaid-title3">Configuring SSO for Contact Center</h2>
<div class="body">
<p class="p">To set up single sign-on (SSO) for Contact Center, you need to configure the Cognito
UserPool to use a SAML application for sign-in. The Cognito UserPool is the one that was
created by the Contact Center CloudFormation template.</p>
<p class="p">The steps in the process include:</p>
<ul class="ul" id="topic_c4c_c4l_yfc__ul_sv4_n4l_yfc">
<li class="li"><a class="xref" href="#topic_ff5_24l_yfc">Gathering the required Cognito UserPool
details</a></li>
<li class="li"><a class="xref" href="#topic_pdp_f4l_yfc">Creating the SAML application in AWS IAM
Identity Center</a></li>
<li class="li"><a class="xref" href="#topic_p2w_f4l_yfc">Configuring an identity provider in the
Cognito UserPool</a></li>
<li class="li"><a class="xref" href="#topic_rdd_g4l_yfc">Specifying this identity provider to be
used for agent authentication</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested2" id="topic_ff5_24l_yfc">
<h3 class="title topictitle3" id="ariaid-title4">Gathering the required Cognito UserPool details</h3>
<div class="body">
<p class="p">The first step to set up single sign-on (SSO) for Contact Center is to gather the
required Cognito UserPool details.</p>
<div class="p">
<strong class="ph b">To gather the required Cognito UserPool details</strong><ol class="ol" id="topic_ff5_24l_yfc__ol_nvk_ypl_yfc">
<li class="li">Log in to the AWS account where the Contact Center CloudFormation stack was created. </li>
<li class="li">In the Cognito service (ensure that you are in the correct region), open the user
pool that was created when the Contact Center CloudFormation stack was created.
<p class="p">Take note of the user pool ID.</p>
<p class="p"><img class="image" id="topic_ff5_24l_yfc__image_nzl_kxx_xfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_15.png" width="600"></p>
</li>
<li class="li">Click the <strong class="ph b">App Integration tab</strong>, then take note of the Cognito domain prefix.
<p class="p">This is the first part of the Cognito domain, before <em class="ph i">.auth.regionxxx</em>. This
is also the value that was specified in the CloudFormation template, so you can copy
the value from the CloudFormation parameters tab if you prefer.</p>
<p class="p"><img class="image" id="topic_ff5_24l_yfc__image_d55_2rl_yfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_16.png" width="600"></p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_pdp_f4l_yfc">
<h3 class="title topictitle3" id="ariaid-title5">Creating the SAML application in AWS IAM Identity Center</h3>
<div class="body">
<p class="p">The second step to set up single sign-on (SSO) for Contact Center is to create the SAML
application in AWS IAM Identity Center.</p>
<div class="p">
<strong class="ph b">To create the SAML application in AWS IAM Identity Center</strong><ol class="ol" id="topic_pdp_f4l_yfc__ol_xbq_vrl_yfc">
<li class="li">Log in to the AWS account where AWS IAM Identity Center is configured.</li>
<li class="li">Select <strong class="ph b">Application assignments</strong> &gt; <strong class="ph b">Applications</strong>, then click <strong class="ph b">Add
application</strong>. </li>
<li class="li">Click <strong class="ph b">Add custom SAML 2.0 application</strong>.</li>
<li class="li">Enter the following information:<div class="p">
<ul class="ul" id="topic_pdp_f4l_yfc__ul_twz_dsl_yfc">
<li class="li">
<strong class="ph b">Display name</strong> is the name displayed on the SAML tile.</li>
<li class="li">
<strong class="ph b">Application start URL</strong> (optional) is the URL for Contact Center. This is
the same URL that was added as an approved origin in Amazon Connect. It has the
following format:
<p class="p">https://${<em class="ph i">LMWorkspace</em>}.${<em class="ph i">LMRegion</em>}.localmeasure.com</p>
</li>
<li class="li">
<strong class="ph b">Relay state</strong> should be left blank.</li>
