AWS quick documentation change
Summary
Updated Microsoft Outlook connector documentation to introduce multiple authentication methods (Default OAuth, Custom OAuth, Service-to-Service OAuth), restructured setup steps, and added a section on admin consent requirements for Microsoft 365 tenants.
Security assessment
The changes add detailed documentation about authentication methods including Service-to-Service OAuth for automated workflows and admin consent requirements for third-party app access. This enhances security awareness but doesn't address a specific vulnerability. The additions help users implement appropriate security controls like application permissions and admin consent workflows.
Diff
diff --git a/quick/latest/userguide/microsoft-outlook-integration.md b/quick/latest/userguide/microsoft-outlook-integration.md index 190e1fa66..c458501ae 100644 --- a//quick/latest/userguide/microsoft-outlook-integration.md +++ b//quick/latest/userguide/microsoft-outlook-integration.md @@ -7 +7 @@ -Before you beginConfigure Microsoft EntraSet up the integration in Amazon QuickAvailable actionsManage and troubleshoot +Before you beginConfiguring Microsoft EntraSetting up the connector in Amazon QuickAvailable actionsManage and troubleshootAdmin consent for Microsoft 365 @@ -11 +11 @@ Before you beginConfigure Microsoft EntraSet up the integration in Amazon QuickA -Use the Microsoft Outlook action connector to access Outlook's email, calendar, and contact APIs directly in Amazon Quick through natural language. +With the Microsoft Outlook action connector, you can access Outlook's email, calendar, and contact APIs directly in Amazon Quick through natural language. @@ -13 +13,12 @@ Use the Microsoft Outlook action connector to access Outlook's email, calendar, -Setting up this integration involves two steps. First, you register an application in Microsoft Entra and configure its permissions. Then, you create the integration in Amazon Quick and connect it to your Entra app. For information about the authentication methods that Amazon Quick supports, see [Authentication methods](./quick-action-auth.html). +Amazon Quick supports multiple authentication methods for Microsoft Outlook. Choose the method that best fits your organization's security requirements. + + * **Default OAuth app** – Uses an AWS-managed OAuth application. No additional credentials are needed. Users authenticate directly with their Microsoft account. + + * **Custom OAuth app** – Uses a customer-managed application registered in Microsoft Entra. This option gives your organization full control over the OAuth configuration. Users authenticate on behalf of a signed-in user (delegated permissions). + + * **Service-to-Service OAuth** – Uses client credentials for server-to-server authentication without user interaction (application permissions). Suitable for automated workflows. + + + + +For more information about the authentication methods that Amazon Quick supports, see [Authentication methods](./quick-action-auth.html). @@ -17 +28 @@ Setting up this integration involves two steps. First, you register an applicati -Make sure you have the following before you set up the integration. +Make sure that you have the following before you set up the integration. @@ -21 +32,3 @@ Make sure you have the following before you set up the integration. - * Access to the [Microsoft Entra admin center](https://entra.microsoft.com/) with at least Application Developer permissions. + * For **Custom OAuth app** or **Service-to-Service OAuth** : Access to the [Microsoft Entra admin center](https://entra.microsoft.com/) on the Microsoft website with at least Application Developer permissions. + + * For Amazon Quick subscription requirements, see [Set up integrations in the console](./integration-console-setup-process.html). @@ -23 +35,0 @@ Make sure you have the following before you set up the integration. - * For subscription requirements, see [Set up integrations in the console](./integration-console-setup-process.html). @@ -26,0 +39 @@ Make sure you have the following before you set up the integration. +## Configuring Microsoft Entra @@ -28 +41 @@ Make sure you have the following before you set up the integration. -## Configure Microsoft Entra +If you are using **Default OAuth app** authentication, skip this section and proceed to Setting up the connector in Amazon Quick. @@ -140 +153,32 @@ Client secret value | Certificates & secrets page -## Set up the integration in Amazon Quick +## Setting up the connector in Amazon Quick + +### Connect from the Available tab + +If you want to use Default OAuth app authentication, you can connect directly from the **Available** tab without additional configuration. + + 1. In the Amazon Quick console, choose **Connectors**. + + 2. On the **Available** tab, find **Microsoft Outlook** and choose **Connect**. + + 3. Complete the Microsoft sign-in flow and grant the requested permissions. + + + + +To configure