A company needs a centralized user portal so employees can sign in to external business applications that support SAML 2.0. Which AWS service provides this capability?

AWS IAM Identity Center (AWS Single Sign-On) is the correct choice because it provides a centralized user portal for managing access to multiple AWS accounts and business applications, including those that support SAML 2.0. It simplifies the user experience by allowing employees to sign in once to access all assigned applications. AWS Identity and Access Management (IAM) manages access to AWS resources within a single AWS account, not external applications. Amazon Cognito primarily handles user authentication and authorization for web and mobile applications, often for customer-facing use cases, rather than enterprise-wide single sign-on to external business applications. AWS CLI is a command-line tool for managing AWS services, not an identity service.