An end-to-end guide for administrators to subscribe, provision users, enable the desktop application, configure enterprise sign-in, and govern Amazon Quick across your organization.
Checked against official AWS documentation on 17 Oct 2026.
Intended audience: Amazon Quick administrators and IT teams rolling out Quick Desktop to an organization. The six stages below take you from subscription to ongoing governance.
Create the account and set the home region.
Invite users and assign roles.
Turn on extension access at the org level.
Set up enterprise SSO (OIDC).
Roll out the app to users.
Manage data, permissions, and monitoring.
Amazon Quick offers five plans: Free, Plus, Max, Professional, and Enterprise (prices checked 17 Oct 2026). The right one depends on whether you need a standalone account for individuals and teams, or full enterprise governance and identity federation. Source: Amazon Quick pricing · Pricing page on this site
| Plan | Best for | How you create it |
|---|---|---|
| Free | Individuals getting started. No AWS account required. ($0) | Sign up with email, Google, Apple, Amazon, or GitHub on the Amazon Quick sign-up page. |
| Plus | Teams of up to 300 that need shared Spaces, user management, and centralized billing. ($20/user/month annually, $25 monthly) | Sign up the same way, then choose Plus. New signups get a 30-day Plus trial (per the FAQs). |
| Max | Frequent users who need more usage capacity. ($100/user/month annually, $125 monthly) | Sign up the same way, then choose Max. |
| Professional / Enterprise | Organizations that need governance, enterprise SSO, and assets at scale. ($20 or $40/user/month + $250/account/month) | Sign up with an AWS account (AWS Management Console). |
Free signup and the new-signup trial require no AWS account or credit card (per the FAQs). Plus and Max are paid upgrades but still use the email/social signup path and do not require an AWS account. Users sign in to the desktop app with Continue with and their email, Amazon, Apple, Google, or GitHub account. Official sources disagree on desktop access for Free, so check your plan.
Create the subscription with an AWS account. The documented desktop enterprise sign-in setup is marked "Applies to: Enterprise Edition" and supports all identity types: IAM Identity Center, IAM federation, and native Amazon Quick users.
Administrators manage user access inside Amazon Quick. How you do it depends on your account's identity configuration: with IAM Identity Center or Active Directory you assign groups to Quick roles; with Quick and IAM users you manage users and roles individually. Open the administration console with Manage account. Source: Managing user access inside Amazon Quick
Sign in to the Amazon Quick administration console and choose Manage account, then open user management. For IAM Identity Center or Active Directory accounts, assign groups to roles; for Quick and IAM users, invite users by email.
For IAM Identity Center or Active Directory accounts, assign groups to Quick roles. For Quick and IAM users, invite users by email and assign the required role (see the role table below).
For accounts that use IAM, you can let users provision themselves by granting the quicksight:CreateAdmin action (or the equivalent create-user action for the target role) in their IAM policy.
Use namespaces to isolate groups of users and assets from one another within the same account — useful for multi-tenant or strongly separated teams.
| Role | Typical permissions |
|---|---|
| Admin | Full administrative access: manage users, account settings, billing, data sources, permissions, and assets. |
| Author | Create data sources, datasets, analyses, and dashboards; share analyses and dashboards. No account administration. |
| Reader | View and interact with shared dashboards; cannot save changes, author content, or administer the account. |
| Admin Pro / Author Pro / Reader Pro | Pro roles that groups can also be assigned. Author Pro additionally supports natural-language content creation, knowledge bases, actions, and advanced automation. Reader Pro additionally supports AI chat agents, collaborative Spaces, Flows, and extensions. Per AWS docs, Reader Pro maps to the Amazon Quick Professional subscription and Author Pro maps to the Enterprise subscription. |
For Enterprise accounts, enterprise sign-in on the desktop app is turned on with two console steps: an extension access in the administration console, then an extension on the Extensions page. Both are one-time, account-level actions. Source: Setting up Amazon Quick on desktop for enterprise deployments
In the Amazon Quick administration console choose Manage account, then under Permissions choose Extension access → Add extension access. Select Amazon Quick (Desktop application for Quick) and enter the Issuer URL, Authorization Endpoint, Token Endpoint, JWKS URI, and Client ID from your IdP (see Step 4). The extension access cannot be edited after creation; to fix a value, delete it and add it again.
In the Amazon Quick console, choose Extensions in the left navigation (or under More), choose Add extension, select the Desktop application for Quick extension access, choose Next, then Create.
After the extension exists, enterprise sign-in is available to all users in the account. If only the extension access exists, users see: "Enterprise sign-in for Quick Desktop has not been configured for this account."
