AWS SSO permission set provisioning failed: "account assignment failed" error

TL;DR

Check the target account and the permission set separately before you retry the assignment, because the failure message merges both halves. Confirm the account is active in the organization and not suspended or mid-move, then open the permission set for policy size or a broken customer managed policy reference. Remove any conflicting existing assignment for the same group and account, wait for the previous provisioning job to finish, and assign again while watching the provisioning status until it reports success.

account assignment failed

Use this when

• Assigning a group or user to an account with a permission set fails.
• Provisioning starts and finishes with an error in Identity Center.
• One account fails while the same permission set assigns cleanly elsewhere.

Not for this skill when

• Users are assigned but cannot sign in. Follow the sign-in and federation path instead.
• The permission set itself needs new policies. Edit content after provisioning works.

Steps

1. Open the target account in AWS Organizations and confirm its status is active, not suspended, closing or still joining, and note any recent move between organization units. Verify: the account status and recent moves are recorded.
2. In Identity Center open the failed assignment request or provisioning status and copy the detailed error text rather than relying on the short banner message. Verify: the detailed error is captured in the ticket.
3. Open the permission set and check its attached policies, looking for a customer managed policy name that does not exist in the target account or a total policy size near the documented limit. Verify: any missing policy reference or oversize policy is identified.
4. List existing assignments for the same account and principal to find a duplicate or a stale assignment from a previous group that conflicts with the new one. Verify: conflicting assignments are listed or ruled out.
5. Create any missing customer managed policy in the target account with the exact expected name, or trim the permission set, following the change process for that account. Verify: the permission set references now resolve in the target account.
6. Retry the assignment for one principal, watch provisioning through to a success state, and have that user open the account access portal entry as a smoke test. Verify: provisioning succeeds and the portal shows the account for the test user.
7. Assign the remaining principals, confirm each provisioning result, and file the success list with the access review evidence for the account. Verify: all intended principals show successful assignments.

Why it happens

Identity Center provisioning creates or updates an IAM role in the target account and attaches the permission set policies to it. That hidden work fails when the account cannot accept changes, when a referenced customer managed policy was never created in that account, or when the combined policy size exceeds limits. The banner error hides which of those happened, but the detailed status and a one-account test separate them cleanly. The missing policy reference is the classic fleet problem: it works in the first account because someone created the policy there by hand.

Variants and edge cases

permission set provisioning failed in one account only

The fleet phrasing. A single account failure with a shared permission set points at account local state, usually the missing managed policy.

Identity Center account assignment stuck provisioning

The stuck phrasing. Read the detailed provisioning status; a long running job from an earlier attempt can block the retry.

customer managed policy not found during assignment

The explicit phrasing. Create the policy in the target account with the exact name, case included, before retrying.

Edge cases to check before closing the review cycle:

• Provisioning into accounts under a restrictive service control policy can fail with a generic message. Check control policies when the account is newly moved.
• Renaming a customer managed policy breaks every permission set that references the old name. Treat renames as fleet changes.
• Assignment success in the console precedes portal visibility by a few minutes. Wait before declaring a sign-in failure.

Compatibility: AWS IAM Identity Center permission sets and account assignments, AWS Organizations account states, customer managed policies in member accounts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstc7i7IDmJqkhAMI71IE06Q