Deploy Amazon WorkSpaces across Regions with Entra ID and IAM Identity Center

This article explains how to deploy Amazon WorkSpaces Personal across multiple AWS Regions while maintaining centralized identity management with Microsoft Entra ID using IAM Identity Center multi-Region replication.

• Enable a primary IAM Identity Center instance and configure SAML/SCIM synchronization with Microsoft Entra ID
• Create a customer-managed multi-Region KMS key for encrypting identity data across Regions
• Replicate IAM Identity Center to target Regions for local authentication without cross-Region dependencies
• Configure Microsoft Entra ID application registration and Windows Autopilot for automatic device enrollment
• Store Entra ID credentials in AWS Secrets Manager with regional KMS encryption
• Create WorkSpaces directories in each Region connected to local Identity Center replicas
• Each Region operates independently; primary outage pauses identity changes but doesn't affect existing authentication

This architecture enables globally distributed WorkSpaces deployments with simplified identity management, regional resilience, and full compliance auditability through customer-managed encryption keys.