Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using Active Directory with Amazon Quick Suite Enterprise edition

Amazon Quick Suite Enterprise edition supports both Amazon Directory Service for Microsoft Active Directory and Active Directory Connector.

To create a new directory to be your identity manager for Quick Suite, use Amazon Directory Service for Microsoft Active Directory, also known as Amazon Managed Microsoft AD. This is an Active Directory host in the Amazon Cloud that offers most of the same functionality of Active Directory. Currently, you can connect to Active Directory in any Amazon Region supported by Amazon Quick Suite, except for Asia Pacific (Singapore). When you create a directory, you use it with a virtual private cloud (VPC). For more information, see VPC.

If you have an existing directory that you want to use for Quick Suite, you can use Active Directory Connector. This service redirects directory requests to your Active Directory—in another Amazon Web Services Region or on-premises—without caching any information in the cloud.

For a walkthrough about creating and managing a directory with Amazon Managed Microsoft AD, see Use an Amazon Managed Microsoft AD with Quick Suite? in the Amazon Knowledge Center.

When you use Amazon Directory Service to launch a directory, Amazon creates an organizational unit (OU) with the same name as your domain. Amazon also creates an administrative account with delegated administrative rights for the OU. You can create accounts, groups, and policies within the OU by using Active Directory users and groups. For more information, see Best Practices for Amazon Managed Microsoft AD in the Directory Service Administration Guide.

After you establish your directory, you use it with Quick Suite by creating groups for users. Amazon Quick Suite has six specific user roles that can be assigned, including Pro versions that provide access to advanced capabilities:

You can add or refine access by applying IAM policies. For example, you can use IAM policies to allow users to subscribe themselves.

When you subscribe to Amazon Quick Suite Enterprise edition and choose Active Directory as your identity provider, you can associate your AD groups with Amazon Quick Suite. You can also add or change your AD groups later on.

Directory integration with Quick Suite Enterprise edition

Quick Suite Enterprise supports the following options:

If you want to use IAM federation with an on-premises Active Directory, you implement Amazon Directory Service as a separate Active Directory with a trust relationship to the on-premises Active Directory.

If you want to avoid using a trust relationship, you can deploy a standalone domain for authentication within Amazon. Then you can create users and groups in Active Directory. You'd then map them to users and groups in Quick Suite. In this example, users authenticate using their Active Directory login credentials. To make access to Quick Suite transparent to your users, use IAM federation in this scenario.