AWS quick medium security documentation change
Summary
Updated documentation for Amazon Quick Outlook extension from Legacy to Preview version. Removed legacy configuration steps and added new deployment procedures, permission requirements, and security considerations for the preview extension.
Security assessment
Added explicit security warnings about AI executing code in Outlook sandbox and potential mistakes. Detailed required Graph API permissions (Mail.ReadWrite, Calendars.ReadWrite etc.) and emphasized Human-in-the-Loop confirmation for email/calendar actions. Documented tenant-wide admin consent process which involves sensitive permissions delegation.
Diff
diff --git a/quick/latest/userguide/outlook-extension.md b/quick/latest/userguide/outlook-extension.md index 1e1d7f4b7..b2773b485 100644 --- a//quick/latest/userguide/outlook-extension.md +++ b//quick/latest/userguide/outlook-extension.md @@ -7 +7 @@ -Outlook prerequisitesConfigure Outlook extension +Outlook prerequisitesOutlook permissionsDeploy Outlook extension @@ -9 +9 @@ Outlook prerequisitesConfigure Outlook extension -# Amazon Quick Microsoft Outlook extension (Legacy) +# Amazon Quick Microsoft Outlook extension (Preview) @@ -13 +13 @@ Outlook prerequisitesConfigure Outlook extension -This is the legacy version of the Microsoft Outlook extension. We recommend using the new [Amazon Quick Microsoft Outlook extension (Preview)](./outlook-extension-preview.html) for new deployments. +This extension is currently available as a preview. During the preview period, the extension is fully functional for end users and production workloads. Administrative features such as centralized deployment controls and usage monitoring are being developed and will be available when the extension becomes generally available. Functionality and features may change during the preview period. We recommend using this extension instead of the legacy Microsoft Outlook extension for new deployments. @@ -15 +15 @@ This is the legacy version of the Microsoft Outlook extension. We recommend usin -The Quick extension for Microsoft Outlook integrates AI-powered assistance directly into your email workflows. Users can access Quick capabilities within Outlook to enhance their email communication and productivity without switching between applications. +The Quick extension for Microsoft Outlook integrates AI-powered assistance directly into your email workflows. Users can leverage Quick within Outlook to streamline their inbox and calendar management, draft contextual emails using their Quick data, and perform external actions without switching applications. @@ -19 +19 @@ The Outlook extension enables users to: - * Summarize emails for quick understanding. + * Prioritize and organize their inbox. @@ -21 +21 @@ The Outlook extension enables users to: - * Draft contextual responses with AI assistance. + * Search for relevant email content for a topic using natural language. @@ -23 +23 @@ The Outlook extension enables users to: - * Use actions from action connectors configured in Amazon Quick. + * Schedule meetings and manage their calendars. @@ -25 +25 @@ The Outlook extension enables users to: - * Access any company knowledge sources added to your Amazon Quick instance from within Microsoft Outlook. + * Summarize emails and draft contextual responses using Quick data. @@ -26,0 +27 @@ The Outlook extension enables users to: + * Access their enterprise data and perform actions in external applications. @@ -30,23 +30,0 @@ The Outlook extension enables users to: -###### Important - - * The Amazon Quick customer integrating Microsoft Outlook must have a paid Microsoft Outlook organization with an _M365 subscription for their organization_. - - * Amazon Quick does not use your user data for service improvement or for training its underlying large language models (LLMs). - - - - -###### Topics - - * Prerequisites for Microsoft Outlook extension - - * Configure Microsoft Outlook extension access - - - - -## Prerequisites for Microsoft Outlook extension - -Before configuring access to the Amazon Quick extension to Microsoft Outlook, administrators must complete the following steps: - - 1. Have a Microsoft 365 Business subscription and be a Global Admin or have administrative permissions (specifically `AppCatalog.ReadWrite.All`). @@ -54 +32 @@ Before configuring access to the Amazon Quick extension to Microsoft Outlook, ad - 2. Have a Amazon Quick instance. +The Amazon Quick Outlook extension is available within Amazon Quick to all eligible users by default and requires no administrative setup for user access if users can access the Microsoft Outlook app store. Users can search for Amazon Quick in the Microsoft Outlook app store or visit the [Quick for Outlook Microsoft store page](https://marketplace.microsoft.com/en-us/product/WA200010695) to add the extension. @@ -56,23 +34 @@ Before configuring access to the Amazon Quick extension to Microsoft Outlook, ad - 3. Your Microsoft 365 tenant ID. You can find this by going to the Azure portal > **Azure Active Directory** > **Properties** , or by using PowerShell. For detailed steps, see [How to find your tenant ID - Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) in the Microsoft Learn portal. - - - - -If you configured the authentication to connect to Amazon Quick with IAM Identity