Amazon Quick Desktop requires an external OIDC identity provider (Microsoft Entra ID, Okta, or Ping Identity) for Enterprise login. There is no path for customers using IAM Identity Center's **built-in directory** to authenticate on Desktop — despite the web version working seamlessly with Identity Center.
Does anybody know how to get Quick Desktop (not Web) to work with my AWS account so I can have 1 subscription attached to my IAM User?
## My Setup
- **AWS Account**: An account in us-east-1
- **Identity**: IAM Identity Center with built-in directory (no external IdP)
- **Amazon Quick Web**: Works perfectly — logs in via Identity Center with no issues
- **Amazon Quick Desktop**: Cannot use Enterprise login; forced to use a separate standalone email login
## The Problem
1. The [Desktop Enterprise setup documentation](https://docs.aws.amazon.com/quick/latest/userguide/desktop-enterprise-setup.html) only provides instructions for external IdPs (Entra, Okta, Ping). There is no path for Identity Center's built-in directory.
2. IAM Identity Center's OIDC implementation only supports the **Device Authorization Grant** (RFC 8628), not the **Authorization Code + PKCE** flow that Quick Desktop requires. This means Identity Center cannot act as the OIDC authorization server for Desktop login.
3. Attempting to self-reference Identity Center as a "trusted token issuer" in the OAuth 2.0 application wizard could theoretically work, but feels like an antipattern.
4. The net result: I maintain **two separate identities** — one for my AWS business account (web) and one standalone login (Desktop). This creates billing confusion and a fragmented experience.
## Impact and Feedback (for Quick PMs)
- Customers using Identity Center's built-in directory are effectively locked out of Desktop Enterprise login
- Small/mid-size organizations that don't need a third-party IdP are forced to adopt one (Entra, Okta, etc.) solely to use Quick Desktop — adding cost, complexity, and an external dependency
- The workaround (standalone email login) divorces Desktop usage from the org's subscription, creating billing and identity management headaches
## Suggested Resolution
1. **Support IAM Identity Center natively on Desktop** — similar to how AWS CLI does SSO login via the device authorization flow + access portal redirect, Quick Desktop could implement a comparable flow that works with Identity Center directly.
2. **At minimum, document the limitation clearly** — the current docs don't mention this gap at all, leading customers through a frustrating trial-and-error process.
3. **Allow account linking** — if native Identity Center support isn't feasible short-term, provide a way to link a standalone Desktop login to an existing Identity Center-based org subscription so billing and user identity are unified.
Thanks for details . Quick Desktop requires an OIDC Client which IAM IDC does not support, the following deployment guide is the solution Cognito OIDC Provider - Amazon Quick Knowledge Hub , so that your user can access Quick Desktop.
Kind regards,
Koushik
Hi @nick_quick_user,
Hope everything is well! Just checking to see if you saw Koushik’s most recent reply in regard to your question. Please help the community by marking this answer as “Solution” or following up in general within the next 3 business days!
Thank you!
While we have arrived at the answer --that AWS Quick Desktop doesn’t work with IAM IDC since Quick Desktop requires OIDC --it is pretty unsatisfying. It seems unusual that AWS’s primary identity system would not work with Quick Desktop. I hope this product gap will be addressed soon.