Desktop app: "You don't have permission to manage brand assets" for an admin with no custom permission restrictions

Q&A
, ,
1

Hi all,

Has anyone got brand assets working in the Quick desktop app? We’re stuck on a permission error we can’t explain.

Setup: Enterprise edition in us-east-1, with IAM Identity Center. Desktop sign-in uses enterprise SSO through the desktop extension, with an OIDC IdP. The user is on Windows.

What happens: an ADMIN_PRO user opens Customize → Brand assets, tries to create a brand, and gets: “You don’t have permission to manage brand assets. Ask your account administrator for access.”

What we’ve checked:

  • The user is ADMIN_PRO, active, and signed in through SSO to our enterprise account (not a social login).
  • Under Custom permissions → Check permissions, no user, role or account default profile applies to him, and the Effective permissions section lists no restrictions.
  • Our only profile is assigned to the Author role and only restricts a few BI capabilities.
  • Signing out of the app completely and back in made no difference.

The docs say “Create and update brand kits” is allowed for all users unless an admin turns it off. Is there a prerequisite or setting we’re missing? Or is the feature still rolling out to some accounts or Regions?

Thanks!

2

Hi @salavessa and welcome to the community!

I went through the brand assets documentation, and it sounds like you’ve already covered the documented prerequisites. Brand assets need Enterprise edition, users need to sign in with your organization’s credentials, and they need access to create Word documents and PowerPoint presentations in Quick. For not being able to create a brand, the doc’s troubleshooting step is to have an admin check whether the Create and update brand kits capability is turned off for that user, and your Check permissions results suggest it isn’t. On the rollout question, the October 9 launch announcement says brand assets are generally available in the Quick desktop app, and it doesn’t mention any Region limits.

Since everything on the documented side checks out, I’d recommend opening a case with AWS Support so they can look into it from the account side. (Case management - AWS Support).

Hope this gets resolved and feel free to keep the community updated!

3

I was encountering the same issue. I was able to resolve this by adding a Custom Permission set.

4

A Custom Profile associated with the Admin + Admin Pro roles did the trick!
Thank you!