# SSO Admin

Source: /aws/services/sso-admin/

## Introduction

SSO Admin is a service provided by Amazon Web Services (AWS) that enables you to manage your AWS Single Sign-On (AWS SSO) resources.
It allows you to create, update, and delete AWS SSO resources such as directories, groups, and users.

LocalStack provides a mock implementation of the SSO Admin API that allows you to create and manage your AWS SSO resources.
The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of SSO Admin's integration with LocalStack.

## Getting started

This guide is designed for users new to SSO Admin and assumes basic knowledge of the AWS CLI and our [`lstk aws`](/aws/developer-tools/running-localstack/lstk/cloud-and-iac-commands/#aws) command.

Start your LocalStack container using your preferred method.
We will demonstrate how to create a permission set, add tags to a permission set, and list permission sets.

### Create a permission set

You can create a permission set using the [`CreatePermissionSet`](https://docs.aws.amazon.com/sso-admin/latest/APIReference/API_CreatePermissionSet.html) API.

```bash
lstk aws sso-admin create-permission-set \
    --name my-permission-set \
    --description "My permission set" \
    --instance-arn arn:aws:sso:::instance/d-1234567890 \
    --tags Key=Name,Value=my-permission-set
```

```bash title="Output"
{
    "PermissionSet": {
        "CreatedDate": "2025-07-02T12:15:33.352631+05:30",
        "Description": "My permission set",
        "Name": "my-permission-set",
        "PermissionSetArn": "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8",
        "SessionDuration": 3600
    }
}
```

### List permission sets

You can list permission sets using the [`ListPermissionSets`](https://docs.aws.amazon.com/sso-admin/latest/APIReference/API_ListPermissionSets.html) API.

```bash
lstk aws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance/d-1234567890
```

```bash title="Output"
{
    "PermissionSets": [
        "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8"
    ]
}
```

### List tags for a permission set

You can list tags for a permission set using the [`ListTagsForResource`](https://docs.aws.amazon.com/sso-admin/latest/APIReference/API_ListTagsForResource.html) API.

```bash
lstk aws sso-admin list-tags-for-resource --resource-arn arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8 --instance-arn arn:aws:sso:::instance/d-1234567890
```

```bash title="Output"
{
    "Tags": [
        {
            "Key": "Name",
            "Value": "my-permission-set"
        }
    ]
}
```

## API Coverage


### IAM Identity Center (successor to Single Sign-On) API coverage

Source service: `sso-admin`. 26 of 79 tracked operations are implemented.

Service documentation: /aws/services/sso-admin/
License availability: available starting with the Ultimate plan. See /aws/licensing/ for current plan details.

| Operation | Status |
| --- | --- |
| AddRegion | Not implemented |
| AttachCustomerManagedPolicyReferenceToPermissionSet | Implemented |
| AttachManagedPolicyToPermissionSet | Implemented |
| CreateAccountAssignment | Implemented |
| CreateApplication | Not implemented |
| CreateApplicationAssignment | Not implemented |
| CreateInstance | Not implemented |
| CreateInstanceAccessControlAttributeConfiguration | Not implemented |
| CreatePermissionSet | Implemented |
| CreateTrustedTokenIssuer | Not implemented |
| DeleteAccountAssignment | Implemented |
| DeleteApplication | Not implemented |
| DeleteApplicationAccessScope | Not implemented |
| DeleteApplicationAssignment | Not implemented |
| DeleteApplicationAuthenticationMethod | Not implemented |
| DeleteApplicationGrant | Not implemented |
| DeleteInlinePolicyFromPermissionSet | Implemented |
| DeleteInstance | Not implemented |
| DeleteInstanceAccessControlAttributeConfiguration | Not implemented |
| DeletePermissionSet | Implemented |
| DeletePermissionsBoundaryFromPermissionSet | Not implemented |
| DeleteTrustedTokenIssuer | Not implemented |
| DescribeAccountAssignmentCreationStatus | Implemented |
| DescribeAccountAssignmentDeletionStatus | Implemented |
| DescribeApplication | Not implemented |
| DescribeApplicationAssignment | Not implemented |
| DescribeApplicationProvider | Not implemented |
| DescribeInstance | Not implemented |
| DescribeInstanceAccessControlAttributeConfiguration | Not implemented |
| DescribePermissionSet | Implemented |
| DescribePermissionSetProvisioningStatus | Not implemented |
| DescribeRegion | Not implemented |
| DescribeTrustedTokenIssuer | Not implemented |
| DetachCustomerManagedPolicyReferenceFromPermissionSet | Implemented |
| DetachManagedPolicyFromPermissionSet | Implemented |
| GetApplicationAccessScope | Not implemented |
| GetApplicationAssignmentConfiguration | Not implemented |
| GetApplicationAuthenticationMethod | Not implemented |
| GetApplicationGrant | Not implemented |
| GetApplicationSessionConfiguration | Not implemented |
| GetInlinePolicyForPermissionSet | Implemented |
| GetPermissionsBoundaryForPermissionSet | Not implemented |
| ListAccountAssignmentCreationStatus | Not implemented |
| ListAccountAssignmentDeletionStatus | Not implemented |
| ListAccountAssignments | Implemented |
| ListAccountAssignmentsForPrincipal | Implemented |
| ListAccountsForProvisionedPermissionSet | Implemented |
| ListApplicationAccessScopes | Not implemented |
| ListApplicationAssignments | Not implemented |
| ListApplicationAssignmentsForPrincipal | Not implemented |
| ListApplicationAuthenticationMethods | Not implemented |
| ListApplicationGrants | Not implemented |
| ListApplicationProviders | Not implemented |
| ListApplications | Not implemented |
| ListCustomerManagedPolicyReferencesInPermissionSet | Implemented |
| ListInstances | Implemented |
| ListManagedPoliciesInPermissionSet | Implemented |
| ListPermissionSetProvisioningStatus | Not implemented |
| ListPermissionSets | Implemented |
| ListPermissionSetsProvisionedToAccount | Implemented |
| ListRegions | Not implemented |
| ListTagsForResource | Implemented |
| ListTrustedTokenIssuers | Not implemented |
| ProvisionPermissionSet | Implemented |
| PutApplicationAccessScope | Not implemented |
| PutApplicationAssignmentConfiguration | Not implemented |
| PutApplicationAuthenticationMethod | Not implemented |
| PutApplicationGrant | Not implemented |
| PutApplicationSessionConfiguration | Not implemented |
| PutInlinePolicyToPermissionSet | Implemented |
| PutPermissionsBoundaryToPermissionSet | Not implemented |
| RemoveRegion | Not implemented |
| TagResource | Not implemented |
| UntagResource | Not implemented |
| UpdateApplication | Not implemented |
| UpdateInstance | Implemented |
| UpdateInstanceAccessControlAttributeConfiguration | Not implemented |
| UpdatePermissionSet | Implemented |
| UpdateTrustedTokenIssuer | Not implemented |