AWS amazonq documentation change
Summary
Expanded prerequisites and added detailed integration steps for Microsoft Outlook Add-in, including IAM role requirements, tenant ID configuration, and admin console procedures
Security assessment
Added documentation about IAM roles, trust policies, and admin permissions required for integration, which are security-related configurations but do not indicate a specific security vulnerability being addressed. The changes focus on proper setup procedures rather than patching weaknesses.
Diff
diff --git a/amazonq/latest/qbusiness-ug/configuring-integration-msoutlook.md b/amazonq/latest/qbusiness-ug/configuring-integration-msoutlook.md index 2efba8b0e..54a36e84b 100644 --- a//amazonq/latest/qbusiness-ug/configuring-integration-msoutlook.md +++ b//amazonq/latest/qbusiness-ug/configuring-integration-msoutlook.md @@ -4,0 +5,2 @@ +Prerequisites Integrating + @@ -26 +28,85 @@ - * [Prerequisites for integrating the Amazon Q Microsoft Outlook Add-in ](./integration-msoutlooks-prerequisites.html) + * Prerequisites for integrating the Amazon Q Microsoft Outlook Add-in + + * Integrating Microsoft Outlook with the Amazon Q Business Add-in + + + + +## Prerequisites for integrating the Amazon Q Microsoft Outlook Add-in + +As admins, before you can integrate the Amazon Q Business Microsoft Outlook (Outlook) Add-in, you must complete the following steps. + + 1. You must have a Microsoft 365 Business subscription and be a _Global Admin_ or someone with administrative permissions, specifically `AppCatalog`.`ReadWrite`. `All`. + + 2. You need your Microsoft 365 tenant ID. For more information, see [How to find your tenant ID - Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) in the _Microsoft Learn portal_. + + 3. [Get started with Amazon Q Business](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/getting-started.html) + + 4. [Create an IAM Identity Center-integrated application](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-application.html) and create your Amazon Q Business web experience. + +###### Note + +[IAM federated application environments](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-application-iam.html) do not support integrations with Outlook. + + 5. Add the two IAM roles and trust policies for adding integrations. For more information, see [IAM roles and trust policy for your integrations](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/amazon-q-business-integrations-iam.html). + + 6. To use this feature, you must enable **Allow end users to send queries directly to the LLM** in your Admin controls and guardrails. For more information, see the [Response settings](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails-global-controls.html#guardrails-global-response) topic in [Admin controls and guardrails](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails.html) and [`chatMode`](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_ChatSync.html#qbusiness-ChatSync-request-chatMode) if you are configuring programmatically. + + + + +## Integrating Microsoft Outlook with the Amazon Q Business Add-in + +To use the Amazon Q Business Add-in for Microsoft Outlook, you must allow it to connect to your Amazon Q Business application environment and web experience. + +###### Note + +This integration can only be added using the Amazon Q Business console. + +### Using the console + + 1. Sign in to the Amazon Q Business console. + + 2. Choose **Applications** , then select the name of your application environment from the list. + + 3. Choose **Integrations** under **Enhancements**. + + 4. Choose **Add integration** from the **Integrations** section on the main page. + + 5. Choose **Microsoft Outlook** as your integration. + + 6. On the **Add Outlook integration page** , enter the **Name** of your integration. This is the display name for the integration resource in AWS. + + 7. Add a **description** (optional). + + 8. In the **Workspace** section, enter your Microsoft **Tenant ID**. This can be found in the _Microsoft Entra Admin Center_. For more information, see [How to find your tenant ID - Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) + + 9. Choose the type of **Service access** method that you want the Outlook integration to use as authorization while accessing your service. You can **Create a new service role** or **Use an existing service role**. For more information, see [IAM role for allowing the integration to call Amazon Q Business on your end user's behalf](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/amazon-q-business-integrations-iam-allow-integration-access.html). + + 10. Choose the **Access management access** for the Outlook integration to authorize to connect to IAM Identity center. For more information, see [IAM role for allowing Amazon Q Business to monitor the resources that the integration creates in your account](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/amazon-q-business-integrations-iam-allow-qbusiness-monitor.html). + + 11. Optionally, add any **Tags** that are relevant for this Teams integration. + + 12. Choose **Add integration**. + + 13. Once you have added the integration, Amazon Q will deploy your integration. You will see that update on the **Integration details page**. + +Once the integration is _deployed_ , choose the name of your Outlook integration from the list of integrations in the **Integrations** section. + + 14. Copy the **Manifest URL** in the **Integration details** section. + +###### Note + +You will now continue the remainder of this procedure within the _Microsoft 365 admin center_. + + 15. In the Microsoft 365 admin center, choose **Integrated apps** from the left navigation and choose **Upload custom apps** This will open the **Deploy New App** page. + + 16. Choose **Office Add-in** as your App type. + + 17. Paste the manifest URL link you copied in the **Provide link to manifest file** and choose **Validate**. + + 18. Choose the users you want to add in the **Add users** section. + + 19. Choose **Accept permissions** in the **Accept permissions requests** section and deploy the Add-in. Once deployment is completed, you users will be able to install the Amazon Q Business Add-in in their Microsoft Outlook. + +###### Note @@ -28 +114 @@ - * [Integrating Microsoft Outlook with the Amazon Q Business Add-in](./integrating-integration-msoutlook.html) +Authentication may be required. @@ -41 +127 @@ Microsoft Outlook -Prerequisites +Using