<li class="li">Under <strong class="ph b">Application metadata</strong>, select <strong class="ph b">Manually type your metadata
values</strong>, then specify the following:<ul class="ul" id="topic_pdp_f4l_yfc__ul_gj1_ysl_yfc">
<li class="li">
<strong class="ph b">Application ACS url</strong>:
https://${<em class="ph i">yourDomainPrefix</em>}.auth.${<em class="ph i">region</em>}.amazoncognito.com/saml2/idpresponse</li>
<li class="li">
<strong class="ph b">Application SAML audience</strong>:
urn:amazon:cognito:sp:${<em class="ph i">yourUserPoolID</em>}</li>
</ul>
<p class="p"><img class="image" id="topic_pdp_f4l_yfc__image_g2q_ftl_yfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_17.png" width="600"></p>
</li>
</ul>
</div>
</li>
<li class="li">Click <strong class="ph b">Submit</strong>.</li>
<li class="li">Select <strong class="ph b">Actions</strong> &gt; <strong class="ph b">Edit attribute mappings</strong>.<p class="p"><img class="image" id="topic_pdp_f4l_yfc__image_qpk_ltl_yfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_18.png" width="600"></p>
</li>
<li class="li">Enter the following attributes in the application:
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_pdp_f4l_yfc__table_rzm_qtl_yfc" rules="all" summary="">
<caption><span class="tablecap"><span class="table--title-label">Table 1. </span></span></caption>
<colgroup>
<col style="width:33.33333333333333%">
<col style="width:33.33333333333333%">
<col style="width:33.33333333333333%">
</colgroup>
<thead class="thead" style="text-align:left;">
<tr class="row">
<th class="entry cellrowborder" id="d52e285" style="vertical-align:top;">SAML attribute</th>
<th class="entry cellrowborder" id="d52e288" style="vertical-align:top;">Maps to string value or user attribute</th>
<th class="entry cellrowborder" id="d52e291" style="vertical-align:top;">Format</th>
</tr>
</thead>
<tbody class="tbody">
<tr class="row">
<td class="entry cellrowborder" headers="d52e285" style="vertical-align:top;">Subject</td>
<td class="entry cellrowborder" headers="d52e288" style="vertical-align:top;">${user:email}</td>
<td class="entry cellrowborder" headers="d52e291" style="vertical-align:top;">Persistent</td>
</tr>
<tr class="row">
<td class="entry cellrowborder" headers="d52e285" style="vertical-align:top;">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress </td>
<td class="entry cellrowborder" headers="d52e288" style="vertical-align:top;">${user:email}</td>
<td class="entry cellrowborder" headers="d52e291" style="vertical-align:top;"> </td>
</tr>
</tbody>
</table>
</div>
<p class="p"><img class="image" id="topic_pdp_f4l_yfc__image_ewl_d5l_yfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_19.png" width="600"></p>
</li>
<li class="li">Click <strong class="ph b">Save changes</strong>.</li>
<li class="li">Under <strong class="ph b">Assigned users</strong>, click <strong class="ph b">Assign Users</strong>, then add either users or
groups of users who should have access to Contact Center.</li>
<li class="li">Click <strong class="ph b">Actions</strong> again, then select <strong class="ph b">Edit configuration</strong>.</li>
<li class="li">Under <strong class="ph b">IAM Identity Center SAML metadata file</strong>, click <strong class="ph b">Download</strong>.<p class="p">Save
this file. You'll need it to complete the Cognito configuration.</p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="topic_p2w_f4l_yfc">
<h3 class="title topictitle3" id="ariaid-title6">Configuring an identity provider in the Cognito UserPool</h3>
<div class="body">
<p class="p">The third step to set up Single Sign On (SSO) for Contact Center is to configure an
identity provider in the Cognito UserPool.</p>
<div class="p">
<strong class="ph b">To configure an identity provider in the Cognito UserPool</strong><ol class="ol" id="topic_p2w_f4l_yfc__ol_lbq_fql_yfc">
<li class="li">Log in to the AWS account that contains the Cognito UserPool. </li>
<li class="li">In the Cognito service, open the UserPool.</li>
