Identity & Security: AWS to Azure service map
29 AWS → Azure mappings: 9 direct, 18 partial, 2 with no equivalent.
Identity and access management, workforce and customer identity, directories, multi-account governance and guardrails, audit and compliance, keys, secrets and certificates, and threat detection and security operations. AWS mapped to Azure, verified against official docs.
Identity & access management(7)
Cloud identity and access management Partial match
AWS IAM maps to two Azure services. Microsoft Entra ID holds the identities (users, groups, apps, managed identities), and Azure RBAC grants them roles on resources. AWS IAM does both jobs inside each account.
Workforce single sign-on and MFA Direct match
AWS IAM Identity Center maps to Microsoft Entra ID single sign-on, with Entra MFA and Conditional Access. Many organizations connect Entra ID to Identity Center as its external identity provider.
Credential-free identities for cloud workloads Direct match
IAM roles for EC2, Lambda, ECS, and EKS map to Azure managed identities (system-assigned or user-assigned). Both hand short-lived tokens to code through the platform.
Federation for workloads outside the cloud Partial match
IAM Roles Anywhere (X.509 certificates) and IAM OIDC identity providers map to Microsoft Entra workload identity federation, which trusts OIDC tokens from external issuers such as GitHub Actions, Kubernetes, Google, or AWS.
Just-in-time privileged access Partial match
Azure has Microsoft Entra Privileged Identity Management (PIM) as a built-in service. On AWS, Microsoft notes that the equivalent is the open-source temporary elevated access solution built on IAM Identity Center, or partner products.
Find excessive, unused, or external access Partial match
Microsoft maps IAM Access Analyzer to Microsoft Entra access reviews (part of Entra ID Governance). Access Analyzer is automated policy analysis, while access reviews are periodic human attestations. Entra Permissions Management, Microsoft's former multicloud permissions analyzer, retired November 1, 2025.
Share resources across accounts Partial match
Microsoft maps AWS Resource Access Manager to Azure RBAC. Because Azure subscriptions share one Entra tenant, you usually share by granting roles on a resource, rather than by creating resource shares.
Customer identity, directories & app access(4)
Customer identity and access management (CIAM) Partial match
Amazon Cognito user pools map to Microsoft Entra External ID in an external tenant. Azure AD B2C, the older Azure CIAM service, has been unavailable to new customers since May 1, 2025. Cognito identity pools, which swap tokens for AWS credentials, have no direct Azure counterpart.
Managed Active Directory Partial match
AWS Directory Service maps to Microsoft Entra Domain Services. Both provide managed domain join, Group Policy, LDAP, and Kerberos or NTLM authentication.
Fine-grained authorization for your own apps No equivalent
Azure has no managed equivalent of Amazon Verified Permissions. On Azure, apps use Entra app roles, groups, and token claims, and implement fine-grained rules in code or with open-source policy engines.
Zero trust access to private apps (VPN replacement) Partial match
AWS Verified Access maps to Microsoft Entra Private Access, part of Microsoft's Global Secure Access security service edge.
Multi-account governance & guardrails(3)
Multi-account organization hierarchy Direct match
AWS Organizations maps to Azure management groups. AWS accounts correspond roughly to Azure subscriptions, and organizational units to management groups.
Organization-wide guardrail policies Partial match
Service control policies (and resource control policies) map most closely to Azure Policy assigned at management groups, which can deny, audit, or fix resource configurations. Azure RBAC deny assignments cover only limited scenarios.
Landing zone setup and account vending Partial match
AWS Control Tower maps to Azure landing zones from the Cloud Adoption Framework, deployed with the portal accelerator, Bicep, or Terraform, plus subscription vending modules. Azure Blueprints, an older option, retires January 31, 2027.
Audit, configuration & compliance(4)
API and control-plane audit logs Direct match
AWS CloudTrail maps to the Azure Monitor activity log for resource operations, plus Microsoft Entra audit and sign-in logs for identity events. Resource-level data-plane logs come from each service's diagnostic settings.
Resource configuration history and compliance rules Partial match
AWS Config maps to a combination of Azure Policy (compliance evaluation and remediation) and Azure Resource Graph (inventory and change history).
Compliance assessments and audit evidence Partial match
AWS Audit Manager maps to Microsoft Purview Compliance Manager and the regulatory compliance dashboard in Defender for Cloud. Audit Manager is in maintenance mode, and since April 30, 2026 it can't be set up in new accounts.
Provider compliance reports and agreements Direct match
AWS Artifact maps to the Microsoft Service Trust Portal.
Keys, secrets & certificates(5)
Managed encryption keys Direct match
AWS KMS maps to Azure Key Vault (keys), or Key Vault Managed HSM for single-tenant, HSM-only key storage.
Single-tenant HSMs under your control Direct match
AWS CloudHSM maps to Azure Cloud HSM. Azure Dedicated HSM, the older option, is closed to new customers and supported until July 31, 2028.
Secrets storage and rotation Direct match
AWS Secrets Manager maps to Azure Key Vault secrets.
Managed TLS certificates Partial match
AWS Certificate Manager maps to Key Vault certificates, plus free managed certificates built into App Service and Front Door.
Managed private certificate authority No equivalent
Azure has no general-purpose managed private CA like AWS Private CA. Key Vault can create self-signed certificates or integrate with external CAs, and Azure Cloud HSM can protect the keys of a CA you run yourself (for example, AD Certificate Services).
Threat detection, posture & security operations(6)
Managed threat detection Partial match
Amazon GuardDuty maps to the workload protection plans in Microsoft Defender for Cloud (Defender for Servers, Containers, Storage, Databases, Resource Manager, and others).
Cloud security posture management (CSPM) Direct match
AWS Security Hub CSPM (the control checks formerly called Security Hub) maps to Defender for Cloud's free Foundational CSPM and the paid Defender CSPM plan. The newer AWS Security Hub, which correlates findings into exposures, maps to Defender CSPM's attack path analysis and risk prioritization.
Vulnerability scanning for servers, containers, and functions Partial match
Amazon Inspector maps to Defender for Servers (with Microsoft Defender Vulnerability Management) for VMs, and Defender for Containers or Defender CSPM for container image scanning.
Sensitive data discovery Partial match
Amazon Macie maps to Microsoft Purview (Data Map classification and Data Security Posture Management), and to sensitive data threat detection in Defender for Storage and Defender CSPM.
Security investigation and incident analysis Partial match
Amazon Detective maps most closely to Microsoft Sentinel's incident investigation, entity pages, and UEBA, now in the Microsoft Defender portal. Sentinel is a full SIEM and SOAR, while Detective is an investigation tool, and AWS has no first-party SIEM.
Security data lake Partial match
Amazon Security Lake maps to the Microsoft Sentinel data lake.