Deploy the desktop app (Connections, distribution, networking, and auditing) | AWS Quick: Zero to Hero 14

Level 200. A handout for IT teams and Quick administrators on deploying the AWS Quick desktop app (AWS Quick on desktop) to company devices. How it works: the three boundaries (the device, the Quick service, and connected apps) and how one request flows through the agent runtime. Turning it on: restrict access with custom permissions first, because adding the desktop connector turns the app on for everyone; sign-in the same way as on the web or with a dedicated IdP; and the Regions with Agentic Features. Deploying it: per-machine installers for macOS (.pkg) and Windows (.exe) with MDM, and the managed policies that turn off social sign-in and automatic updates (DisableSocialLogin, DisableAutoUpdates). Networking and auditing: outbound 443 only, with port 18080 on localhost during sign-in (a diagram); cloud connector calls that start in the Quick service; permissions for local tools such as folder access and browser actions; where data is kept (Quick doesn't encrypt device data, so use FileVault or BitLocker); and AWS CloudTrail, vended logs, and device diagnostics. Three screens of the desktop app show the version, tool permissions, and exporting logs. The rollout order is the author's suggestion, not an official AWS procedure. The appendix has the domains to allow, a glossary, and sources. Based on public documentation as of November 2026. Deck 14 (Roll it out) of the series AWS Quick: Zero to Hero.

Transcript

1. AWS Quick: Zero to Hero Roll it out Deploy the desktop app Connections, distribution, networking, and auditing 14 Level 200 / As of November 2026 November 2026 Riku Inada Amazon Web Services Japan © 2026, Amazon Web © 2026, Services, Amazon Inc. or Web its Services, affiliates.Inc. All or rights its affiliates. reserved.All rights reserved. 1
2. Introduction About me Riku Inada Amazon Web Services Japan G.K. Solutions Architect Works mainly with manufacturing customers Recent work Promoting the AI-Driven Development Life Cycle (AI-DLC) Writing and speaking about Kiro and AWS Amplify © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. X @inada_riku Speaker Deck speakerdeck.com/inariku Zenn zenn.dev/inariku GitHub github.com/inariku 2
3. Introduction Where this deck fits Now: 14 Deploy the desktop app. Next: 15 From QuickSight to Quick Get started 01–03 Go deeper 04–08 Let it run 01 Intro to AWS Quick From chat to 04 deliverables 02 Quick on the web 05 knowledge Read first 03 Quick on desktop 09–12 Roll it out 13–15 Updates Read first 09 Quick Research Quick for 13 your company 10 Quick Flows 14 desktop app 06 Agents and skills 11 Always-on agents QuickSight 15 From to Quick 07 Connectors and extensions 12 Quick Automate Spaces and Deploy the 2026.11 New each month Read next Sight 08 Quick and apps © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 3
4. Introduction What you'll learn How to turn on, deploy, and secure the AWS Quick desktop app 1 The desktop connector turns the app on for everyone, so restrict it first. 2 Deploy the per-machine installer with MDM, and set OS-managed policies. 3 The app connects out on 443, local tools run as the user, and disks need encryption. In this deck, "the desktop app" means AWS Quick on desktop, as the User Guide calls it Read first: decks 13 and 03 © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 4
5. How it works © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 5
6. How it works Three boundaries You protect devices, AWS protects the service, and providers protect their apps Device: the company protects Quick service: AWS protects Apps: company or provider Your company protects the device (the desktop app, local tools, disk encryption). AWS protects the Quick service (the agent runtime, stored conversations and memory, permission checks). Your company or the provider protects the business apps behind connectors. AWS doesn't use your conversations, files, or personal context to train or improve AI models © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 6
7. How it works How one request flows The runtime handles each request, and Quick checks permissions before each tool call 1 Send 2 Think 3 Check 4 Store 5 Return The app sends The runtime Per tool call: Encrypts and Sends the answer the request and processes it admin, connector saves the back to the app attachments with a model owner, and user conversation (user token) permissions The runtime (in the cloud) runs on Amazon Bedrock AgentCore and uses a model on Amazon Bedrock Each user gets a dedicated environment, and each session runs in its own microVM (a small VM) © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 7
8. Turn it on © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 8
