Access grant and revocation workflow integrating Microsoft Entra ID, SCIM provisioning, and AWS IAM Identity Center with SSO and MFA. New employees are added to Entra ID groups, synchronized via SCIM to AWS IAM Identity Center where Permission Sets are assigned, then authenticate through SSO plus MFA to gain AWS account access. Role changes or departures trigger the reverse flow: group removal in Entra ID, SCIM synchronization, Permission Set revocation in IAM Identity Center, and immediate AWS access loss. This architecture demonstrates zero-trust identity governance, automating access lifecycle management and reducing manual provisioning errors. Fork this diagram on Diagrams.so to customize for your organization's Entra ID tenant, SCIM connector, and AWS organizational structure.