A company has an organization with all features enabled in AWS Organizations.

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

IAM Identity Center account instances are designed for isolated deployments of supported AWS managed applications in a single AWS account. AWS documentation states that account instances should be used for isolated users who need applications in one account, and they remain bound to the account in which they are created. This matches the requirement: third-party users cannot be added to the company’s main IdP, and access must be isolated from the organization-level IAM Identity Center identity source. Amazon Cognito identity pools do not configure authentication for IAM Identity Center integrated AWS managed applications in this pattern. IAM SAML roles in the management account would not isolate the application account cleanly. IAM Identity Center supports one identity source per instance, so adding a second identity source to the organization instance is not the right design.

================