---
title: "Sign people in through single sign-on · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people
updated: 2026-10-20
licence: "All rights reserved"
---

# Sign people in through single sign-on

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Rule: Give people cloud access only through the company identity provider, with two-factor login. Create no separate cloud user with a password for a person.
- How: Connect the cloud to the identity provider, for example with AWS IAM Identity Center, Google Cloud's Workforce Identity or Microsoft Entra ID. Map groups to roles, such as read-only, developer and admin. Require phishing-resistant factors, passkeys or security keys, as in [two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login). Set the session length of production roles to 1 hour, because credentials already issued stay valid until they expire. When someone leaves, removing them from the identity provider then ends all their cloud access within that hour.
- Check: The cloud lists no user with a console password, except the documented break-glass accounts. Disable a test person in the identity provider, and their next cloud call fails within 1 hour.

Example:

```sh
# AWS: lists users that have a console password. Expect only the documented break-glass users.
aws iam generate-credential-report >/dev/null && sleep 5
aws iam get-credential-report --query Content --output text | base64 -d | awk -F, 'NR>1 && $4=="true" {print $1}'
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people`.

- Next: [Keep no long-lived access keys](https://agentwranglers.se/playbook/infrastructure/identity-and-access/no-long-lived-keys)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)