Amazon Web Services → Microsoft Azure
Azure equivalent of AWS Identity and Access Management (IAM)
AWS IAM maps to two Azure services.
About AWS Identity and Access Management (IAM)
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Users, groups, roles, and JSON policies that authorize every AWS API call, with identity-based and resource-based policies, permissions boundaries, and conditions. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (2)
| Capability | Azure equivalent | Match |
|---|---|---|
| Cloud identity and access management | Microsoft Entra ID, Azure role-based access control (Azure RBAC) | Partial match |
| Federation for workloads outside the cloud | Microsoft Entra workload identity federation | Partial match |
Identity & access management(2)
Cloud identity and access management Partial match
AWS IAM maps to two Azure services. Microsoft Entra ID holds the identities (users, groups, apps, managed identities), and Azure RBAC grants them roles on resources. AWS IAM does both jobs inside each account.
- Where identities live. IAM users and roles live in each AWS account (workforce users usually come through Identity Center). Entra ID is one tenant-wide directory shared by Azure, Microsoft 365, and your apps.
- Policy model. IAM uses JSON policies attached to identities or resources, with explicit deny, conditions, and permissions boundaries. Azure RBAC assigns roles (sets of actions) at a scope that inherits downward, with deny assignments and attribute-based conditions in limited cases.
- Data plane. Some Azure services use separate data-plane roles (for example, Storage Blob Data Reader or Key Vault Secrets User). IAM actions cover both management and data APIs.
Federation for workloads outside the cloud Partial match
IAM Roles Anywhere (X.509 certificates) and IAM OIDC identity providers map to Microsoft Entra workload identity federation, which trusts OIDC tokens from external issuers such as GitHub Actions, Kubernetes, Google, or AWS.
- Trust type. Roles Anywhere trusts certificates from a CA you register. Entra workload identity federation trusts OIDC tokens. For certificate-based workloads on Azure, use app registrations with certificate credentials, or Azure Arc-enabled servers with managed identities for on-premises machines.
- Cross-cloud. To call Azure from AWS, Microsoft documents exchanging an AWS-issued OIDC token (for example, through Cognito) for an Entra token. To call AWS from Azure, configure Entra ID as an IAM OIDC provider.