Deploying Amazon Quick on desktop to a managed fleet with MDM

As an administrator, you can distribute the Amazon Quick desktop application to a managed fleet with mobile device management (MDM), without any per-machine interaction. This page describes the deployment using Microsoft Intune for both macOS and Windows. The artifacts it describes – a signed macOS .pkg and a per-machine Windows .exe – also work with other MDM solutions, such as Jamf, Kandji, and VMware Workspace ONE. Only the upload mechanics differ between solutions.

This page describes how to complete the following tasks:

Prerequisites

Before you begin, verify that you have the following:

Get the installer artifacts

The Amazon Quick download service at desktop.downloads.quick.aws.com provides the desktop installers. For MDM deployment, use the per-machine installer for each platform. The per-machine installer differs from the per-user installer that individual users download from the standard download page:

Each platform publishes a channel manifest that lists the current version and a SHA-512 checksum. Fetch the manifest to find the version to deploy and the checksum to verify your download against.

# macOS manifest
curl -fsSL https://desktop.downloads.quick.aws.com/darwin/arm64/quick-latest-mac.yml

# Windows per-machine manifest
curl -fsSL https://desktop.downloads.quick.aws.com/win32/x64/quick-prod-admin.yml

Download the per-machine artifact for each platform. In the following URL patterns, replace version with the version from the manifest.

# macOS .pkg (per-machine, installs to /Applications)
https://desktop.downloads.quick.aws.com/darwin/arm64/quick-prod/Amazon Quick-version-arm64.pkg

# Windows per-machine .exe (installs for all users into Program Files)
https://desktop.downloads.quick.aws.com/win32/x64/quick-prod-admin/Amazon Quick-Admin Setup version.exe

A pre-production beta channel also exists for internal testing. It updates itself automatically and does not publish a public first-time installer, so it is not used for MDM deployment. For the standard download page that individual users use, see Downloading and installing.

Static and version-specific download URLs

The Windows per-machine .exe also has a static download link that always resolves to the current version, so you do not need to fetch the manifest first:

https://desktop.downloads.quick.aws.com/windows/x64/Amazon-Quick-Admin.exe

To pin a specific version, fetch the manifest first to get the exact version string, and then use the version-specific channel URL.

For macOS, download the .pkg in two steps, because the .pkg is published only under its version-specific channel path. Fetch the manifest to get the current version, and then substitute that version into the URL.

Deploying the macOS application with Microsoft Intune

The macOS installer is a signed, notarized component .pkg that installs Amazon Quick.app to the /Applications folder.

On each assigned device, the installation runs silently and the application is installed at /Applications/Amazon Quick.app. To verify the installation on a device, run the following command and confirm that it returns com.aws.QuickWork.mac.

defaults read "/Applications/Amazon Quick.app/Contents/Info" CFBundleIdentifier

Device-side deployment logs are in the /Library/Logs/Microsoft/Intune/ directory.

Deploying the Windows application with Microsoft Intune

The Windows installer is an NSIS .exe. The Microsoft Intune Win32 app type does not accept a raw .exe, so you first wrap the installer into a .intunewin package. Use the Windows app (Win32) app type. The line-of-business app type accepts only .msi, .appx, and .msix files, so it does not apply.

The following table lists the key facts for the per-machine Windows installer.

The Intune Management Extension installs on a device the first time you assign a Win32 application, which can take a few minutes and two device check-ins. To trigger a check-in on a device, go to Settings → Accounts → Access work or school, select your account, and choose Sync. To watch the installation on a device, tail the log with the following PowerShell command.

Get-Content "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log" -Wait -Tail 50

Trusting a corporate certificate authority

If your network inspects encrypted traffic or uses a custom corporate certificate authority (CA), the Amazon Quick desktop application must trust that CA. Otherwise, sign-in and responses can fail on the corporate network. Examples of traffic-inspection proxies include Zscaler and Netskope.

Deploy the CA into the operating system trust store with an MDM certificate profile. The application reads the operating system trust store when it starts, so a CA that you install there is trusted for all of the application's outbound connections. This approach works on both platforms and requires no environment variables, scripts, or certificate file placement.

Advanced: environment variables for mixed toolchains on Windows

The following example install script places the CA bundle at a machine-wide path and sets the environment variables.

@echo off
mkdir "C:\ProgramData\Amazon Quick\certs" 2>nul
copy /Y "%~dp0tls-ca-bundle.pem" "C:\ProgramData\Amazon Quick\certs\tls-ca-bundle.pem"
SETX /M REQUESTS_CA_BUNDLE "C:\ProgramData\Amazon Quick\certs\tls-ca-bundle.pem"
SETX /M SSL_CERT_FILE "C:\ProgramData\Amazon Quick\certs\tls-ca-bundle.pem"
exit /b 0

The NODE_EXTRA_CA_CERTS variable is not consumed by the Amazon Quick agent, so the certificate profile remains the reliable path for the application itself. Use the environment-variable script only if other tooling on the device requires the CA through those variables.

Troubleshooting MDM deployment

The following table describes common issues you might encounter when you deploy the application with an MDM solution, and how to resolve them.