Quick answer
Amazon WorkSpaces Applications agent access is generally available. AWS’s original May 5, 2026 launch post was updated July 1 to record the move from public preview to GA. The feature gives an agent a managed WorkSpaces Applications streaming session and an AWS-hosted Model Context Protocol service for desktop input, screenshots, and optional forwarded tools.
GA describes the service lifecycle, not the safety of a particular automation. A desktop agent can click the wrong control, act under the wrong application identity, expose screenshot data, or repeat a consequential action. Approve a workflow only after end-to-end identity, least privilege, human control, audit, accuracy, and recovery tests.
What the managed surface provides
| Surface | AWS-managed capability | Customer decision |
|---|---|---|
| Desktop session | WorkSpaces Applications fleet and stack | Image, applications, capacity, network, patching, licenses |
| Agent connection | Managed MCP service over Streamable HTTP | Client, credentials, session issuance, retries, lifecycle |
| Interaction | Computer input and computer vision | Which capabilities are enabled and when writes require approval |
| Identity | SigV4-signed MCP request; streaming URL or SAML session path | Caller ownership, IAM scope, application login, tenant separation |
| Evidence | CloudTrail events, CloudWatch metrics, optional S3 screenshots | Trail data events, retention, redaction, access, alerts, review |
| Human control | VIEW_ONLY or VIEW_STOP observer modes | Who can watch or stop, response time, escalation, restart policy |
The MCP server is managed; the agent framework and business workflow are not automatically managed by this feature. AWS’s sample uses Strands Agents with Claude Computer Use through Amazon Bedrock, but the service is not limited to that sample architecture.
Current service limits
AWS documentation currently requires an active Always-On or On-Demand fleet, an associated stack, and the latest WorkSpaces Applications Agent. It lists these limitations:
- only Windows Server images;
- no VPC endpoints for agent access;
- no multi-session fleets;
- no Elastic fleets;
- one agent connection per unique session.
Computer input and computer vision are configured at stack level, and at least one must be enabled. The documented screen resolution is 1280×720 with PNG or JPEG captures. Recheck the live guide before designing around any of these limits.
Identity is layered
Every managed MCP request must be SigV4-signed with IAM credentials for the agentaccess-mcp service. A non-domain-joined fleet also passes a streaming URL; a domain-joined fleet uses a signed SAML assertion and requires certificate-based authentication. Neither method automatically logs the agent into the desktop application or authorizes a business transaction.
Map these separately: orchestration caller, IAM principal, streaming-session user, Windows or directory identity, application account, model identity, forwarded MCP identity, and approving human. A valid connection at one layer must not silently confer authority at another.
The MCP, IAM, CloudTrail, and CloudWatch guide provides the control map. The computer vision and screenshot audit guide covers visual data and human observation.
A safe GA rollout
- Choose one read-mostly legacy workflow with a deterministic accepted outcome.
- Create a dedicated image, fleet, stack, network boundary, agent identity, and application account.
- Enable only the interaction modes the task needs.
- Configure CloudTrail data events, CloudWatch alerts, and protected screenshot storage before live use.
- Add immutable approvals for submissions, messages, orders, account changes, and other consequential actions.
- Test UI changes, pop-ups, latency, disconnects, session expiry, duplicate attempts, and stop behavior.
- Reconcile the system of record after every ambiguous result.
- Roll out to a limited cohort with a cost cap and named operator.
Use the AWS agent desktop readiness checklist to record the evidence. Compare architecture options in desktop vs API vs browser automation.
Frequently asked questions
Is WorkSpaces agent access GA?
Yes. AWS updated the launch post on July 1, 2026 to say it moved from public preview to GA.
Is the MCP server managed?
Yes. AWS hosts the MCP server; your team still operates the agent, identities, workflow logic, and downstream controls.
Can an agent use any desktop application safely?
No. Technical access is not proof of correctness, authorization, compliance, or recoverability.
Official sources
- AWS: WorkSpaces agent access GA announcement
- AWS: agent access overview
- AWS: agent access capabilities and limits
- AWS Samples: WorkSpaces agent access
Source check: August 12, 2026. Recheck lifecycle, supported fleets and regions, interaction features, pricing, IAM, MCP behavior, and service limits before deployment.