Connecting Amazon Q Enterprise to Microsoft SharePoint On-line utilizing least privilege entry management

Amazon Q Enterprise is a generative synthetic intelligence (AI) assistant that leverages enterprise data and information to empower workers. Microsoft SharePoint Online Many organizations use it as a spot to securely retailer, arrange, share, and entry their inner information. Generative AI may also help workers get solutions to questions, summarize content material, and generate insights from information saved in SharePoint On-line. Amazon Q Enterprise Connectors help you join your SharePoint On-line information to Amazon Q Enterprise functions and get immediate insights out of your information.

On this publish, we present you tips on how to use Amazon Q Enterprise as a knowledge supply with SharePoint On-line to offer solutions, generate summaries, and current insights utilizing least privilege entry management. Best practices recommended by the Microsoft SharePoint Development Support Team.

Answer overview

On this publish, we’ll arrange an Amazon Q Enterprise software that connects to a SharePoint On-line web site utilizing the out-of-the-box Amazon Q Enterprise Connector. Websites.Chosen Software permission scope. Websites.Chosen Permissions are essential as a result of many organizations implement insurance policies that do not permit learn entry to all websites (Websites.Learn.All) or Full Management (Websites.FullControl.All) to any connector.

This resolution strategy respects customers’ present identities, roles, and permissions by enabling id crawling and entry management lists (ACLs) within the Amazon Q Enterprise connector for SharePoint On-line utilizing safe credentials supplied by AWS Secrets and techniques Supervisor. If a consumer doesn’t have permission to entry sure information with out Amazon Q Enterprise, they can’t entry that information utilizing Amazon Q Enterprise. Solely information {that a} consumer has entry to is used to assist consumer queries.

Stipulations

The next conditions are required to deploy the answer:

• An AWS account with an AWS Identification and Entry Administration (IAM) function and consumer with permissions to create and handle the assets and elements required by your software. If you do not have an AWS account, see How do I create and activate a brand new Amazon Net Providers account?
• An Amazon Q Enterprise software. If you have not already set one up, see Creating an Amazon Q Enterprise Software Atmosphere.
• a Microsoft Account If in case you have a SharePoint On-line subscription, you possibly can create and publish an software utilizing the steps described on this article. When you shouldn’t have one, contact your group’s administrator to create a sandbox to your experiments, or Create a new account You could want a trial subscription to finish the steps.
• Microsoft Entra ID Software Websites.FullControl Software stage permissions, consumer ID, and consumer secret. This software will not be utilized by the Amazon Q Enterprise connector, however Websites.Chosen Grant permissions solely to the focused software.

Register a brand new app within the Microsoft Azure portal

To register a brand new app within the Microsoft Azure portal, comply with these steps:

1. Log in Azure Portal Use a Microsoft account.
2. select join.
   1. for titleWithin the Software Identify area, enter the title of your software. TargetAppAmazon Q Enterprise Purposes TargetApp Connects to a SharePoint On-line web site to crawl and index the information.
   2. for Who can use this software or entry this API?select Solely accounts on this organizational listing (<テナント名> solely – single tenant).
   3. select register.
3. Observe down the Software (consumer) ID and the Listing (tenant) ID. overview You will want it later for those who want it TargetApp-ClientId and TenantId.
4. select API Permissions below administration Within the navigation pane.
5. select Including permissions Permits the appliance to learn information in your group’s listing in regards to the signed-in consumer.
   1. select Microsoft Graph.
   2. select Delegated authority.
   3. select Consumer.Learn.All from consumer part.
   4. select GroupMember.Learn.All from Group Members part.
   5. select Websites.Chosen from web site part.
   6. select Including permissions.
6. Within the choices menu (three dots), Take away Permissions.
7. Delete the unique Consumer.Learn – Delegated permission.
8. select Grant admin consent for Default Listing.

9. select Certificates and Secrets and techniques Within the navigation pane.
10. select New consumer secret.
    1. for clarificationand enter an outline.
    2. Please choose a price ExpiredPlease observe that in a manufacturing atmosphere, you must manually rotate secrets and techniques earlier than they expire.
    3. select addition.
    4. Make an observation of the brand new secret worth, you will want it later when requested for the consumer secret (TargetApp-ClientSecret).
11. Choose choices Proprietor Add homeowners for the appliance. Homeowners can handle permissions for the Azure AD software (TargetApp).

Use the Graph API to grant permissions to your software on a SharePoint On-line web site.

On this step, you outline which SharePoint On-line websites you wish to grant entry to. TargetAppAmazon Q Enterprise App TargetApp Connects to a SharePoint On-line web site to crawl and index the information.

On this publish, PostmanTo grant permissions, you utilize a platform to make use of APIs. To grant permissions to a selected SharePoint On-line web site, you want a separate Azure AD software. AdminAppand Websites.FullControl.All authority.

If the conditions should not met AdminAppTo register, please comply with the earlier steps AdminApp and Software PermissionsGrant Websites.FullControl.All Permissions. As acknowledged within the conditions, AdminApp It’s only used to grant entry to the SharePoint On-line web site. TargetApp.

we ClientId and ClientSecret The worth of the AdminApp From Azure AD functions AccessToken worth.

