AWS Builder Center

Builder Center

Running End User Computing workloads with AWS Managed Microsoft AD (Hybrid Edition)

In this post, you'll learn how to deploy these workloads with Hybrid Edition, covering architecture, authentication flows, and best practices.

Shantanu Nitin Padhye

Authors :

Shantanu N Padhye
Asish Ray 
Suhail Fouzan 

Introduction :

Organizations that deploy Amazon WorkSpaces Personal  and Amazon WorkSpaces applications  face a challenge: how to integrate these services with existing on-premises Active Directory environments. With faster cloud adoption, organizations face new challenges to manage user identities, access controls, and group policies across hybrid environments. The solution is to extend your Active Directory domain to AWS and reduce the operational burden of self-managed domain controllers in the cloud.
AWS Managed Microsoft AD (Hybrid Edition)  enables you to extend your existing self-managed Active Directory domain directly into AWS. This approach preserves your domain namespace, security permissions, and operational continuity without the overhead of managing domain controllers. Hybrid Edition lets you authenticate WorkSpaces users against your existing Active Directory, enforce group policies, and centralize identity management across hybrid environments.

Benefits of AWS Managed Microsoft AD (Hybrid Edition)

This solution provides several key benefits:
  • Streamlined integration — Integrates your existing AD with AWS while preserving your identity infrastructure. Maintains full compatibility with standard AD features and AWS applications.
  • Managed scalability — Provides managed infrastructure through AWS. Share directories across accounts and expand as needed while maintaining full AD functionality.
  • Operational control — You retain operational control of your directory while AWS handles infrastructure management and monitoring. You can return to fully self-managed AD if required.
  • Centralized management — Centralizes authentication, group policies, and domain trust relationships across hybrid environments. Keeps your existing AD forest name and organizational structure intact.

Solution overview

AWS Managed Microsoft AD (Hybrid Edition) supports deployment of Amazon WorkSpaces Personal with AWS Directory Service AD Connector and Amazon WorkSpaces applications.
Figure 1: Architecture for End User Computing workloads with AWS Managed Microsoft AD (Hybrid Edition)
Architecture_Diagram
Architecture_Diagram

Understanding the architecture

This reference architecture deploys End User Computing workloads with AWS Managed Microsoft AD (Hybrid Edition). It spans your corporate data center and AWS cloud infrastructure.
The solution uses two VPCs in a single AWS Region, connected to on-premises via VPN or AWS Direct Connect. This architecture adapts to a single VPC, multiple VPCs, or your existing VPC structure.
VPC 1 hosts AWS Managed Microsoft AD (Hybrid Edition). It establishes bidirectional AD replication with your on-premises domain controllers. The managed service automatically synchronizes security principals, group policies, and organizational units between environments. Amazon EC2 instances deployed as member servers in this VPC can be domain-joined for additional compute resources.
VPC 2 is dedicated to End User Computing workloads. It contains the AWS AD Connector along with Amazon WorkSpaces and WorkSpaces applications. This separation provides architectural flexibility while maintaining centralized identity management. You can also deploy all components within a single VPC based on your networking requirements.

Active Directory Sites and Services configuration

AWS Managed Microsoft AD (Hybrid Edition) automatically creates a dedicated site in Active Directory Sites and Services. This site uses the naming format <directory-id>-<region> (for example, d-1234567890-us-east-1). This configuration is critical for optimizing authentication traffic and achieving resilience.
Configure additional subnets used for WorkSpaces and WorkSpaces applications under the same AWS site. This routes authentication requests to AWS-hosted domain controllers, eliminating VPN or Direct Connect traversal to on-premises.
This design provides several key benefits:
  • Reduced latency — Authentication requests stay within the AWS network, providing faster response times for end users.
  • Improved resilience — If on-premises connectivity fails, AWS domain controllers independently handle authentication. End-user sessions remain unaffected.
  • Cost optimization — Keeping authentication traffic within AWS reduces data transfer costs for cross-premises traffic over VPN or Direct Connect.
  • Optimized replication efficiency — WorkSpaces subnets under the AWS site authenticate locally. This reduces replication latency and bandwidth for Group Policy updates and password changes.
  • Simplified troubleshooting — Clearly defined AWS sites simplify troubleshooting authentication and replication issues for End User Computing workloads.

Organizational unit structure

WorkSpaces Personal

Create a dedicated organizational unit (OU) for WorkSpace computer objects. By default, machine accounts are placed in the Computers OU of the directory your AD Connector connects to. You can select a different target OU from the WorkSpaces console under Target domain and organizational unit in your directory settings.
Note: You can select only one OU per directory. Existing WorkSpaces must be rebuilt to move to a newly selected OU.

WorkSpaces applications

Create a separate dedicated OU for fleet computer objects. The service account used for domain join operations requires the following minimum OU permissions:
  • Create Computer Object
  • Change Password
  • Reset Password
  • Write Description
As a best practice, use a service account with only the minimum privileges necessary.
Using dedicated OUs for each workload type simplifies Group Policy application and provides clear organizational boundaries for your End User Computing resources.