Center, complete the following additional steps: - - 1. Ensure you have an IAM Identity Center instance enabled on your AWS account. - - 2. If you are connecting an external IAM provider to IAM Identity Center, ensure that every user under your IAM provider configuration has an email associated with them. - - 3. If you are using Entra ID, set up SCIM identity propagation between the Microsoft Entra ID instance and IAM Identity Center. For detailed steps, see [Configure SAML and SCIM with Microsoft Entra ID and IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html). - - - - -## Configure Microsoft Outlook extension access - -As an administrator, you must allow the Amazon Quick Microsoft Outlook extension to connect to your Amazon Quick application environment. You can use the Amazon Quick console to manage extension access configurations. - -### User attribute mapping - -When you configure a Microsoft Outlook extension, user identity is mapped by default using the following attributes: +###### Important @@ -80 +36 @@ When you configure a Microsoft Outlook extension, user identity is mapped by def - * **Amazon Quick user attribute** \- Email address is used to map Amazon Quick users to their corresponding Microsoft 365 accounts. The system uses the email address to establish the connection between user identities. + * The Amazon Quick Outlook extension uses generative AI to create and execute code within your Outlook application sandbox to help you perform your Outlook tasks. AI can make mistakes and perform inaccurate actions within your Outlook mailbox. @@ -82 +38 @@ When you configure a Microsoft Outlook extension, user identity is mapped by def - * **M365 Office add-in user attribute** \- User Principal Name (UPN) is used to match against Microsoft 365 user accounts. Users need to use the User Principal Name (UPN) to sign in to Microsoft 365. Email address that works on both cloud and on-premise systems. + * Amazon Quick does not use your user data for service improvement or for training its underlying large language models (LLMs). @@ -87 +43 @@ When you configure a Microsoft Outlook extension, user identity is mapped by def -These default mappings ensure secure and accurate user identification across both platforms without requiring additional configuration. +The following procedures are for IT administrators who want to automatically deploy the Amazon Quick Outlook extension across their organization on behalf of their users. @@ -91,7 +47 @@ These default mappings ensure secure and accurate user identification across bot - * Add Microsoft Outlook extension access for accounts using IAM Identity Center - - * Add Microsoft Outlook extension access for accounts using other authentication methods - - * Edit Microsoft Outlook extension access - - * Delete Microsoft Outlook extension access + * Prerequisites for deploying the Microsoft Outlook extension to your organization @@ -98,0 +49 @@ These default mappings ensure secure and accurate user identification across bot + * Microsoft Outlook extension permissions @@ -99,0 +51 @@ These default mappings ensure secure and accurate user identification across bot + * Deploying the Microsoft Outlook extension to your organization @@ -102 +53,0 @@ These default mappings ensure secure and accurate user identification across bot -### Add Microsoft Outlook extension access for accounts using IAM Identity Center @@ -104 +54,0 @@ These default mappings ensure secure and accurate user identification across bot -Configuring extension access with IAM Identity Center requires completing steps specific to your identity provider (Entra ID or Okta) followed by common setup steps in AWS. @@ -106 +56 @@ Configuring extension access with IAM Identity Center requires completing steps -#### Configure IAM Identity Center with Entra ID +## Prerequisites for deploying the Microsoft Outlook extension to your organization @@ -108,9 +58 @@ Configuring extension access with IAM Identity Center requires completing steps -Follow these steps only if you are using IAM Identity Center with Entra ID to set up and configure an Azure tenant on your Microsoft Azure portal: - -###### To set up an Azure tenant - - 1. In the Azure account, create a new app registration. - - 1. Go to **App registrations**. - - 2. In the **App registrations** screen, choose **New registration**. Under the **Supported account types** option, choose **Accounts in this organizational directory only (Personal use only - Single tenant)**. Once finished, choose **Register**. +Before configuring access to the Amazon Quick extension to Microsoft Outlook, administrators must complete the following steps: @@ -118 +60 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 3. Note the client ID. You will need this later. + 1. Have a Microsoft 365 Business subscription and be a Global Admin or have administrative permissions (specifically `AppCatalog.ReadWrite.All`). @@ -120 +62 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 4. Create a client secret for the app registration and keep note of it. You will need this later. + 2. Have an Amazon Quick instance. @@ -122 +64 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 2. Add callback URLs for each Region in which your Outlook extension will be installed. + 3. Grant tenant-wide admin consent for Microsoft Graph