1. Make a POST request utilizing the URL in Postman https://login.microsoftonline.com/{TenantId}/oauth2/v2.0/token.
2. Within the request physique, x-www-form-urlencoded Set the next key-value pairs:
   1. set client_id To AdminApp-ClientId.
   2. set client_secret To AdminApp-ClientSecret.
   3. set grant_type To client_credentials.
   4. set scope To https://graph.microsoft.com/.default.

3. select ship.
4. From the response returned, access_tokenYou may want it while you’re requested for a bearer token in a later step.
5. Use the worth of access_token Grant the permissions from the earlier step TargetApp.
   1. get hold of SiteId Entry the URL of your SharePoint On-line web site (e.g. https://<yourcompany>.sharepoint.com/websites/{SiteName}) in your browser. To entry the positioning, it’s essential to log in to the positioning by coming into legitimate credentials.
   2. Edit and add the URL in your browser’s handle bar /_api/web site/id On the finish of {SiteName} You want this to get the SiteId SiteId Within the subsequent step.

6. Make one other POST request in Postman with the URL https://graph.microsoft.com/v1.0/websites/{SiteId}/permissions. Change {SiteId} within the request URL with the SiteId from the earlier step.

You possibly can repeat this step for every web site you wish to embody within the Amazon Q Enterprise SharePoint On-line connector.

7. select Bearer Token for sort To Approval
8. please fill within the worth access_token from earlier than token.

9. For payload, Dwelling Enter the next JSON code: <<ターゲットアプリクライアントID>> and <<ターゲットアプリ名>> worth):

{
    "roles": [
        "fullcontrol"
    ],
    "grantedToIdentities": [
        {
            "application": {
                "id": "<<TargetApp-clientId>>",
                "displayName": "<<TargeApp-Name>>"
            }
        }
    ]
}

10. select ship To finish the method of granting entry to a SharePoint On-line web site TargetApp An Azure AD software.

Configure the Amazon Q Enterprise SharePoint On-line Connector

To configure the SharePoint On-line connector for the Amazon Q Enterprise software, comply with these steps:

1. Within the Amazon Q Enterprise console, Add a Knowledge Supply.
2. Search and choose Sharepoint.
3. Enter a reputation and outline (optionally available).
4. select SharePoint On-line for Internet hosting Strategies below Supply Settings.
5. Specifies the complete URL of the SharePoint web site that you simply wish to embody in crawling and indexing. A singular web site URL for the SharePoint repository.
   1. The total URL of the positioning https://<yourcompany>.sharepoint.com/websites/anycompanyUse <yourcompany> As a price of area.
6. select OAuth 2.0 authentication for Authentication Technique.
7. Delivering worth TenantId for Tenant ID.

The SharePoint connector requires credentials to connect with the SharePoint On-line web site utilizing the Microsoft Graph API. That is achieved by creating a brand new Secrets and techniques Supervisor secret. These credentials should not used within the entry logs for the SharePoint On-line web site.

8. select Create and add a brand new secret.
9. Enter a reputation to your secret.
10. Enter your username and password SiteCollection The administrator of a web site that’s a part of an Amazon Q repository.
11. Enter the Consumer ID and Consumer Secret you obtained throughout registration. TargetApp Within the earlier step.
12. select maintain.

13. select Create a brand new service function Create an IAM function and enter a reputation for the function.
14. for Sync Varyselect Choose Entity Choose all (or any mixture of things you wish to sync).
15. Choose the sync choice based mostly in your wants (on-demand or at a frequency of your alternative). For this publish, we’ll choose on-demand.
16. select Add a Knowledge Supply.
17. As soon as the information supply is created, Sync now Begin crawling and indexing.

Check the answer

To check the answer, you possibly can add customers and teams, assign subscriptions, and take a look at consumer and group entry inside your Amazon Q enterprise software.

cleansing

If you’re simply experimenting with the steps on this publish, remember to delete the appliance from the Azure portal and delete the Amazon Q software from the Amazon Q console to keep away from incurring any prices.

Conclusion

On this publish, we mentioned tips on how to configure the Amazon Q Enterprise SharePoint On-line connector with least privilege entry management that works with site-level least privilege to securely crawl and index your SharePoint On-line web site content material, and tips on how to protect and implement ACLs whereas responding to consumer conversations.

With Amazon Q Enterprise, organizations can use their present SharePoint On-line information to realize higher insights, generate summaries, and get solutions to pure language queries in a conversational format. By connecting SharePoint On-line as a knowledge supply, workers can use pure language to work together with organizational data and information saved in SharePoint, making it simpler to seek out related data, extract key takeaways, and derive helpful insights. This will considerably enhance productiveness, decision-making, and data sharing inside a company.

Check out the options on this publish and depart your suggestions or questions within the feedback part.

In regards to the Creator

Surendar Gajaveli He’s a Senior Options Architect based mostly in Nashville, Tennessee. He’s a passionate expertise fanatic who enjoys working with shoppers to construct modern options.

Abi Patrolla is a Senior Options Architect based mostly within the New York Metropolis space serving to shoppers with their cloud transformation, AI/ML and information initiatives. As a strategic and technical chief, he advises executives and engineers on cloud methods that drive innovation and optimistic impression.