Assuming I have an instance of Jira (or any other non-aws app that supports SAML), and it is running in my VPC, what steps do I need to take enable single-sign on using AWS Directory Service MicrosoftAD? (Ideally, when people try to access the app, they should be authenticated first, and the app should be able to access their user attributes.)
AWS Directory Service says in its documentation that it has disabled powershell access in AWS Directory Service. Does that mean that it is impossible to enable single sign on programmatically?
You can use AWS Cognito User Pools and Connect Active Directory as a Federated Identity Provider to the User Pool. After the integration you can use Cognito User Pools and SDKs to integrate with any web applications for authentication.
Check the AWS documentation of Using Federation for Amazon Cognito User Pools for more details.