IAM Identity Center Introduces Separate Quotas for Accounts and Applications

What's new

AWS IAM Identity Center now offers separate, independent quotas for the number of AWS accounts and enterprise applications that can be configured within a single instance. This means that utilizing more of one resource type will no longer consume capacity from the other.

The default limits are now set at 7,000 AWS accounts and 7,000 applications, independently. For organizations that previously had higher limits for either accounts or applications, these increased capacities are automatically applied to both categories without requiring any manual action. Should these new default limits prove insufficient, further increases can be requested through the AWS Service Quotas console.

Why it matters

This update is a practical improvement for larger organizations and those implementing extensive multi-account strategies. Previously, a shared or less granular quota could become a bottleneck, where onboarding numerous AWS accounts might inadvertently restrict the number of SaaS or internal applications that could be integrated for single sign-on (SSO), or vice-versa.

By decoupling these limits, AWS provides clearer capacity planning and reduces the likelihood of hitting an arbitrary ceiling. Engineering teams can now scale their AWS account management and application integration efforts independently, without concerns that one will negatively impact the other. This flexibility is crucial for maintaining agility in complex enterprise environments and simplifies the process of integrating critical business applications with centralized identity management.

How to use it

Review your current IAM Identity Center usage and existing quotas in the AWS Service Quotas console to understand your new effective limits for both accounts and applications.