Integrate with Amazon WorkSpaces

Amazon and JumpCloud have partnered to offer a fully managed virtual desktop infrastructure (VDI) service over the web. Using JumpCloud SSO, a JumpCloud-enabled BYOL image and Amazon WorkSpaces Personal, admins can provision persistent virtual devices for users that are accessible from multiple devices or web browsers.

See our blog for more information about our partnership.

Prerequisites

• A JumpCloud tenant and admin account
• JumpCloud SSO Package or higher
• An AWS Identity Center instance and admin account
• AWS IAM Identity Center SSO configured and enabled
• BYOL is enabled for your WorkSpaces account and an AWS KMS server that your personal WorkSpaces can access for Windows 10 and 11 activation
• An Amazon S3 bucket

Installation Overview

1. Create an Amazon WorkSpaces Directory
   • Ensure BYOL is enabled on your account
2. Create JumpCloud Virtual Machine (VM)
   • Download latest Windows ISO
   • Configure JumpCloud VM
   • Run BYOL Checker
3. Create JumpCloud BYOL Image
   • Upload the VHD to an S3 bucket
   • Export VHD to Amazon EC2
   • Import image into WorkSpaces
4. Configure WorkSpaces
   • Create a custom bundle
   • Create JumpCloud workspace(s)
   • Connect JumpCloud user accounts

Creating an Amazon WorkSpaces Directory

1. Open the WorkSpaces console.
2. Go to Directories in the left menu and click Create directory.
3. Select Personal and then scroll down and select Custom.
4. In User identity source, select your IAM Identity Center instance from the dropdown.
5. Enter the following in the Directory information section:
   • Directory name - name of your directory
   • Directory description - add a description
   • VPC - if not already displayed, select it from the dropdown
   • Subnet 1 - select your first subnet from the dropdown menu
   • Subnet 2 - select your second subnet from the dropdown menu
6. Under Configuration, select Enable dedicated WorkSpace.

7. Click Create directory.

Creating the JumpCloud VM

1. Download the latest Windows 11 ISO.

2. Create a new VM with the following:
   • Disk size - 52GB
   • TPM - enabled
   • Checkpoints - disabled
   • Initialize from the ISO
   • Skip naming the computer in the image (if you are making multiple images or all the computers will have the same name)

3. Start the VM and set up Windows 11. During setup, choose:
   • Work/school account
   • Select the domain option
   • Create a local account named WorkSpaces_BYOL and password
   • Save the local admin account info in a secure location, like JumpCloud Password Manager
4. Shut down the VM.
5. In the VM settings, remove the DVD drive.
6. Restart the VM, log in as WorkSpaces_BYOL and password, make sure all the latest Windows updates are installed, and pause Windows Updates, for example, for one week.
7. From the JumpCloud Admin Portal, go to Device Management > Devices >Windows tab and click Add Device.
8. Select Install via Powershell and copy the PowerShell Install Command to the clipboard.

9. On the VM, create a new folder called C:\JumpCloud.
10. In this folder, create a PowerShell script file, for example named install.ps1, and paste the PowerShell Install Command from the previous step into this new file and save it.
11. Start the Task Scheduler as an administrator and create as new task as follows:
    • Give it a name, like Install Jumpcloud
    • Click the Change User or Group button
    • Type in SYSTEM and click Check Names
    • After the name resolves, click OK

12. Select the Triggers tab, add a new trigger and configure as follows:
    • Begin the task - select On an event
    • Log - select Application
    • Source - enter Amazon Workspaces
    • Event ID - enter 1001
    • Click OK

13.  Select the Actions tab, add a new action and configure as follows:
    • Program/script - enter powershell.exe
    • Add arguments(optional) - enter the full path to the installation script created above, i.e., C:\JumpCloud\install.ps1
    • Click OK

14. Download the BYOL Checker script .zip file to your Downloads folder.
15. In your Downloads folder, create a BYOL folder.
16. Extract the files from BYOLChecker.zip and copy them to the Downloads\BYOL folder.
17. Delete the Downloads\BYOLChecker.zip folder so that only the extracted files remain.
18. From the Admin PowerShell, execute the following commands to run BYOL Checker:

19. Follow the prompts to run the checks. Address all the warnings and failed checks.

20. After all the checks are passed in BYOLChecker, click Run Sysprep.
21. Shut down your VM.

Creating a JumpCloud BYOL Image

1. After the VM shuts down, convert your VM to a virtual hard disk (VHD).
2. Upload the JumpCloud VHD to an S3 bucket:

3. Create a new file containers.json with the following structure:

4. Import the JumpCloud VHD into EC2:

5. Monitor the import status:

6. Create the JumpCloud WorkSpace BYOL image:

7. Monitor the JumpCloud WorkSpace BYOL image status:

Configuring WorkSpaces

1. In the WorkSpaces console, create a workspace bundle from the JumpCloud WorkSpace BYOL image.

2. Create a personal workspace from the workspace bundle created above. Ensure you make the following selections:
   • Onboarding options - I know what workspace options I need for my use case
   • Basic details - Personal
   • Bundle - Use your own custom or BYOL bundle and select your bundle from the dropdown
   • Personal WorkSpace directories - select the directory created above.
   • Select users from directory - select the user you want to assign to it.
3. Monitor the state of the created workspace. Once it becomes available, take a note of the Computer Name field.

4. In JumpCloud Admin Portal, verify that the device with the same name appears in the list of managed devices:

5. Connect users to the workspaces:
   • If Self-Service Account Provisioning is disabled, connect the user account to this device and provide the workspace registration code to the user
   • If Self-Service Account Provisioning is enabled, after the user signs in for the first time, the user account gets connected to the device:

7. Repeat the steps to create additional workspaces for other users.

User Sign in Experience

1. After the user launches the Amazon WorkSpaces client and enters their registration code provided by the administrator, they see the sign-in screen:

2. The user clicks Continue to sign in to WorkSpaces and the web browser window pops up. If the user hasn’t logged in to JumpCloud before, they enter their email and click Continue:

3.  Then the user authenticates by entering their password and clicking SSO Login:

4. The user is prompted to navigate back to the Amazon WorkSpaces client application:

5. The Workspace lock screen is displayed:

6. If Self-Service Account Provisioning is enabled and the user hasn’t been connected to the workspace, then the experience is as follows:
   • The user clicks on the lock screen and selects Sign in with JumpCloud
   • If a user is connected to the WorkSpace, their name will appear

7. The JumpCloud login window pops up:

8. After the user authenticates with their JumpCloud credentials, they are prompted to create a Windows Hello PIN:

9. After creating the PIN, the user gets signed in to their new Windows account:

10. Now that the user account is set up, the user is going to use their PIN to sign in: