A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS. Which solution will meet these requirements?

The correct solution is to configure AWS IAM Identity Center (AWS Single Sign-On), connect it to the existing IdP, and provision users and groups. IAM Identity Center is designed for centralized access management across multiple AWS accounts within an organization, making it ideal for this scenario. It integrates seamlessly with external IdPs, allowing employees to use their existing corporate credentials to access AWS accounts. Creating IAM users for thousands of employees across 10 accounts is unmanageable and doesn't leverage the existing IdP effectively. Setting up root users with synchronized credentials is a severe security risk and violates best practices. AWS Resource Access Manager (AWS RAM) is used for sharing AWS resources between accounts or within an organization, not for managing user authentication and access to accounts from an external IdP.