Prerequisites

You'll need the following to deploy End User Computing workloads with AWS Managed Microsoft AD (Hybrid Edition):
  • An active AWS Managed Microsoft AD (Hybrid Edition) directory
  • IAM permissions to create and manage AWS Directory Service, Amazon WorkSpaces, and WorkSpaces applications resources
  • Network connectivity between VPCs (if deployed in different VPCs) via VPC peering, AWS Transit Gateway, or shared VPC
  • VPN or AWS Direct Connect connection between your on-premises environment and AWS
  • Dedicated OUs for Amazon WorkSpaces Personal and WorkSpaces applications fleet instances

Network requirements

Configure network and security groups to allow Active Directory traffic between the End User Computing workloads VPC and the AWS Managed Microsoft AD domain controllers.
Refer to the AWS WorkSpaces documentation  for the complete list of required ports and protocols.

Deploying Amazon WorkSpaces Personal

Amazon WorkSpaces Personal provides persistent virtual desktops for end users. It integrates with your Active Directory through AD Connector.

Requirements

WorkSpaces Personal requires AD Connector to proxy authentication requests between WorkSpaces and AWS Managed Microsoft AD (Hybrid Edition). For detailed steps and prerequisites, refer to the AD Connector prerequisites documentation .

Deployment overview

To deploy WorkSpaces Personal with AWS Managed Microsoft AD (Hybrid Edition):
Create an AD Connector and register with Amazon WorkSpaces
Follow the steps in the AWS documentation to create an AD Connector . Once the AD Connector status shows Active, register it with Amazon WorkSpaces.
Important: When configuring DNS IP addresses during AD Connector setup, use the IP addresses of your AWS Managed Microsoft AD (Hybrid Edition) domain controllers. You'll find these in the Directory Service console under your Hybrid Edition directory details.

Authentication flow

When users log in to their WorkSpaces:
  1. Users launch the WorkSpaces client and enter their domain credentials.
  2. AD Connector forwards the authentication request to AWS Managed Microsoft AD (Hybrid Edition) domain controllers in the AWS VPC.
  3. AWS Managed Microsoft AD validates the credentials against replicated directory data synchronized from on-premises.
  4. Upon successful authentication, users access their persistent WorkSpace desktop. The desktop is domain-joined and applies Group Policy Objects from Active Directory.
  5. Users have full domain context, including access to mapped drives, printers, and domain resources.

Deploying Amazon WorkSpaces applications

Amazon WorkSpaces applications integrate directly with AWS Managed Microsoft AD (Hybrid Edition). Configure your VPC DHCP option set with the Hybrid Edition domain controller IPs. This enables automatic domain-join for fleet instances.

Authentication flow

WorkSpaces applications provide a different authentication model compared to WorkSpaces Personal:
  1. Fleet instances join the AWS Managed Microsoft AD domain during launch and remain persistently joined.
  2. Users access applications through streaming URLs or SAML 2.0 federation with their identity provider.
  3. When a streaming session starts, the fleet instance authenticates the user against AWS Managed Microsoft AD using their domain credentials.
  4. Group Policy Objects from Active Directory are automatically applied to the fleet instance, enforcing organizational policies.
  5. Users interact with applications running on domain-joined fleet instances, with full access to domain resources such as file shares and databases.
AWS-mapped subnets allow local domain operations through AWS Managed Microsoft AD. This reduces cross-premises reliance and enhances session performance and resilience.

Monitoring and troubleshooting

  • Use Amazon CloudWatch to monitor AWS Managed Microsoft AD (Hybrid Edition) health metrics, authentication success rates, and connection status.
  • Configure Amazon SNS notifications for AD Connector to receive alerts for directory status changes.
  • Monitor WorkSpaces applications fleet usage metrics and session performance through Amazon CloudWatch.
  • Configure Amazon VPC Flow Logs to troubleshoot connectivity issues between VPCs.
  • Monitor Active Directory replication health between on-premises and AWS domain controllers.
  • Review AWS Directory Service event logs regularly for security and operational insights.

Cleanup

Before deleting your AWS Managed Microsoft AD (Hybrid Edition) directory, delete all Amazon WorkSpaces Personal desktops and WorkSpaces applications associated with it.

Delete WorkSpaces Personal

  1. In the Amazon WorkSpaces console, select and delete all WorkSpaces .
  2. After deletion completes, deregister the AD Connector directory from WorkSpaces.
  3. Delete the AD Connector directory .

Delete WorkSpaces applications

  1. In the WorkSpaces applications console, disassociate and delete all stacks.
  2. Stop and delete all fleets.
  3. Delete the Active Directory configuration.
For detailed steps, see cleanup resources in Amazon WorkSpaces applications .

Delete AWS Managed Microsoft AD (Hybrid Edition)

  1. In the AWS Directory Service console, select your Hybrid Edition directory.
  2. Choose Actions, then choose Delete.
  3. Confirm the deletion by entering the directory ID.
For detailed steps, refer to deleting a hybrid directory documentation .
Note: Deleting the Hybrid Edition directory in AWS doesn't affect your on-premises Active Directory domain. Your self-managed AD infrastructure remains intact and operational.

Conclusion

AWS Managed Microsoft AD (Hybrid Edition) extends your on-premises Active Directory to support WorkSpaces Personal and WorkSpaces applications. This reduces the operational overhead of managing cloud domain controllers while maintaining centralized identity management across your hybrid environment.
The solution offers two integration patterns. WorkSpaces Personal uses AD Connector as a proxy. WorkSpaces applications connect directly to Managed Microsoft AD. Both patterns let users access virtual desktops and applications with existing domain credentials — while maintaining Group Policy enforcement and centralized identity management.
To get started, explore these resources:
# end-user-computing# amazon-workspaces# amazon-appstream# active-directory# aws-solutions
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article