A ready-to-work WorkSpace in minutes, with no tickets.
Add a user to an AD or Entra ID security group. WSM builds the WorkSpace, applies your baseline, checks readiness and emails the user. Need 500 for a new team? Do it in one run.
Stop paying for idle and oversized desktops.
Stop escalating simple tickets.
Stop building WorkSpaces by hand.
WorkSpaces Manager gives your team one console for Amazon WorkSpaces and WorkSpaces Applications across every account and region, so you can reduce administration, automate routine tasks and cut unnecessary spend.
Available on AWS Marketplace · Deployed in your AWS environment · 24×7 support

Once an estate grows, accurate visability becomes more complicated, support tickets need AWS experts, and the bill climbs because of desktops nobody uses. WorkSpaces Manager tackles all three.
Add a user to an AD or Entra ID security group. WSM builds the WorkSpace, applies your baseline, checks readiness and emails the user. Need 500 for a new team? Do it in one run.
Find any user across every account. See latency, CPU and memory history, then reboot, rebuild or shadow a session. Role-based access gives first-line staff control without AWS Console access.
Find unused, orphaned and oversized WorkSpaces. Move each to the cheaper billing mode each month and downgrade or remove desktops automatically under your rules.
More than 300 features have been added from customer requests since 2018. Explore the management, administration, optimisation and automation tools below.
Stop finding out about problems from angry users.
WSM alerts you when a user keeps hitting CPU or memory limits, so you can resize the WorkSpace before they complain.
See 12 hours of latency for any user and tell straight away whether it's their network or the desktop.
Logon, logoff and idle time for every user, the evidence you need to right-size, recharge and remove WorkSpaces with confidence.
See installed applications and their CPU and memory use across the estate, for licence audits, security reviews and troubleshooting.
See where in the world each user connects from, so you can flag unusual access and support compliance checks.
See which WorkSpaces client each user runs and report on everyone who needs to upgrade.
Get warned before a directory runs out of IP addresses, before a rebuild or expansion fails in front of the business.
Split shared WorkSpaces Pools costs by each user's actual time, so every department pays for what it uses.
Last reboot, unused WorkSpaces, patch status and more. Select the results and reboot, delete or change running mode in bulk.
Give your service desk power without giving away the AWS Console.
Choose from more than 15 roles, scoped by region, directory or tag. First-line staff get exactly what they need and nothing more, which cuts both escalations and risk.
Manage WorkSpaces across multiple AWS accounts, regions, domains and forests without switching consoles or logins.
Search by name, email, WorkSpace ID, IP address, OS, directory, bundle or tag, including partial matches. It's the fastest route from phone call to fix.
Open an RDP session or shadow the user's screen straight from their record and fix the issue while they're on the call.
Give a new joiner the same image, apps and performance as a colleague in the same role, with no build checklist and no mistakes.
Allow only approved tags, so cost reports, access roles and automation rules always line up.
Deliver and manage applications with Microsoft Intune, using the tools your team already knows (requires BYOL WorkSpaces).
Every idle or oversized WorkSpace is money you do not need to spend.
WSM compares each user's actual hours with AlwaysOn and AutoStop pricing and switches the WorkSpace automatically. No spreadsheets, no manual review.
Find WorkSpaces unused for any period you choose, then downgrade them to the lowest spec or remove them automatically.
CPU, memory and usage data show which WorkSpaces are overworked and which are oversized. Upgrade or downgrade with one click, or let WSM do it.
Find WorkSpaces with no Active Directory user attached, often leftovers from leavers, and remove the cost.
Twelve months of WorkSpaces spend on one screen, ready for budget reviews and chargeback.
WSM places each new WorkSpace in a directory with free IP capacity, so large rollouts don't stall.
If your team does it every week, WSM can do it for them.
Link a profile to an Entra ID or AD group and every new member gets a WorkSpace automatically. Ideal for new teams, acquisitions and seasonal workers.
Connect WSM to ServiceNow or your HR system, so a joiner, mover or leaver request creates, changes or removes a WorkSpace with no manual handoff.
Set rules to remove WorkSpaces after a set number of unused days or on a contract end date, so you stop paying for people who've left.
WSM detects unhealthy WorkSpaces and reboots them or moves them to a healthy host automatically, so fewer tickets and less downtime.
Wake stopped or suspended WorkSpaces on a schedule, so updates install out of hours and users start the day ready to work.
Provision, rebuild, upgrade, suspend and retire WorkSpaces from one place, with a full record of every change.
Move one or many WorkSpaces from PCoIP to WSP, and back if you need to (WorkSpaces created as WSP cannot move to PCoIP).
Users are reminded automatically before their password expires, which removes one of the most common service desk tickets.
A quick view of where one console for daily management changes the work.
| Task | AWS Console | WorkSpaces Manager |
|---|---|---|
| Manage multiple AWS accounts | Switch accounts and regions one by one | Every account, region and directory in one view |
| Give the service desk access | IAM policies and console access | 30+ ready-made roles, scoped by region, directory or tag |
| Find unused WorkSpaces | Manual checks and exports | Found automatically, then downgraded or removed under your rules |
| Choose AlwaysOn or AutoStop | Manual review per WorkSpace | Switched automatically every month from real usage |
| Onboard a new starter | Manual build and handover | Add to a group; WSM builds, checks and emails the user |
| Troubleshoot a slow desktop | Check CloudWatch metrics separately | Nuvens Advisor with Anomaly detection finds the soiution fast |
| Charge back costs | Build it yourself from billing data | Per-user cost history and Pools billing breakdown |
Usage, cost, performance and patch status for every WorkSpace in every account, on one screen. The WSM Agent captures the detail your team needs. When something needs fixing, the action is on the same page.
Actual WorkSpaces Manager · user activity and controls
Actual WorkSpaces Applications · delivery overviewWorkSpaces Applications, formerly AppStream 2.0, gets the same operational view and support path as your desktops, including single and multi-session fleets.
See WorkSpaces Applications pricing ↗


