A company uses AWS Organizations to manage hundreds of AWS accounts. The company has a team that is responsible for AWS Identity and Access Management (IAM). The IAM team wants to implement AWS IAM…

Creating a new AWS account for the IAM team and delegating IAM Identity Center administration to this account ensures that the IAM team manages SSO from a separate, less privileged environment, fulfilling the requirement to avoid unneeded access to the Organizations management account.

Enabling IAM Identity Center directly in the Organizations management account is not a best practice for security and would expose the Identity Center configuration to the highly privileged management account, violating the least privilege principle for the IAM team.

Creating users and groups within IAM Identity Center is a step for granting users *access to* resources, not for granting the IAM team *administrative permissions to manage* Identity Center itself.

Creating a permission set in IAM Identity Center specifically for managing IAM Identity Center and assigning these permissions to the IAM team directly implements the principle of least privilege for their administrative duties.

Assigning an administrative permission set directly to the Organizations management account would give the IAM team a role in that account, potentially granting unneeded access and violating the principle of isolating SSO administration from the management account.

Assigning the administrative permission set (created in D) to the IAM team group within their new, dedicated AWS account (created in A) grants them the necessary permissions to administer IAM Identity Center from that delegated account, including provisioning permission sets to member accounts.