9. Turn it on Turning it on The desktop connector turns the app on for everyone at once, so restrict it first 1 Restrict first 2 Add the connector 3 Check, then expand In custom permissions, turn Manage account > Check that it shows Enabled off Quick desktop for Inbound connectors > To add people, loosen step 1 those who should wait Quick Desktop tab > Add desktop connector Where automatic updates are off, deploy 1.1.4053 or later before you add the connector Requires an Enterprise edition account and a supported home Region (slide 11) © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 9
10. Turn it on Sign-in People sign in the same way as on the web, or with a dedicated IdP setup Default IdP Dedicated IdP When to use Usually this one To manage desktop sign-in apart from the web IdP work None Register an OIDC app Sign-in lasts Up to 30 days (tokens refresh hourly) 30 days or the IdP limit, whichever is shorter Both work with AWS IAM Identity Center, IAM federation, and users created in Quick A dedicated setup needs matching emails in the IdP and Quick. The steps differ by IdP © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10
11. Turn it on Region requirements The desktop app works only in Regions with Agentic Features, so check yours Supported Regions Quick account Its home Region must be one on the right US East (N. Virginia) US West (Oregon) Asia Pacific (Tokyo) Asia Pacific (Singapore) Asia Pacific (Sydney) Europe (Frankfurt) Europe (Ireland) Europe (London) AWS GovCloud (US-West) For example, in a Tokyo account, inference runs in Japan (Tokyo and Osaka) and web search runs in Tokyo. For your Region, see the Regions page of the User Guide © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 11
12. Deploy it © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 12
13. Deploy it Deploying Use MDM to install the macOS .pkg and the Windows .exe with no user action 1 Get the installer 2 Upload to MDM 3 Installed desktop.downloads.quick.aws.com A per-machine installer. macOS: /Applications gives the version and SHA-512 On Windows, the .exe Windows (silent, /S): with Admin in its name Program Files Supported: macOS on Apple silicon, and Windows Pro, Enterprise, or Education Installing the app doesn't turn on access (slide 9) In About, check that the version is 1.1.4053 or later (slide 9) Captured before the rename, so it says Amazon Quick © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 13
14. Deploy it Device policies You can turn off social sign-in (personal accounts) and automatic updates Admin Turns off Social sign-in Automatic updates © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. macOS (configuration profile) Windows (registry) Location com.aws.QuickWork.mac (preference domain) HKLM\SOFTWARE\Policies\Amazon\Quick DisableSocialLogin true (Boolean) REG_DWORD 1 DisableAutoUpdates major, minor, or patch (String) REG_SZ, same values With major, only major updates are off. With minor, minor and major updates are off. With patch, all updates are off. AWS strongly recommends allowing patch updates, so choose major or minor 14
15. Networking and auditing © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 15
16. Networking and auditing Network The app connects out on 443 only. Port 18080 listens only during sign-in 1 2 3 Outbound 443 (HTTPS and WebSocket, TLS 1.2 or later). Domains: Appendix A1. The app uses the OS proxy settings. For TLS inspection, add your CA to the OS (an MDM certificate profile) 4 During sign-in only, the app listens on localhost:18080 for the browser. If endpoint security blocks it, allow it © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 16
17. Networking and auditing Cloud integration paths Calls to cloud connectors start in the Quick service, not on the device Employee device The desktop app AWS Quick service 1 Request Connector tokens are runs only the kept in a token vault local tools in your Quick account Connected services 3 Calls Cloud connectors, knowledge bases, data sources 2 Tools 2 uses the WebSocket the app opened. 3 uses the internet or a VPC connection, not the device The app talks to Quick on outbound 443 only (Appendix A1 lists the domains) © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 17
18. Networking and auditing Local tool permissions Local tools run with the OS permissions of the signed-in user Customize > Connectors > the ⋮ menu of the row > Manage permissions Code that Quick runs on the device stays in a sandbox with no network access The user decides (screen above) Admins can turn off (custom permissions) Per tool: Always Allow, Ask Each Time, or Always Deny Local connectors, coding agents, browser actions, Only allowed folders and the OS temp folder are read and local code. Admins can't see which ones users add © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 18