Replace the ticket, manual build, follow-up email and first-day support call with one automated, audited workflow for Entra ID only and hybrid joined AD environments.
Link an Auto Provisioning profile to an Entra ID or AD group. From then on, joining the group is the only step.
AWS builds the WorkSpace from the right profile, and WSM tracks it and its owner from the first minute.
The user gets clear sign-in instructions by email, with no service desk call needed.
Entra ID only: Autopilot enrols the WorkSpace in Entra ID and Intune. Hybrid: it follows your existing AD join and device management.
Your policies install the required applications, updates, security tools and settings.
WSM checks AWS, Microsoft and agent signals against your readiness rules. Nothing is marked ready until it is.
When every check passes, the user is told their WorkSpace is ready.
See onboarding in progress, get alerted when a check fails and retain an audit record of the result.
Hold the ready email, flag the failed check and alert the team. Retry or remediate where configured.
The user is told their secure, configured WorkSpace is ready to use.
Through a ServiceNow request or by hand. Entra ID only uses an Entra security group. Hybrid replicates the user to an AD auto provisioning group.
WSM spots the new member, matches the group to its predefined profile and builds the WorkSpace. It tracks it and its owner from the first minute.
The user gets clear instructions by email: sign in with your work email and domain password. No service desk call needed.
Hi Jamie, your desktop has been set up. Here is how to sign in for the first time.
WSpdx+R7Q2KDAfter sign-in, the screen stays locked while the WorkSpace joins Entra ID and enrols in Intune.
Intune installs your security tools before the user can reach your network, then the applications they need.
WSM checks with Intune that every required application is installed. Nothing is marked ready until it is.
The ready email is held and the admin is told the Intune configuration failed, so it can be investigated before the user is affected.
When every check passes, the user gets a second email: their WorkSpace is ready and they can begin work.
Everything is installed and checked. You can start work now.
Open WorkSpaceZero-touch onboarding for Amazon WorkSpaces, on Entra ID only and hybrid joined AD.
Start with a 30-day free trial and see what you could save before you pay.
Buy on AWS Marketplace, deploy with CloudFormation and start finding savings the same day. No contract, cancel anytime.
How to start your trial ↗Entra Only Join WorkSpaces Module with Intune and creation monitoring.
Ask about Entra Only ↗Buy through AWS Marketplace, with standard installation, 24×7 support and options for public sector security requirements.
Get a quote ↗Management of WorkSpaces Applications, including Dynamic Apps, with standard installation and 24×7 support.
Start free trial ↗Need something bespoke? We build custom features and integrations for enterprise environments. Talk to us ↗






In 30 minutes, see where unused and oversized WorkSpaces tend to hide, what can be automated and where a trial could show savings.
See how WorkSpaces Manager brings cost, support and automation into one console. 1 min 31 sec · Sound optional