AWS quick documentation change
Summary
Major restructuring of SharePoint knowledge base documentation, replacing detailed setup instructions with overview of two authentication methods (user-managed and admin-managed) and moving specifics to separate pages
Security assessment
The change introduces documentation for admin-managed setup with certificate-based credentials and built-in document-level access control (ACL) synchronization, which is a security feature. However, there is no evidence this addresses a specific security vulnerability or incident - it appears to be adding new functionality documentation rather than fixing a security issue. The change mentions that admin-managed setup provides ACL synchronization and permission verification at query time, which enhances security.
Diff
diff --git a/quick/latest/userguide/sharepoint-knowledge-base.md b/quick/latest/userguide/sharepoint-knowledge-base.md index b056c7684..4bbc0d29b 100644 --- a//quick/latest/userguide/sharepoint-knowledge-base.md +++ b//quick/latest/userguide/sharepoint-knowledge-base.md @@ -7 +7 @@ -Before you beginPermissions granted during consentSet up the knowledge base integrationSupported content typesAccess controlsManage and troubleshoot +Prerequisites @@ -11 +11 @@ Before you beginPermissions granted during consentSet up the knowledge base inte -Use the Microsoft SharePoint knowledge base integration to index SharePoint content so that Amazon Quick agents can search and answer questions about it. +Microsoft SharePoint Online is a collaborative platform for building websites, managing document libraries, and organizing content across your organization. With the Amazon Quick SharePoint connector, you can create knowledge bases from your SharePoint content to power AI-driven search and Q&A. @@ -13 +13 @@ Use the Microsoft SharePoint knowledge base integration to index SharePoint cont -Amazon Quick uses a pre-registered multi-tenant application to connect to SharePoint for knowledge bases. You do not need to create an app registration. When a user first connects, Microsoft presents a consent dialog. An administrator can grant consent on behalf of the entire organization, or individual users can consent for themselves. +Amazon Quick supports two authentication methods for connecting to SharePoint Online: @@ -15 +15 @@ Amazon Quick uses a pre-registered multi-tenant application to connect to ShareP -## Before you begin + * **User-managed setup** – You sign in to SharePoint directly to authorize the connection. This is the simplest way to get started. For more information, see [User-managed setup](./sharepoint-kb-user-managed.html). @@ -17 +17 @@ Amazon Quick uses a pre-registered multi-tenant application to connect to ShareP -Make sure you have the following before you set up the integration. + * **Admin-managed setup (service credentials)** – An Entra ID app registration authenticates on behalf of the application using certificate-based credentials. A key benefit of admin-managed setup is built-in document-level access control (ACL). Amazon Quick automatically syncs access control lists from SharePoint and verifies each user's permissions at query time. Users see answers only from documents that they are authorized to access. For more information, see [Admin-managed setup (service credentials)](./sharepoint-kb-admin-managed.html). @@ -19 +18,0 @@ Make sure you have the following before you set up the integration. - * A Microsoft 365 account with SharePoint access. @@ -21,31 +19,0 @@ Make sure you have the following before you set up the integration. - * For subscription requirements, see [Set up integrations in the console](./integration-console-setup-process.html). - - * Your Microsoft administrator may need to grant organizational consent before users can create a SharePoint knowledge base. Administrators can grant organization-wide consent by signing in and choosing **Consent on behalf of your organization** during the integration creation flow. - - - - -###### Note - -When an administrator grants organizational consent, Microsoft Entra automatically creates an Enterprise Application (service principal) in your tenant. You can disable or delete this service principal at any time from **Enterprise applications** in the Microsoft Entra admin center, which immediately revokes all access. - -## Permissions granted during consent - -SharePoint knowledge base – permissions Permission | API | Description ----|---|--- -`Files.Read.All` | Microsoft Graph | Allows the app to read all files that the user can access. -`Notes.Read.All` | Microsoft Graph | Allows the app to read all OneNote notebooks that the user can access. -`User.Read` | Microsoft Graph | Allows users to sign in and allows