AWS bedrock: Remove OAuth 2.0 SharePoint connector authentication section
Summary
Deletes the entire 'OAuth 2.0 authentication' section for the SharePoint data source connector, including prerequisites, AWS Secrets Manager credential key-value pairs (username, password, clientId, clientSecret), console/API connection steps, and the sample CreateDataSource JSON. The removed text also contained guidance to disable Azure Security Defaults and multi-factor authentication (MFA) on the SharePoint admin account so Bedrock could crawl content, and a note that Azure ACS App-Only authentication was retired on April 2, 2026 in favor of Microsoft Entra ID (OAUTH2_CLIENT_CREDENTIALS).
Security assessment
The removed block explicitly advised customers to disable MFA and Azure Security Defaults and to store long-lived admin username/password plus client secrets for crawling, which is a documented authentication weakness; deleting this guidance (and pointing users to Entra ID client-credentials auth) removes an insecure configuration recommendation, though no specific CVE or incident is cited.
Evidence
- * You might need to turn off multi-factor authentication (MFA) in your SharePoint account, so that Amazon Bedrock is not blocked from crawling your SharePoint content.
Diff
diff --git a/bedrock/latest/userguide/sharepoint-data-source-connector.md b/bedrock/latest/userguide/sharepoint-data-source-connector.md index de8ce1c..302cf91 100644 --- a//bedrock/latest/userguide/sharepoint-data-source-connector.md +++ b//bedrock/latest/userguide/sharepoint-data-source-connector.md @@ -247,110 +246,0 @@ To learn about customizations that you can apply to ingestion by including the o -###### Important - -SharePoint App-Only authentication through Azure ACS was retired by Microsoft on April 2, 2026. Use Microsoft Entra ID authentication (`OAUTH2_CLIENT_CREDENTIALS`) as described in the prerequisites above. - -Using OAuth 2.0, you can authenticate and authorize access to SharePoint resources for SharePoint connectors integrated with Knowledge Bases. - -### Pre-requisites - -**In SharePoint, for OAuth 2.0 authentication, make sure you** : - - * Take note of your SharePoint Online site URL/URLs. For example, `https://yourdomain.sharepoint.com/sites/mysite`. Your URL must start with `https` and contain `sharepoint.com`. Your site URL must be the actual SharePoint site, not `sharepoint.com/` or `sites/mysite/home.aspx` - - * Take note of the domain name of your SharePoint Online instance URL/URLs. - - * Copy your Microsoft 365 tenant ID. You can find your tenant ID in the Properties of your Microsoft Entra portal or in your OAuth application. - -Take note of the username and password of the admin SharePoint account, and copy the client ID and client secret value when registering an application. - -###### Note - -For an example application, see [Register a client application in Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/healthcare-apis/register-application) (formerly known as Azure Active Directory) on the Microsoft Learn website. - - * Certain read permissions are required to connect to SharePoint when you register an application. - - * SharePoint: AllSites.Read (Delegated) – Read items in all site collections - - * You might need to turn off **Security Defaults** in your Azure portal using an admin user. For more information on managing security default settings in the Azure portal, see [Microsoft documentation on how to enable/disable security defaults](https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-conditional-access?view=o365-worldwide&tabs=secdefaults#security-defaults-1). - - * You might need to turn off multi-factor authentication (MFA) in your SharePoint account, so that Amazon Bedrock is not blocked from crawling your SharePoint content. - - - - -To complete the pre-requisites, make sure that you've completed the steps in AWS account. - -### Secret authentication credentials - -For connection configuration for OAuth2.0, you can perform the same steps for the auto detection of the main document fields, inclusion/exclusion filters, and incremental syncing as described in Connection configuration. - -**For OAuth 2.0 authentication, your secret authentication credentials in AWS Secrets Manager must include these key-value pairs**. - - * `username`: `SharePoint admin username` - - * `password`: `SharePoint admin password` - - * `clientId`: `OAuth app client ID` - - * `clientSecret`: `OAuth app client secret` - - - - -### Connect a SharePoint instance to your knowledge base - -To connect a SharePoint instance to your knowledge base when using OAuth2.0: - - * (console) In the console, follow the same steps as described in [Connect a SharePoint instance to your knowledge base](https://docs.aws.amazon.com/bedrock/latest/userguide/sharepoint-data-source-connector.html#connect-sharepoint-console). When you want to provide the authentication information to connect to your SharePoint instance. - - * Provide the tenant ID. You can find your tenant ID in the Properties of your Azure Active Directory portal. - - * Go to AWS Secrets Manager to add your secret authentication credentials or use an existing Amazon Resource Name (ARN) for the secret you created. Your secret must contain the SharePoint admin username and password, and your registered app client ID and client secret. For an example application, see [Register a client application in Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/healthcare-apis/register-application) (formerly known as Azure Active Directory) on the Microsoft Learn website. - - * (API) The following is an example of using the `CreateDataSource` API to create your data source with your connection information for OAuth2.0. - - aws bedrock-agent create-data-source \ - --name "SharePoint Online connector" \ - --description "SharePoint Online data source connector for Amazon Bedrock to use content in SharePoint" \ - --knowledge-base-id "your-knowledge-base-id" \ - --data-source-configuration file://sharepoint-bedrock-connector-configuration.json \ - --data-deletion-policy "DELETE" - -**Contents of`sharepoint-bedrock-connector-configuration.json`** - - { - "sharePointConfiguration": { - "sourceConfiguration": { - "tenantId": "888d0b57-69f1-4fb8-957f-e1f0bedf64de", - "hostType": "ONLINE", - "domain": "yourdomain", - "siteUrls": [ - "https://yourdomain.sharepoint.com/sites/mysite" - ], - "authType": "OAUTH2_CLIENT_CREDENTIALS", - "credentialsSecretArn": "arn:aws::secretsmanager:your-region:secret:AmazonBedrock-SharePoint" - }, - "crawlerConfiguration": { - "filterConfiguration": { - "type": "PATTERN", - "patternObjectFilter": { - "filters": [ - { - "objectType": "File", - "inclusionFilters": [ - ".*\\.pdf" - ], - "exclusionFilters": [ - ".*private.*\\.pdf" - ] - } - ] - } - } - } - }, - "type": "SHAREPOINT" - } - - - -