19. Networking and auditing Where data is kept Conversations stay in the cloud and settings on the device, so encrypt the disk Quick account: conversations and memory Device: settings and logs, you encrypt Quick account: conversations, memory, the knowledge graph, Library, skills, and indexed folder content. Kept per user and encrypted Device: settings and permissions (.quickwork), logs, and caches. Quick doesn't encrypt them, so use FileVault or BitLocker. Tokens and secret MCP values go to Keychain or Credential Manager; other MCP values are plain text Any app running as the same OS user can read these files. Signing out or uninstalling leaves some local data. Local folders aren't uploaded until indexed © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 19
20. Networking and auditing Monitoring and auditing AWS CloudTrail records API calls. Vended logs record conversations after setup Tool What it records AWS CloudTrail API calls, and connector actions as data events (off until you turn them on) Vended logs Conversations (incognito too), from setup on, to CloudWatch Logs, Amazon S3, or Data Firehose Device diagnostics Users export them with Export logs in Settings > Advanced (screen below) Revoking access Remove a user (existing sessions end within five minutes), or use custom permissions © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 20
21. Summary © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 21
22. Summary Summary Restrict first, allow the network, set device policies, and deploy with MDM 1 The desktop connector turns the app on for everyone, so restrict it first. 2 Deploy the per-machine installer with MDM, and set OS-managed policies. 3 The app connects out on 443, local tools run as the user, and disks need encryption. A suggested order (not an official AWS procedure) 1 Restrict 2 Allow the domains 3 Set device policies 4 Deploy 5 Add the desktop connector 6 Expand © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 22
23. Summary Read next For scheduled agents, read deck 11. For company-wide rules, read deck 13 11 13 Always-on agents Quick for your company Routines, the activity feed, Mission Control, and Accounts, sign-in, Regions, permissions, and usage approvals If you set the rules for your whole company If you schedule agents that keep running in the cloud © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 23
24. Appendix © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 24
25. Appendix A1 Domains to allow Category Domain Used for Quick admin console *.quicksight.aws.amazon.com The web console, finding resources Quick data *.dp.appintegrations (no suffix in the docs) Inference, streaming, search Sign-in and API <tenant-id>.<region>.enterprise.quick.aws.com <tenant-id>.*.<region>.enterprise.quick.aws.com Sign-in, tokens, desktop APIs Settings and updates *.cloudfront.net (Amazon CloudFront) Feature flags, app updates, Quick apps Telemetry cognito-identity.*.amazonaws.com Operational telemetry Your IdP Varies (for example, login.microsoftonline.com) Sign-in at your IdP * is a Region, a per-account cell ID, or a CloudFront ID. Sign-in cells can change. The data host follows <cell-id>.dp.appintegrations.<region> and is known after the first sign-in (the docs don't say where) Find <tenant-id> by opening the desktop connector on the Quick Desktop tab of Inbound connectors. Installers come from desktop.downloads.quick.aws.com © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 25
26. Appendix A2 Glossary Term Meaning Term Meaning Desktop connector The admin setting that turns on the app Custom permissions Rules that limit features MDM Central management of company devices IdP Your company's identity provider OIDC OpenID Connect, a sign-in standard Local tools Folder access, browser actions, and more Per-machine Installed for all users of a device Sandbox An isolated area with no network microVM A small VM for each session Vended logs Chat and usage logs sent to your account Data events CloudTrail records of actions on resources Incognito A chat kept out of history and memory MCP Model Context Protocol, for AI tools CA Certificate authority Agentic Features A column of the Regions table Social sign-in Personal accounts, such as Google © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 26
27. Appendix A3 Sources AWS Quick User Guide, read on November 9, 2026 (slides 4, 6, 7, 9–11, 13, 14, 16–20, 25, 26) https://docs.aws.amazon.com/quick/latest/userguide/ What's New, November 2 and September 9, 2026 (slides 10, 11, 13) https://aws.amazon.com/about-aws/whats-new/ Screenshots: the desktop app in a test account (slides 13, 18, 20). The About window (slide 13) was captured before the rename. The network diagram (slide 16) uses draw.io and the official AWS icons; AWS Quick has no official architecture icon, so it is a labeled box © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved. 27