the app to read the signed-in user's profile. -`Sites.Read.All` | Microsoft Graph | Allows the app to read documents and list items in all site collections. -`offline_access` | Microsoft Graph | Allows the app to maintain access when the user is not actively signed in. -`AllSites.Read` | Office 365 SharePoint Online | Allows the app to read items in all site collections. - -## Set up the knowledge base integration - - 1. In the Amazon Quick console, choose **Integrations**. - - 2. Choose **Microsoft SharePoint** and choose the Add (plus "+") button. - - 3. In the **Create SharePoint knowledge base** dialog, under **Connected account** , choose **Sign in to SharePoint** and complete the Microsoft sign-in and consent flow. - - 4. Under **Create knowledge base** , enter a name and an optional description for your knowledge base. @@ -53 +20,0 @@ SharePoint knowledge base – permissions Permission | API | Description - 5. In the **Content** section, choose **Add content** and select the SharePoint pages, files, or folders you want to index. @@ -55 +22 @@ SharePoint knowledge base – permissions Permission | API | Description - 6. Choose **Create**. +After connecting, Amazon Quick indexes your SharePoint document libraries, sites, lists, and pages into a knowledge base. Your Amazon Quick agents can then search this content and generate answers grounded in your SharePoint data. @@ -56,0 +24 @@ SharePoint knowledge base – permissions Permission | API | Description +## Prerequisites @@ -57,0 +26 @@ SharePoint knowledge base – permissions Permission | API | Description +Before you set up the SharePoint knowledge base integration, make sure that you have the following: @@ -58,0 +28 @@ SharePoint knowledge base – permissions Permission | API | Description + * An AWS account with an active Amazon Quick instance. @@ -60 +30 @@ SharePoint knowledge base – permissions Permission | API | Description -## Supported content types + * A Microsoft 365 account with SharePoint Online access. @@ -62,22 +32 @@ SharePoint knowledge base – permissions Permission | API | Description - * **Document libraries:** Word, Excel, PowerPoint, PDF, OneNote (.one) - - * **Media files:** MP3, MP4, MOV, WMV - - * **Site pages and wiki pages** - - - - -## Access controls - -###### Important - -When Amazon Quick indexes SharePoint content, it does not sync access control lists (ACLs) from SharePoint. All indexed content is accessible to any user who has access to the knowledge base in Amazon Quick, regardless of their permissions in SharePoint. Review which content you include when creating a knowledge base. - -## Manage and troubleshoot - -To edit, share, or delete your integration, see [Managing existing integrations](./integration-workflows.html#managing-existing-integrations). - -For general knowledge base troubleshooting, including sync issues and missing documents, see [Troubleshooting knowledge bases](./troubleshooting-knowledge-bases.html). - -### SharePoint-specific issues + * For subscription requirements, see [Set up integrations in the console](./integration-console-setup-process.html). @@ -85 +33,0 @@ For general knowledge base troubleshooting, including sync issues and missing do - * **Admin consent required** – Some organizations require an administrator to grant consent before individual users can connect. An administrator must sign in and choose **Consent on behalf of your organization** during the consent flow. @@ -87 +34,0 @@ For general knowledge base troubleshooting, including sync issues and missing do - * **Enterprise Application disabled** – If the service principal was previously disabled in **Enterprise applications** in the Microsoft Entra admin center, re-enable it to restore access. @@ -89 +35,0 @@ For general knowledge base troubleshooting, including sync issues and missing do - * **SharePoint throttling** – SharePoint may throttle requests during high usage periods. Retry the sync during off-peak hours. @@ -90,0 +37 @@ For general knowledge base troubleshooting, including sync issues and missing do +For admin-managed setup, additional prerequisites apply. For more information, see [Admin-managed setup (service credentials)](./sharepoint-kb-admin-managed.html). @@ -91,0 +39 @@ For general knowledge base troubleshooting, including sync issues and missing do +###### Tip @@ -92,0 +41 @@ For general knowledge base troubleshooting, including sync issues and missing do +Custom SharePoint domains are supported. If your organization uses a custom domain instead of the default `https://`tenant`.sharepoint.com` format, you can use your custom SharePoint URL when configuring the knowledge base. @@ -102 +51 @@ Action integration -Microsoft Teams integration +User-managed setup