Setting up SSO for AWS Quick Desktop with Microsoft Entra ID

Getting the AWS Quick desktop app to sign in via Microsoft Entra ID (Azure AD) requires understanding three things the documentation doesn't make obvious. I found out the hard way and with help from AWS support:

1. The desktop app doesn't go directly to your identity provider (Entra ID), it first needs an active Quick web session in your default browser to discover your account configuration.
2. The email claim in the OIDC token comes from Entra's Mail attribute, not the UPN. These are often completely different addresses.
3. Your Quick account's authentication type chosen at subscription time is irreversible and it determines how users get provisioned and which SSO paths are available.

The setup

• AWS Quick Enterprise Edition on AWS account in eu-central-1
• Microsoft Entra ID as the corporate identity provider
• Entra ID (Azure AD) synced to AWS IAM Identity Center via SCIM/SAML
• Goal: users sign into the Quick desktop app with their corporate Entra ID credentials

Understanding Quick's identity types

When you create a Quick subscription, you choose an authentication method. This choice is permanent:

If you're starting fresh, choose IAM Identity Center. If you have an existing IDENTITY_POOL account and want automatic provisioning, you must delete and recreate the subscription (destructive, all assets are lost).

The desktop app's hidden prerequisite: web session discovery

This is the most important thing the documentation doesn't tell you.

When you click "Continue with SSO" in the Quick desktop app, it does NOT redirect directly to Entra. Instead:

1. The app opens a Quick web page in your default browser
2. That page identifies your AWS account from an active Quick web session
3. It retrieves the OIDC extension configuration (Client ID, endpoints) for your AWS account
4. It hands those back to the desktop app
5. Only THEN does the desktop app redirect to Entra for OIDC auth code + PKCE

If there's no active Quick web session in your default browser, step 2 fails and you see the AWS account chooser or local login page instead of being sent to Entra.

The fix: sign into Quick in your default browser first via the Identity Center portal, then use the desktop app (see Step 5: Sign In below). After the first successful desktop sign-in, the app has refresh tokens and stays signed in across restarts.

Setup path for IAM Identity Center

This is the clean path. Users are provisioned automatically, no local passwords needed.

Prerequisites

• IAM Identity Center active in the same region as Quick (or org-level)
• Microsoft Entra ID configured as the external identity source for Identity Center
• Identity Center groups created for Quick roles (e.g., quick-admins, quick-authors, quick-readers)
• Users assigned to those groups in Entra/Identity Center

Step 1: Subscribe to Quick with Identity Center

During subscription:

• Select IAM Identity Center as the authentication method
• Map your Identity Center groups to Quick Admin/Author/Reader roles
• Users in those groups are provisioned automatically

Step 2: Create the OIDC App Registration in Entra

Register a public OIDC client for the desktop app:

1. In Azure portal: Microsoft Entra ID > App registrations > New registration
2. Settings:
   • Name: AWS Quick Desktop
   • Supported account types: Single tenant
   • Redirect URI platform: Public client/native (mobile & desktop)
   • Redirect URI: http://localhost:18080
3. API permissions: openid, email, profile, offline_access
4. Authentication > Advanced settings: You can leave "Allow public client flows" turned off. That setting is only needed for older sign-in methods (like device codes), not for the flow the desktop app actually uses.
5. Token configuration: Add optional claim > ID token > email

Each user must have their Mail attribute populated in Entra (under Contact Information > Email). The desktop OIDC extension sources the email claim from this attribute, not the UPN. If your SCIM provisioning maps the UPN to Identity Center's email field instead of the Mail attribute, the provisioned Quick user's email won't match the token and sign-in will fail with "0 users for your email."

Step 3: Add Extension Access in Quick

AWS docs mention the extension twice, once for adding it, second for activating it. Not sure why it's not a one step process, this way I lost too much time in finding how to create it. Use my print screens for an easier life.

In Quick admin console > Manage account > Permissions > Extension access:

1. Add extension access
2. Select service: AWS Quick (Desktop application for Quick)
3. Enter the OIDC values:
   • Client ID: your app's Application (client) ID
   • Issuer URL: https://login.microsoftonline.com/TENANT_ID/v2.0
   • Authorization endpoint: https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize
   • Token endpoint: https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
   • JWKS URI: https://login.microsoftonline.com/TENANT_ID/discovery/v2.0/keys

Important: The Issuer URL MUST include /v2.0. This configuration cannot be edited after creation, if any value is wrong, you must delete and recreate.

Step 4: Activate the Extension

The extension access from Step 3 holds the OIDC configuration, but it's not active until you create an extension from it on a separate page.

In Quick console > Extensions (may be under "More"):

1. Add extension
2. Select the extension access you created
3. Create

Both steps are required. Extension access without the extension gives an error.

Step 5: Sign In

1. Go to your Identity Center portal (e.g., https://your-domain.awsapps.com/start)
2. Under the Applications tab, click the AWS Quick tile, this establishes the web session. This tile appears automatically for anyone in the group you mapped during Step 1 subscription. No manual assignment is needed in Identity Center. If you don't see it, check that your user is a member of the mapped group.
3. Open the Quick desktop app
4. Click "Continue with SSO"
5. Authenticate with your Microsoft Entra ID credentials
6. You're in, with refresh tokens for persistent sessions