permissions. This allows the extension to access inbox, calendar, and contact data for all users in your organization. Without these permissions, the extension can only respond to questions about the currently open email thread. For instructions, see Grant tenant-wide admin consent. @@ -124 +65,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 1. Navigate to the app registration's **Authentication** tab. @@ -126 +66,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 2. Choose **Platform Configurations** , **Add a platform**. @@ -128 +67,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 3. Choose **Web**. @@ -130 +69 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 4. Compose a callback URL using the following format, replacing `your-region` with your Amazon Quick instance Region. The Outlook extension supports the following Regions: `ap-southeast-2`, `eu-west-1`, `us-west-2`, and `us-east-1`. +## Microsoft Outlook extension permissions @@ -132 +71 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - qbs-cell001.dp.appintegrations.your-region.prod.plato.ai.aws.dev/auth/idc-tti/callback +The Amazon Quick Outlook extension uses the `ReadWriteMailbox` Office JavaScript API permission level. This is an Office add-in manifest permission, not a Microsoft Graph API scope. @@ -134 +73 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 5. Insert the callback URL as the redirect URI and choose **Configure** when done. +The default app capabilities for the Outlook add-in are: @@ -135,0 +75 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se + * Can read and make changes to your document @@ -136,0 +77 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se + * Access your profile information such as your name, email address, company name, and preferred language @@ -137,0 +79 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se + * Can send data over the Internet @@ -139 +80,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se -Follow these steps to configure a Trusted Token Issuer on your IAM Identity Center instance in your AWS Console: @@ -141 +81,0 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent -###### To configure a Trusted Token Issuer @@ -143 +82,0 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent - 1. Go to your AWS account and navigate to your IAM Identity Center instance. @@ -145 +84 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent - 2. Navigate to **Settings** , **Authentication**. +### Graph API delegated permissions @@ -147 +86 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent - 3. Choose **Create trusted token issuer**. +The Outlook extension uses Microsoft Graph integration, which requires additional delegated permissions. @@ -149 +88 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent - 4. Add the issuer URL, which should follow this template, where `Tenant ID` refers to your Entra tenant ID: +###### Important @@ -151 +90 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent - login.microsoftonline.com/Tenant ID/v2.0 +These permissions are required for the Amazon Quick Outlook extension to provide its full range of capabilities. Without these permissions granted, the extension can only answer questions about the currently open email thread and draft a reply. It cannot summarize your inbox, manage your calendar, or perform inbox-wide operations such as searching, organizing, or triaging emails. @@ -155,22 +94 @@ Follow these steps to configure a Trusted Token Issuer on your IAM Identity Cent -The issuer URL should be the OIDC discovery endpoint of your identity without the well-known document URI path. If you include the well-known document URI path, this will not work. See Trusted token issuer configuration settings. - - 5. Choose **Email** as the Identity Provider attribute and IAM Identity Center attribute. - - 6. Note the trusted token issuer ARN. You will need this in a later step. - - - - -After completing these Entra ID-specific steps, proceed to the Complete AWS Configuration (all providers) section below. - -#### Configure IAM Identity Center with Okta - -Follow these steps only if you are using IAM Identity Center with Okta to set up and configure your App Integration in the Okta Admin console: - -###### To set up an Okta Application - - 1. In your Okta account, create a new Okta App Integration. - - 1. In your Okta Admin console, navigate to **Applications** > **Applications**. - - 2. Click on **Create App Integration**. +The Amazon Quick Outlook extension does not send emails or create calendar appointments automatically. It uses Human-in-the-Loop (HITL) confirmation before any sending action, so users always review and approve outgoing messages and calendar changes. @@ -178 +96 @@ Follow these steps only if you are using IAM Identity Center with Okta to set up - 3. For the Sign-in method, select **OIDC - OpenID Connect**. +Users are prompted to sign in the first time they interact with the extension. Administrators can pre-approve these permissions by granting tenant-wide admin consent (see Grant tenant-wide admin consent). @@ -180 +98 @@ Follow these steps only if you are using IAM Identity Center with Okta to set up - 4. For the Application type, select **Web Application**. +The following table lists the delegated Graph API permissions used by the Outlook extension.