a connector with Custom OAuth app or Service-to-Service OAuth instead, use the **Create for your team** tab as described below. + +### Create from the Create for your team tab + +After you complete any required Entra configuration, create the connector in Amazon Quick. + + 1. In the Amazon Quick console, choose **Connectors**. + + 2. Choose the **Create for your team** tab. + + 3. Find and choose **Microsoft Outlook**. + +###### Note + +If a Microsoft Outlook connector already exists, a dialog appears with your existing connectors. To use an existing connector, choose it. To create a new one, choose **No, create new**. + + 4. Enter a **Name** for your connector. Optionally, choose **\+ Add Description** to add a description. @@ -142 +186 @@ Client secret value | Certificates & secrets page -After you complete the Entra configuration, create the integration in Amazon Quick. + 5. For **Connection type** , choose **Public network**. @@ -144 +188 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 1. In the Amazon Quick console, choose **Integrations**. + 6. For **OAuth Configuration** , choose one of the following authentication methods and configure the required fields. @@ -146 +190 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 2. Choose the **Actions** tab. + 1. For **Default OAuth app** : @@ -148 +192 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 3. Choose **Microsoft Outlook** and choose the Add (plus "+") button. +No additional credentials are needed. Choose **Next** to continue. @@ -150 +194 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 4. Fill in the integration details: + 2. For **Custom OAuth app** (user authentication with delegated permissions), configure the following fields: @@ -152 +196 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Name** – Descriptive name for your Outlook integration. + * **Base URL** (Optional) – The Microsoft Graph API base URL. Example: `https://graph.microsoft.com/v1.0` @@ -154 +198 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Description** (Optional) – Purpose of the integration. + * **Client ID** – The Application (client) ID from your Entra app registration. @@ -156 +200 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 5. Choose your connection type and fill in the connection settings: + * **Client secret** – The client secret value from your Entra app registration. @@ -158 +202 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 1. For **User authentication (OAuth)** , configure the following fields: + * **Token URL** – The token endpoint. Example: `https://login.microsoftonline.com/`{tenant-id}`/oauth2/v2.0/token` @@ -160 +204 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Base URL** – `https://graph.microsoft.com/v1.0` + * **Authorization URL** – The authorization endpoint. Example: `https://login.microsoftonline.com/`{tenant-id}`/oauth2/v2.0/authorize` @@ -162 +206 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Client ID** – Application (client) ID from your Entra app registration. + * **Redirect URL** – Pre-filled with the Amazon Quick callback URL. @@ -164 +208 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Client Secret** – Client secret value from your Entra app registration. + 3. For **Service-to-Service OAuth** (service authentication with application permissions), configure the following fields: @@ -166 +210 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Token URL** – `https://login.microsoftonline.com/`{tenant-id}`/oauth2/v2.0/token` + * **Base URL** (Optional) – The Microsoft Graph API base URL. Example: `https://graph.microsoft.com/v1.0` @@ -168 +212 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Auth URL** – `https://login.microsoftonline.com/`{tenant-id}`/oauth2/v2.0/authorize` + * **Client ID** – The Application (client) ID from your Entra app registration. @@ -170 +214 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Redirect URL** – `https://`{region}`.quicksight.aws.amazon.com/sn/oauthcallback` + * **Client secret** – The client secret value from your Entra app registration. @@ -172 +216 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 2. For **Service authentication** , configure the following fields: + * **Token URL** – The token endpoint. Example: `https://login.microsoftonline.com/`{tenant-id}`/oauth2/v2.0/token` @@ -174 +218,3 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Client ID** – Application (client) ID from your Entra app registration. +###### Note + +The scope for the client credentials token request (`https://graph.microsoft.com/.default`) is set automatically by Amazon Quick. You do not need to configure it manually. @@ -176 +222 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Client Secret** – Client secret value from your Entra app registration. + 7. Choose **Next**. @@ -178 +224 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Token URL** – `https://login.microsoftonline.com/`{tenant-id}`/oauth2/v2.0/token` + 