AWS IAM Identity Center Adds Multi-Region Support for Resilient Access & Enhanced Performance

February 13, 2026 Rachel Kim – Technology Editor Technology

Amazon Web Services (AWS) has expanded the availability of its IAM Identity Center multi-Region support, enabling improved resilience for accessing AWS accounts and managed applications, the company announced Friday. The feature, now generally available in all 17 enabled-by-default commercial AWS Regions, allows organizations to replicate workforce identities, permission sets, and related metadata across regions.

The multi-Region support is designed to address potential service disruptions. By replicating data to additional regions, users can continue to access their AWS accounts through an active AWS access portal endpoint even if the primary region experiences an outage. This functionality relies on the ability to replicate workforce identities to an additional region, providing a local access point for already provisioned permissions.

AWS also highlighted the ability to deploy AWS managed applications closer to users, and datasets. This deployment strategy aims to improve user experience and address data residency requirements. Applications deployed in additional regions can access replicated workforce identities locally, optimizing performance and reliability.

The rollout builds on a feature introduced in October 2025 allowing customers to use customer-managed AWS Key Management Service (AWS KMS) keys for encryption at rest within IAM Identity Center. AWS recommends utilizing multi-Region AWS KMS keys for consistent key material across regions, though single-Region keys are supported for organizations with specific policy restrictions. Before replicating IAM Identity Center, customers must replicate their customer-managed KMS key to the additional region and configure the replica key with the necessary permissions.

Configuration is managed through the IAM Identity Center console. Users can select additional regions for replication, considering factors such as data compliance and user experience. The initial replication process duration is dependent on the size of the Identity Center instance. Once completed, users can access their accounts and applications in the modern region, and administrators can view Assertion Consumer Service (ACS) URLs for both primary and additional regions.

Integration with external identity providers (IdPs) like Microsoft Entra ID and Okta requires updating the IdP configuration to include the additional region’s ACS URL. AWS provides guidance for this process, including screenshots for the Okta admin console. Organizations can also create bookmark applications within their IdP to provide users with direct access to the AWS access portal in the additional region.

AWS clarified several key considerations for the new feature. It’s currently limited to organization instances of IAM Identity Center connected to an external IdP; account instances and other identity sources are not yet supported. The primary region remains the central point for managing workforce identities and configurations, even as additional regions offer a limited feature set, primarily focused on application management and user session revocation. All workforce actions are logged in AWS CloudTrail within the region where they occur.

The multi-Region support is available at no additional cost, with standard AWS KMS charges applying for key storage and usage. AWS encourages users to provide feedback through AWS re:Post for Identity Center or their usual AWS Support channels.