A company has a single AWS account. IT support currently uses named IAM users to sign into the AWS Management Console and wants to stop managing separate IAM users while continuing to use their on-premises Active Directory credentials. The solutions architect will implement AWS IAM Identity Center (AWS SSO). Which solution meets the requirement most cost-effectively?

The correct solution leverages AD Connector, which is a cost-effective way to integrate on-premises Active Directory with AWS services without deploying a full managed AD in AWS. AD Connector acts as a proxy, forwarding authentication requests to your existing on-premises AD. This avoids the higher cost and management overhead of AWS Managed Microsoft AD. Creating an AWS Organization and enabling all features is a prerequisite for using IAM Identity Center effectively across multiple accounts, even if only one account is currently in use, as it provides a foundation for future multi-account strategies and centralized identity management. IAM Identity Center then uses the AD Connector as its identity source, allowing users to sign in with their existing on-premises AD credentials and granting access based on permission sets mapped to their AD groups.