8. If you chose **Default OAuth app** or **Custom OAuth app** , a Microsoft authorization window opens. Review the requested permissions and choose **Accept**. @@ -180 +226 @@ After you complete the Entra configuration, create the integration in Amazon Qui - * **Scope** – `.default` +If you see an error instead of the consent dialog, your organization might restrict third-party app access. See Admin consent for Microsoft 365. @@ -182 +228 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 6. Choose **Create and continue**. + 9. On the **Review** page, review the available actions for the connector. Choose **Next**. @@ -184 +230 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 7. Choose users to share the integration with. + 10. On the **Publish** page, choose who can access the connector. You can enable access for everyone in your organization or search for specific teams or groups. @@ -186 +232 @@ After you complete the Entra configuration, create the integration in Amazon Qui - 8. Choose **Next**. + 11. Choose **Publish**. @@ -193 +239 @@ After you complete the Entra configuration, create the integration in Amazon Qui -After you set up the integration, the following actions are available. +After you set up the connector, the following actions are available. @@ -197,21 +243,21 @@ Microsoft Outlook available actions Category | Action | Description -Email | List User Mails | View emails in a mailbox. -Email | List Folder Messages | View messages in a specific mail folder. -Email | View Email | Get email details by ID. -Email | Send User Email | Send a new email message. -Email | Reply To Email | Reply to an existing email. -Email | Forward User Email | Forward an email to other recipients. -Email | Update Email | Edit email properties. -Email | Delete Email | Remove an email from a mailbox. -Email | Move Email To Folder | Move an email to a different folder. -Email | List Email Attachments | View attachments on an email. -Email | Get Attachment | Get attachment details and content by ID. -Calendar | List Calendar Events | View events on a calendar. -Calendar | List Calendar View | View meetings in a specified date range. -Calendar | Create Calendar Event | Create a new meeting or appointment. -Calendar | Update Calendar Event | Modify an existing event. -Calendar | Delete Calendar Event | Remove an event from a calendar. -Calendar | Find Meeting Times | Suggest meeting times based on attendee availability. -Contacts | List Contacts | View contacts. -Users | List Users | View users in the organization. -Settings | Get Mailbox Settings | Read mailbox configuration. -Places | List Places | View meeting rooms and room lists. +Email | List User Mails | Lists emails in a mailbox. +Email | List Folder Messages | Lists messages in a specific mail folder. +Email | View Email | Retrieves email details by ID. +Email | Send User Email | Sends a new email message. +Email | Reply To Email | Replies to an existing email. +Email | Forward User Email | Forwards an email to other recipients. +Email | Update Email | Edits email properties. +Email | Delete Email | Removes an email from a mailbox. +Email | Move Email To Folder | Moves an email to a different folder. +Email | List Email Attachments | Lists attachments on an email. +Email | Get Attachment | Retrieves attachment details and content by ID. +Calendar | List Calendar Events | Lists events on a calendar. +Calendar | List Calendar View | Lists meetings in a specified date range. +Calendar | Create Calendar Event | Creates a new meeting or appointment. +Calendar | Update Calendar Event | Modifies an existing event. +Calendar | Delete Calendar Event | Removes an event from a calendar. +Calendar | Find Meeting Times | Suggests meeting times based on attendee availability. +Contacts | List Contacts | Lists contacts. +Users | List Users | Lists users in the organization. +Settings | Get Mailbox Settings | Reads mailbox configuration. +Places | List Places | Lists meeting rooms and room lists. @@ -242,0 +289,28 @@ To edit, share, or delete your integration, see [Managing existing integrations] +## Admin consent for Microsoft 365 + +When you use the **Default OAuth app** authentication method, Amazon Quick uses an AWS-managed application to access Microsoft Outlook on behalf of the signed-in user. Most users can complete setup without any extra steps. However, if your Microsoft 365 tenant restricts third-party app access, a Microsoft 365 administrator must grant one-time consent before users can connect. + +If you see an error when you sign in during connector setup, your organization might restrict third-party app access. Share the following information with your Microsoft 365 administrator: + + * **What to do:** Grant admin consent for the Amazon Quick Microsoft Outlook integration application. + + * **Why:** Amazon Quick needs delegated access to Outlook email, calendar, and contact data to perform actions on behalf of users.