AWS: Enabling Federation With ADFS

Following the guide found in the blog post below;

https://blogs.aws.amazon.com/security/post/Tx71TWXXJ3UI14/Enabling-Federation-to-AWS-using-Windows-Active-Directory-ADFS-and-SAML-2-0

This guide allowed us to set up federation using ADFS 3.0. The only thing to note which does not appear to be in the blog post, is that the Active Directory Security Groups that you create (starting AWS-) must be Global or Universal. This will not work if the group has been created as Domain Local.

If you have created the group at this level you can change this without needing to recreate the Security Group. Simply set the Group Scope to "Universal" as this will then allow the "Global" box to be selected again.

This will also accept nested groups when granting access so you do not need to add all users individually.