AWS opensearch-service documentation change

Service: opensearch-service · 2026-05-13 · Documentation low

File: opensearch-service/latest/developerguide/saml.md

Summary

Added Microsoft Entra ID to supported SAML providers and added note requiring IdP Entity ID to be in URL format

Security assessment

Adding a new identity provider is a routine update. The note about URL format prevents configuration errors (500 errors) but doesn't address a specific security vulnerability or weakness.

Diff

diff --git a/opensearch-service/latest/developerguide/saml.md b/opensearch-service/latest/developerguide/saml.md
index f3a4c8677..5b0a818c6 100644
--- a//opensearch-service/latest/developerguide/saml.md
+++ b//opensearch-service/latest/developerguide/saml.md
@@ -13 +13 @@ SAML authentication for OpenSearch Dashboards lets you use your existing identit
-Rather than authenticating through [Amazon Cognito](./cognito-auth.html) or the [internal user database](./fgac.html#fgac-dashboards), SAML authentication for OpenSearch Dashboards lets you use third-party identity providers to log in to Dashboards, manage fine-grained access control, search your data, and build visualizations. OpenSearch Service supports providers that use the SAML 2.0 standard, such as Okta, Keycloak, Active Directory Federation Services (ADFS), Auth0, and AWS IAM Identity Center. 
+Rather than authenticating through [Amazon Cognito](./cognito-auth.html) or the [internal user database](./fgac.html#fgac-dashboards), SAML authentication for OpenSearch Dashboards lets you use third-party identity providers to log in to Dashboards, manage fine-grained access control, search your data, and build visualizations. OpenSearch Service supports providers that use the SAML 2.0 standard, such as Okta, Keycloak, Microsoft Entra ID, Active Directory Federation Services (ADFS), Auth0, and AWS IAM Identity Center. 
@@ -195,0 +196,4 @@ After you input your IdP metadata, configure the following additional fields wit
+###### Note
+
+The IdP Entity ID value must be in URL format (for example, `https://idp.example.com/...`). Non-URL values such as a plain string (for example, "JumpCloud") will cause a 500 error.
+