View a markdown version of this page

Set up enterprise sign-in with Microsoft Entra ID for Amazon Quick on desktop - Amazon Quick
Step 1: Create an OIDC application in Microsoft Entra IDStep 2: Add the desktop connector with your identity provider configurationStep 3: Download, verify, and distribute the desktop application
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Set up enterprise sign-in with Microsoft Entra ID for Amazon Quick on desktop

 Applies to: Enterprise Edition 
   Intended audience: System administrators 

Use these steps only if you choose Configure Identity Provider when you add the desktop connector. Most organizations don't need a separate identity provider configuration for the desktop application. For the default setup, see Turning on desktop access.

This page walks you through the three steps to set up enterprise sign-in with Microsoft Entra ID:

  1. Create an OpenID Connect (OIDC) application in Microsoft Entra ID and record its values.

  2. Add the desktop connector with your identity provider configuration.

  3. Download, verify, and distribute the desktop application.

Before you begin, review the prerequisites in Setting up Amazon Quick on desktop for enterprise deployments and Using a dedicated identity provider configuration (advanced).

Note

To sign in, users need an active Amazon Quick web session in their browser. The email address in Microsoft Entra ID must exactly match the user's email address in Quick, and Microsoft Entra ID must not mark that email address as unverified. For more information, see How sign-in works with a dedicated identity provider.

Step 1: Create an OIDC application in Microsoft Entra ID

Register a public OIDC client application in Microsoft Entra ID. The Amazon Quick desktop application uses this client to authenticate users through the authorization code flow with PKCE. This client requires no client secret. Grant the offline_access scope so that the application can issue refresh tokens. Without it, users must re-authenticate frequently.

For more information, see Register an application in the Microsoft Entra documentation.

To create the Entra ID app registration

  1. In the Azure portal, navigate to Microsoft Entra ID → App registrations → New registration.

  2. Configure the following settings:

    Setting Value
    Name Amazon Quick Desktop
    Supported account types Accounts in this organizational directory only (Single tenant)
    Redirect URI platform Public client/native (mobile & desktop)
    Redirect URI http://localhost:18080

  3. Choose Register.

  4. On the Overview page, note the Application (client) ID and Directory (tenant) ID. You need these values in later steps.

This is a public client registration. Entra ID enforces PKCE automatically for public clients.

To configure API permissions

  1. In the app registration, navigate to API permissions → Add a permission → Microsoft Graph → Delegated permissions.

  2. Add the following permissions: openid, email, profile, offline_access.

  3. Choose Add permissions.

  4. If your organization requires it, choose Grant admin consent for [your organization].

To configure authentication settings

  1. In the app registration, navigate to Authentication.

  2. Under Advanced settings, leave Allow public client flows set to No.

  3. Verify that http://localhost:18080 is listed under Mobile and desktop applications.

  4. Choose Save.

To configure token claims

  1. In the app registration, navigate to Token configuration.

  2. Choose Add optional claim.

  3. Select token type: ID.

  4. Select the email claim and choose Add.

Important

This step is required. Without the email optional claim, Microsoft Entra ID does not include the user's email address in the ID token, and Amazon Quick cannot map the token to a user. Additionally, each user who signs in must have their Mail attribute populated in their Entra ID profile (under Contact Information). The User Principal Name (UPN) alone is not sufficient. The Mail attribute must contain a value.

Record the following OIDC endpoints. You enter these values, together with the Application (client) ID you noted earlier, in Step 2. Replace <TENANT_ID> with your Directory (tenant) ID.

Important

The Issuer URL must include the /v2.0 path suffix. Do not use the Authority URL shown in the Entra ID Endpoints panel, which omits this suffix. If the /v2.0 suffix is missing, token validation fails with an "Invalid issuer" error at sign-in time.

Field Value
Client ID The Application (client) ID from the app registration Overview page
Issuer URL https://login.microsoftonline.com/<TENANT_ID>/v2.0
Authorization endpoint https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/authorize
Token endpoint https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token
JWKS URI https://login.microsoftonline.com/<TENANT_ID>/discovery/v2.0/keys
Tip

The JWKS URI is not displayed in the Microsoft Entra ID Endpoints panel. You can find it by opening the OpenID Connect metadata document URL from the Endpoints panel and locating the jwks_uri field in the JSON response. Alternatively, construct it using the format shown in the preceding table.

Important

If your application has custom signing keys because of the claims-mapping feature, you must append an appid query parameter containing the Application (client) ID to the JWKS URI. Otherwise, token validation fails because the default keys endpoint does not return the application's custom signing key. For example:

https://login.microsoftonline.com/<TENANT_ID>/discovery/v2.0/keys?appid=<CLIENT_ID>

To confirm the correct value, open the OpenID Connect metadata document with the same appid parameter appended (https://login.microsoftonline.com/<TENANT_ID>/.well-known/openid-configuration?appid=<CLIENT_ID>) and use the jwks_uri it returns. For more information, see Validate the signature in the Microsoft Entra documentation.

Step 2: Add the desktop connector with your identity provider configuration

In the Amazon Quick console, add the desktop connector and enter the values that you recorded in Step 1.

Important

Adding the desktop connector turns on desktop access for all users in your account right away. To roll out desktop in stages, restrict the Quick desktop capability in a custom permissions profile before you add the connector. For more information, see Turning on desktop access. You can also restrict the capability after you add the connector.

To add the desktop connector

  1. Sign in to the Amazon Quick console as an administrator.

  2. Choose your profile icon, and then choose Manage account.

  3. In the navigation pane, choose Inbound connectors, and then choose the Quick Desktop tab.

  4. Choose Add desktop connector.

  5. For the identity setup, choose Configure Identity Provider, and then enter the values that you recorded in Step 1:

    Identity provider configuration values
    Field Value
    Issuer URL The exact OIDC issuer URL from Step 1, including any required path suffix.
    Authorization endpoint The OIDC authorization endpoint URL from Step 1.
    Token endpoint The OIDC token endpoint URL from Step 1.
    JWKS URI The JSON Web Key Set URI from Step 1.
    Client ID The OIDC client identifier (Client ID or Application (client) ID) that you recorded in Step 1.

  6. Choose Confirm.

  7. Verify that the connector card shows the name Quick Desktop and the status Enabled.

Note

Adding the desktop connector is a one-time, account-level action. After the connector is enabled, all users in your account can sign in with your identity provider. Users don't need to turn anything on themselves.

Step 3: Download, verify, and distribute the desktop application

In this step, you install the desktop application, verify that enterprise sign-in works, and then distribute the application to your users.

First, download and install the application. For download locations and installation steps, see Downloading and installing.

Then, verify that enterprise sign-in works.

To verify enterprise sign-in

  1. Open the Amazon Quick desktop application.

  2. On the sign-in screen, choose Continue with SSO.

  3. (Optional) Select your Amazon Web Services Region, or choose Dynamic to detect your Region automatically.

  4. Sign in with your corporate credentials. The application redirects to your identity provider, and then opens the Home screen after sign-in succeeds.

Tip

If sign-in fails, check the values that you entered in Step 2 against the values from Step 1. For more information, see Troubleshooting enterprise sign-in for Amazon Quick on desktop.

Finally, distribute the application to your users. Direct them to Getting started with the Amazon Quick desktop application for download, installation, and sign-in instructions. Users choose Continue with SSO and sign in with their corporate credentials. They don't need any other setup.