MFA Security Issues

Fix Microsoft Authenticator Cannot Complete Microsoft 365 SSO to AWS

John Wilson Oct 12, 2026 868 views

Question details

Users are unable to log into AWS using Microsoft 365 SSO due to a SAML mapping failure during the Microsoft Authenticator sign-in process.

Product: Microsoft 365 / AWS
Device & OS: not provided
Scenario: Attempting to access AWS or a federated application via Microsoft 365 Single Sign-On (SSO).
Observed behavior: The Microsoft Authenticator sign-in completes but fails to map the SAML login to AWS, blocking access to the application.

Before you start

Ensure you have Global Administrator privileges in your Microsoft 365 tenant, as you will need to review Microsoft Entra ID logs and enterprise application settings.

Solution 1Recommended

Verify Microsoft Entra SAML Claims and Application Settings

Check the enterprise application configuration in Microsoft Entra to ensure the SAML claims, identifiers, and reply URLs match AWS requirements.

AWS requires specific SAML claims (such as Role and RoleSessionName) to successfully map an authenticated Entra ID user to an AWS IAM role. Missing or incorrectly formatted claims will cause the SSO to fail even if the MFA prompt is approved.

Access Entra ID

Open the AWS Application

Navigate to 'Applications' > 'Enterprise applications' and select your AWS application from the list.

Verify Basic SAML Configuration

Click on 'Single sign-on' and verify that the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) are exactly matching your AWS environment configuration.

Check Attributes and Claims

Edit the 'Attributes & Claims' section to ensure the SAML claims are properly mapped to the required AWS roles and session tags.

Confirm User Assignment

Navigate to the 'Users and groups' tab to ensure the affected users are properly assigned to the application.

Verify Microsoft Entra SAML Claims and Application Settings

Admin Rights Required: You must be signed in as a Global Administrator or Application Administrator to make changes to Enterprise Applications.

Solution 2

Review Entra Sign-in Logs and AWS Identity Center

Analyze the authentication logs to pinpoint where the SAML mapping fails between Microsoft 365 and AWS.

Free Microsoft Office alternative

Looking for a Hassle-Free Office Suite? Try WPS Office

While configuring complex Microsoft 365 SSO and AWS SAML integrations requires administrative troubleshooting, your daily document work shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for your local and cloud document needs.

1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
2. Install the Suite: Run the downloaded installation file and follow the on-screen prompts.
3. Open and Edit: Launch WPS Office to immediately open, edit, and save your existing Microsoft Office files without complex cloud setups.

Fully compatible with Microsoft Office formats (Word, Excel, PowerPoint).Lightweight design ensures fast startup without heavy background authentication services.Built-in PDF editing and format conversion tools.Familiar user interface for seamless migration from Microsoft 365.

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft Authenticator approve the login but AWS denies access?

This usually happens when the multi-factor authentication succeeds in Microsoft Entra ID, but the SAML token passed to AWS lacks the correct role claims or has mismatched identifiers, causing AWS to reject the mapping.

Do I need Global Administrator rights to fix this SAML SSO issue?

Yes, verifying and editing Microsoft Entra enterprise application settings, SAML claims, and reviewing detailed sign-in logs requires Global Administrator or Application Administrator privileges in your Microsoft 365 tenant.

How do I update the SAML signing certificate for AWS in Microsoft 365?

Go to your AWS Enterprise Application in the Microsoft Entra admin center, select 'Single sign-on', and under the 'SAML Certificates' section, generate or upload a new certificate. You must then download the Federation Metadata XML and upload it to your AWS identity provider.

Microsoft Office Security Issues