Guides

AWS Identity Center: Multi-Region joins the setup

New organization instances can select Multi-Region during setup. AWS creates the key and replicates the instance.

By Alec Chizhik August 15, 2026 6 min read

AWS Identity Center: Multi-Region joins the setup

Since 7 August 2026, AWS has offered three regional configurations when creating an IAM Identity Center organization instance: one region, multiple regions or a custom configuration. The Multi-Region option creates the required AWS Key Management Service (KMS) key automatically and replicates the instance to a second region.

Key takeaways

One click during setup. New organization instances can select Multi-Region directly. Previously, keys, policies and regions required separate steps.
The second region maintains access. If IAM Identity Center fails in the primary region, employees should still reach their AWS accounts using permissions already provisioned.
That click has prerequisites. It applies to organization instances. Active Directory identity sources and account instances are excluded. Standard charges apply to the automatically created KMS key.

Related:AWS Cognito: Skill resets the client / NHI sprawl: Lifecycle beats login MFA

What changes on 7 August

What is IAM Identity Center? IAM Identity Center is the AWS service for centralized workforce sign-in to AWS accounts and managed applications. The instance resides in a chosen primary region and controls identities, permission sets and the employee portal. If that control plane fails, the portal will not open.

AWS has documented Multi-Region for organization instances for some time. The setup process is new. On 7 August 2026, AWS moved this step into instance creation. Anyone creating an organization instance sees three configurations and can select Multi-Region with one click.

Previously, several manual steps stood in the way. Teams had to create a customer-managed KMS key, configure key policies and add regions manually. This sequence explains why many instances remained in one region.

Three setup options

The Single-Region option remains the simplest route. The instance resides in one region. This is quick and inexpensive. But it leaves the control plane in one location.

The Multi-Region option automatically creates a customer-managed Multi-Region KMS key in the same account. AWS simultaneously replicates the instance to another region. Identities, groups, permission sets, assignments and other metadata follow. IAM Identity Center itself carries no additional charge. Standard KMS fees apply to the key.

The Custom option lets teams configure regions individually and reuse an existing customer-managed key. This suits teams wanting control over key policies, replica location or their existing KMS environment.

Setup option	What AWS creates	Best suited to
Single region	Instance only in the selected primary region	Simple setup, one control plane
Multiple regions	Customer-managed Multi-Region KMS key plus an instance replica in another region	Account access if the identity control plane’s primary region fails
Custom configuration	Individually configured regions, with an existing customer-managed KMS key if required	Environments with keys and regions already defined

AWS offers these options for organization instances in 17 commercial regions enabled by default. The announcement does not list those 17 regions. Check the console before clicking. Assuming a region is available is insufficient evidence.

What the second region actually supports

AWS describes two benefits. First, employees should retain access to their AWS accounts during an IAM Identity Center incident in the primary region. Second, managed AWS applications can run in the preferred region. The application reads replicated identities locally.

The first benefit has a firm limit. The documentation restricts account access to permissions provisioned before the incident. New assignments cannot be created through the failed primary region at that point. Multi-Region keeps the existing provisioned state accessible. Fresh provisioning through the affected primary region remains unavailable.

AWS gives clear criteria for replica placement. If compliance requires a dataset to reside in a particular region, the application follows it there. If proximity to users matters, place the replica closer. If account access must survive a regional incident, choose a geographically distant second region. These objectives conflict. No checklist provides one universally correct answer.

Prerequisites that make one-click setup costly

Multi-Region requires an organization instance. Account instances tied to a single account are excluded. Organization instances are already the intended choice for production access to AWS accounts.

The identity source must be an external provider or the IAM Identity Center directory. Active Directory identity sources prevent Multi-Region use. Teams still connecting through AD gain nothing from the new click.

The key must be a customer-managed Multi-Region KMS key in the same account. The one-click option creates it. Custom can use an existing key. AWS currently excludes opt-in regions from this feature.

External identity providers need multiple Assertion Consumer Service (ACS) URLs, meaning multiple destinations for the Security Assertion Markup Language (SAML) response, to deliver the full benefit. AWS cites Okta, Microsoft Entra ID, PingFederate, PingOne and JumpCloud as examples. The documentation lists Google Workspace among providers lacking this capability. Some regional sign-in functionality is then lost.

The application environment matters too. Every AWS managed application in use must support a customer-managed key. Applications intended for the second region must support that location. Clicking the setup option does not perform those checks for the team.

Options for existing instances

The one-click option is part of instance creation. Existing organization instances do not acquire a magic switch afterward. The documentation still permits replicating an instance to an additional region later, provided the prerequisites are met. That follows the previous process: add the key, policies and region.

For existing environments, take inventory before making changes. Identity source, key type, supported applications and the identity provider’s (IdP) ACS capabilities determine whether a replica can work. Teams using Active Directory or only an account instance must first plan their instance type. The second region comes afterward.

New organizations and fresh management accounts have an easier task. They should consider Multi-Region from the outset, provided their identity source and applications support it. The same end state remains achievable later, with more manual work and more scope for overlooking a policy.

Replica choice matters in Germany, Austria and Switzerland

Many environments in Germany, Austria and Switzerland place IAM Identity Center in Frankfurt or Ireland. The announcement does not list the 17 regions. IAM Identity Center documentation includes Frankfurt and Ireland among regions enabled by default where the service can be activated. The console shows whether the new one-click option is available in that specific region during creation.

The replica copies identities and assignments. The automatically generated key is a Multi-Region KMS key. Key material therefore moves to the second region too. Teams with strict data residency requirements must choose that location deliberately. Custom provides more control over location and the existing key. One-click setup provides speed.

Distance matters for account access during an incident. Proximity to the dataset matters for applications with residency requirements. Pursuing both demands a priority. That priority belongs in setup. During an incident, it comes too late.

Source: AWS announcement dated 7 August 2026 and the IAM Identity Center user guide on multiple regions.

Frequently asked questions

Who can use one-click setup?

New IAM Identity Center organization instances in supported commercial regions. Account instances and instances using Active Directory as their identity source are excluded.

What does AWS create automatically for Multi-Region?

A customer-managed Multi-Region KMS key in the same account and an instance replica in another region. Identities, permission sets and assignments are replicated too.

Is full access maintained during a regional outage?

No. AWS limits account access to permissions provisioned before the incident. New assignments cannot be created through the failed primary region at that point.

How much does Multi-Region cost?

IAM Identity Center itself carries no additional charge. Standard AWS KMS fees apply to the automatically created customer-managed KMS key. AWS gives no euro amount in the announcement.

Can existing instances add Multi-Region?

Yes, through the documented replication process, provided the key, instance type and identity source meet the requirements. The new one-click option is part of creation. It does not appear later on an existing instance.