<li class="li">Click the <strong class="ph b">Sign-in experience</strong> tab, then click <strong class="ph b">Add identity
provider</strong>.<p class="p"><img class="image" id="topic_p2w_f4l_yfc__image_yvg_nvl_yfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_20.png" width="600"></p>
</li>
<li class="li">Click <strong class="ph b">SAML</strong>.</li>
<li class="li">Under <strong class="ph b">Set up SAML federation with this user pool</strong>, complete the following
options:<ul class="ul" id="topic_p2w_f4l_yfc__ul_lvm_svl_yfc">
<li class="li">
<strong class="ph b">Provider name</strong>: Enter a name for this identity provider. Do not use any
spaces in the name.</li>
<li class="li">
<strong class="ph b">Metadata document source</strong>: Select <strong class="ph b">Upload metadata document</strong> &gt;
<strong class="ph b">choose file</strong>, then select the SAML metadata file downloaded from AWS IAM
Identity center.</li>
</ul>
</li>
<li class="li">Under <strong class="ph b">Map attributes between your SAML provider and your user pool</strong>, set the
following attribute:<ul class="ul" id="topic_p2w_f4l_yfc__ul_r3h_rjm_yfc">
<li class="li">
<strong class="ph b">User pool attribute:</strong> email</li>
<li class="li">
<strong class="ph b">SAML attribute:</strong>
<a class="xref" href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" target="_blank">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</a>
</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Add identity provider</strong>. <p class="p">At this point the required identity provider
has been created.</p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="topic_rdd_g4l_yfc">
<h3 class="title topictitle3" id="ariaid-title7">Specifying this identity provider to be used for agent authentication</h3>
<div class="body">
<p class="p">The final step to set up single sign-on for Contact Center is to specify the identity
provider to be used for agent authentication.</p>
<div class="p">
<strong class="ph b">To specify the identity provider to be used for agent authentication</strong><ol class="ol" id="topic_rdd_g4l_yfc__ol_fz2_jql_yfc">
<li class="li">In the tabbed view, click <strong class="ph b">App integration</strong>, then click the app-client at the
bottom of the page.</li>
<li class="li">In the Hosted UI section of the app-client, click <strong class="ph b">Edit.</strong><p class="p"><img class="image" id="topic_rdd_g4l_yfc__image_n5s_ycm_yfc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/zen_contact_cent_21.png" width="600"></p>
</li>
<li class="li">Under Hosted sign-up and sign-in pages, click the <strong class="ph b">Identity providers</strong> dropdown
list, then select the identity provider you configured in <a class="xref" href="#topic_p2w_f4l_yfc">Configuring an identity provider in the Cognito UserPool</a>.</li>
<li class="li">Click <strong class="ph b">Save changes</strong>.<p class="p">Zendesk requires the name of the IDP (as configured
under Sign-in experience) to complete the setup of your account. Include this along
with the CloudFormation outputs information shared with Zendesk.</p>
</li>
</ol>
</div>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/9459034190746-Setting-up-single-sign-on-for-AWS-and-Contact-Center",
"url": "https://support.zendesk.com/hc/en-us/articles/9459034190746-Setting-up-single-sign-on-for-AWS-and-Contact-Center",
"headline": "Setting up single sign-on for AWS and Contact Center",
"description": "You can set up single sign-on for Amazon Connect and Contact Center by configuring SAML applications in AWS IAM Identity Center and integrating them with the respective services' identity providers.",
"articleSection": "Setting up Contact Center",
"datePublished": "2025-07-07T17:56:13+00:00",
"dateModified": "2026-04-15T20:13:01.949418+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/9459034190746-Setting-up-single-sign-on-for-AWS-and-Contact-Center"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>