For Enterprise accounts, connect your OIDC-compatible identity provider so users sign in with corporate credentials (Continue with SSO). AWS documents the setup for four identity providers — start with the guide for yours.
Register a public OIDC client in your IdP, add the extension access, create the extension, then download and verify. Official step-by-step guides:
Microsoft Entra ID
Google Workspace
Okta
Ping Identity (PingFederate and PingOne)
Redirect URI: http://localhost:18080
Client type: Public / native client, authorization code flow with PKCE
Scopes: Microsoft Entra ID, Okta, and Ping Identity use openid profile email offline_access. Google Workspace uses openid email profile; Quick adds access_type=offline automatically.
ID token signing: asymmetric only (RS*, PS*, ES*); HS* and none are rejected
Email: must exactly match the user's email in Amazon Quick
Region: at sign-in, select the AWS Region or choose Dynamic
offline_access scope, which IAM Identity Center does not accept, so sign-in through IAM Identity Center fails when connected directly. The AWS Thailand team's field workaround puts Amazon Cognito in front of IAM Identity Center and adds a small proxy on the authorize endpoint that removes offline_access before the request reaches the identity provider. The team's chosen option is a CloudFront Function; an API Gateway proxy is the alternative. Neither is an AWS-recommended or AWS-documented configuration — use the official IdP guides above where you can, and test the workaround in a pilot. Details: Enterprise SSO (OIDC) guide.
Once the extension is created, get the app onto user machines. You can let users self-serve, or deploy it with your MDM. Sources: Getting started (desktop) · Deploying to a managed fleet with MDM
In Amazon Quick on the web, the user chooses Extensions in the left navigation (or under More), selects the Quick Desktop extension, opens the more options menu (...), and chooses Download for Windows or Download for Mac. Direct downloads are also listed in the docs (macOS Apple Silicon .dmg, Windows x64 .exe). Then install, open the app, and choose Continue with SSO.
For fleet rollouts use the per-machine installers from desktop.downloads.quick.aws.com (not the per-user installers): a signed macOS .pkg that installs to /Applications, and a Windows Amazon Quick-Admin Setup version.exe that installs for all users into C:\Program Files\Amazon Quick\. The Windows installer is NSIS; in Microsoft Intune use the Windows app (Win32) type with silent install flag /S (capital S):
For a single-user silent install on Windows (installs for the current user in %LOCALAPPDATA%):
On macOS with Intune, use the macOS app (PKG) type, keep only the main bundle com.aws.QuickWork.mac in Included apps, and set Ignore app version to Yes. To enforce SSO only, deploy the managed policy DisableSocialLogin (macOS preference domain com.aws.QuickWork.mac, Windows HKLM\SOFTWARE\Policies\Amazon\Quick). Windows Home is not supported for Win32 app deployment.
~/.quickwork/ (macOS) or %USERPROFILE%\.quickwork\ (Windows); see the OIDC guide's troubleshooting section.
Ongoing administration keeps your deployment secure and compliant as usage grows.
Control which connectors and MCP servers users can connect. Connector owners set each tool to Let Users Choose (default), Always Ask, or Disable; users then choose Always Allow, Ask Each Time, or Disable. By default, write tasks (for example sending an email) are Ask Each Time and read tasks are Always Allow, so Quick drafts the action and waits for consent unless settings allow it. Permissions apply to scheduled agents too. New tools found during an MCP sync are disabled by default. Source: Connectors.
Use roles (Admin / Author / Reader), groups, and namespaces to scope who can author versus consume. Review admin membership regularly and remove access for departed users.
For Enterprise accounts, centralize identity with an AWS-documented OIDC provider and enforce MFA at the IdP. Follow the provider-specific desktop enterprise sign-in guide.
Use AWS CloudTrail to audit administrative API activity and monitor user activity from the management console. Establish a regular access review and offboarding cadence.
A quick pre-launch checklist before you announce Quick Desktop to your organization.
| Item | Done when… |
|---|---|
| Plan & account | The correct plan is active and the home Region is one of the 7 desktop Regions (for desktop accounts). |
| Users provisioned | Users or groups are assigned roles, using corporate emails that match the IdP. |
| Desktop extension | The extension access is added and the Desktop application for Quick extension is created. |
| Enterprise sign-in | Continue with SSO is verified end-to-end (Enterprise accounts). |
| Distribution | The app is installed on a pilot group with the per-machine installer and validated, ready for wider rollout. |
| Governance | Connector tool permissions, MFA at the IdP, managed policies, and audit logging are in place. |
Official AWS documentation and resources used on this page.
Setting up Amazon Quick on desktop for enterprise deployments