November 6, 2026, (Inside AI) — Amazon Web Services has enabled IAM Identity Center (IdC) multi-region replication for Amazon SageMaker AI Studio, allowing enterprises to deploy machine learning domains in regions separate from their primary identity instance. The update, announced this week, removes a long-standing constraint that forced the IdC instance and the SageMaker domain to reside in the same region.
The change matters because data residency rules and workforce distribution rarely align with a single cloud region. Until now, organizations that needed to keep their identity provider in one jurisdiction faced a hard choice: relocate their ML workloads or abandon centralized single sign-on. AWS says the new capability lets customers replicate their primary IdC instance into the region where they run SageMaker AI Studio, preserving both compliance and SSO.
"This capability helps customers maintain compliance while utilizing centralized workforce identity management," the company stated in its announcement.
The feature is available in 15 AWS Regions, including Asia Pacific (Tokyo), Europe (Ireland), US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Frankfurt), South America (São Paulo), Asia Pacific (Seoul), Europe (London), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Asia Pacific (Mumbai), Europe (Paris), and Europe (Stockholm). AWS did not specify a launch date beyond the immediate availability.
Read: Lumen and Microsoft Expand Co-Selling Pact for AI-Ready Enterprise Networks
Why Identity Geography Became a Cloud Battleground
Identity is the control plane for every cloud workload, and regulators increasingly treat identity data as sensitive. A primary IdC instance holds user directories, group memberships, and authentication logs. For a bank in Frankfurt or a hospital group in Tokyo, moving that directory to another region can violate local data protection laws even if the ML models themselves stay put. Multi-region replication addresses that by letting the identity store follow the workload, not the other way around.
AWS is not alone in this push. Microsoft Entra ID and Google Cloud Identity have offered multi-region replication for years, though with varying degrees of automation. AWS's move brings SageMaker AI Studio closer to parity with those identity services. It also reflects a broader pattern: cloud providers are decoupling control-plane services from data-plane services to satisfy sovereignty requirements without forcing customers into isolated cloud silos.
The timing is notable. Enterprises are scaling generative AI pilots into production, and many of those deployments involve sensitive data. A recent survey by the Cloud Security Alliance found that 68% of organizations cite data residency as a top barrier to AI adoption. Removing the IdC region constraint eliminates one friction point, though it does not address model training data location or inference logging.
Administrators can now deploy SageMaker AI domains aligned with workforce location and data residency requirements, independent of the primary IdC instance's region. AWS documentation outlines the setup process, and the IAM Identity Center User Guide provides replication configuration steps. The company did not disclose whether replication is synchronous or asynchronous, nor did it specify latency implications for authentication requests across regions.
For global operations, the feature supports centralized identity management across distributed teams. A company with headquarters in London and engineering hubs in Singapore and São Paulo can keep its primary IdC instance in London while running SageMaker AI Studio domains in each hub's region, all under one SSO policy. That reduces administrative overhead and avoids the security risks of fragmented identity stores.
Read: Box Expands Nvidia Partnership, Unveils AI Workflow Builder
One unresolved question is cost. AWS has not published pricing for IdC multi-region replication, and it remains unclear whether replication traffic or additional directory replicas incur charges. Enterprises will need to model that into their total cost of ownership, especially if they replicate to many regions.
The update also has implications for disaster recovery. If a primary IdC region experiences an outage, replicated instances in other regions could maintain authentication for SageMaker workloads. AWS did not explicitly frame the feature as a resilience tool, but the architecture enables that use case. Competitors like Azure have marketed multi-region identity replication as a business continuity feature, and AWS customers may pressure the company to do the same.
For now, the capability is live in all standard regions where SageMaker AI Studio is supported. Organizations that previously deferred ML deployments due to identity region conflicts now have a path forward. The next step for AWS is likely to extend replication to other services that depend on IdC, such as Amazon Q or Bedrock, which could further erode region-based adoption barriers.
Shamil has a low tolerance for AI that only works in controlled demos. He covers agentic systems and generative AI with the skepticism of someone who has seen too many “revolutionary” tools quietly disappear six months after launch.
