> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/aws/onboarding/sso-on-pump.md).

# SSO on Pump

If your AWS Organization uses SSO through IAM Identity Center (formerly AWS SSO), Pump migrates your SSO configuration to the new Pump-managed organization as part of the onboarding process. This is a guided process with a Pump solutions architect.

### Overview

When you join Pump with a pre-existing AWS Organization, Pump provisions a new org and provides you with a delegated administrator account. Your SSO configuration (users, groups, permission sets) is exported from your current org and imported into the new one.

Total time: approximately 30 to 45 minutes on a call with a Pump solutions architect, plus about 5 minutes of preparation beforehand.

### Before the call (approximately 5 minutes)

1. Provide Pump with an email address to use for the root user of the delegated administrator account.
2. Specify the AWS region where you want SSO enabled.
3. Pump provisions the new organization with the delegated admin account and SSO enabled in your specified region.
4. Log in to the delegated admin account using the email you provided. Use the "forgot my password" flow to set a password.

### On the call (30 to 45 minutes)

| Step                               | What happens                                                                                                                                                                    |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1. Export existing SSO             | While screen-sharing, log into your current management account and run an export script in IAM Identity Center. This downloads your current users, groups, and permission sets. |
| 2. Import to new org               | Log into the new delegated administrator account and run an import script to upload your users, groups, and permission sets into the new organization.                          |
| 3. Third-party IdP (if applicable) | If you use a third-party identity provider (Okta, Azure AD, Google Workspace, etc.), create a new SAML or SCIM application that points to the new IAM Identity Center instance. |
| 4. Test                            | Verify SSO access by logging in through your identity provider and confirming access to your accounts.                                                                          |

### After migration

Your SSO works exactly as before. Users log in through the same identity provider, access the same accounts, and have the same permission sets. The only difference is that IAM Identity Center now runs in the Pump-managed organization's delegated admin account instead of your previous management account.

### Important notes

IAM Identity Center is managed through the delegated administrator account, not through the PumpCustomerAccess role on the management account. If you need to make changes to SSO configuration after migration (adding users, modifying permission sets), log into the delegated admin account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.pump.co/aws/onboarding/sso-on-pump.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.