Amazon Q Enterprise is a completely managed, generative synthetic intelligence (AI)-powered assistant that helps enterprises unlock the worth of their information and information. With Amazon Q, you possibly can shortly discover solutions to questions, generate summaries and content material, and full duties through the use of the knowledge and experience saved throughout your organization’s varied information sources and enterprise techniques. On the core of this functionality are native information supply connectors that seamlessly combine and index content material from a number of repositories right into a unified index. This allows the Amazon Q massive language mannequin (LLM) to supply correct, well-written solutions by drawing from the consolidated information and knowledge. The information supply connectors act as a bridge, synchronizing content material from disparate techniques like Salesforce, Jira, and SharePoint right into a centralized index that powers the pure language understanding and generative skills of Amazon Q.
To make this integration course of as seamless as doable, Amazon Q Enterprise presents a number of pre-built connectors to a variety of information sources, together with Atlassian Jira, Atlassian Confluence, Amazon Easy Storage Service (Amazon S3), Microsoft SharePoint, Salesforce, and plenty of extra. This lets you create your generative AI answer with minimal configuration. For a full listing of Amazon Q supported information supply connectors, see Supported connectors.
One of many key integrations for Amazon Q is with Microsoft SharePoint On-line. SharePoint is a broadly used collaborative platform that permits organizations to handle and share content material, information, and purposes to enhance productiveness and decision-making. By integrating Amazon Q with SharePoint, companies can empower their staff to entry data and insights from SharePoint extra effectively and successfully.
With the Amazon Q and SharePoint On-line integration, enterprise customers can do the next:
- Get instantaneous solutions – Customers can ask pure language questions and Amazon Q will present correct, up-to-date solutions by looking out and synthesizing data from throughout the group’s SharePoint websites and content material.
- Speed up analysis and evaluation – As an alternative of manually looking out by SharePoint paperwork, customers can use Amazon Q to shortly discover related data, summaries, and insights to assist their analysis and decision-making.
- Streamline content material creation – Amazon Q can help in producing drafts, outlines, and even full content material items (corresponding to reviews, articles, or shows) by drawing on the information and information saved in SharePoint.
- Automate workflows and duties – Amazon Q might be configured to finish routine duties and queries (corresponding to producing standing reviews, answering FAQs, or requesting data) by interacting with the related SharePoint information and purposes.
- Improve collaboration – By making SharePoint content material extra accessible and actionable by Amazon Q, the mixing facilitates higher information sharing, problem-solving, and collaboration throughout the group.
On this publish, we information you thru the method of organising the SharePoint On-line connector in Amazon Q Enterprise. It will allow your group to make use of the facility of generative AI to unlock the total worth of your SharePoint funding and empower your workforce to work smarter and extra effectively.
Discover correct solutions from content material in Microsoft SharePoint utilizing Amazon Q Enterprise
After you combine Amazon Q Enterprise with Microsoft SharePoint, customers can ask questions from the physique of the doc. For this publish, we use a SharePoint On-line website named HR Insurance policies that has details about the journey coverage, state incapacity insurance coverage coverage, payroll taxes, and paid household go away program for California saved in doc libraries. Among the questions you possibly can ask Amazon Q Enterprise would possibly embrace the next:
- Is there a go away plan in California for brand new mother and father?
- Can I declare incapacity insurance coverage throughout this time?
- Earlier than making use of for go away, I need to submit my submit expense report, how can I do it?
- Is there any restrict on spending on a enterprise journey?
- How can I calculate UI and ETT?
Overview of the information supply
SharePoint is a website-based collaboration system that’s used as a safe place to retailer, manage, share, and entry data from any gadget. SharePoint empowers teamwork with dynamic and productive staff websites for each challenge staff, division, and division.
SharePoint is obtainable in two choices: SharePoint Server and SharePoint On-line. SharePoint Server is a regionally hosted platform that your organization owns and operates. You’re liable for the whole lot from server structure, lively listing, to file storage. SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Version are the lively SharePoint Server releases. SharePoint On-line is a cloud-based service offered instantly from Microsoft. They handle identification administration structure, and website administration. SharePoint Sever and SharePoint On-line comprise pages, recordsdata, attachments, hyperlinks, occasions, and feedback that may be crawled by Amazon Q SharePoint connectors for SharePoint Server and SharePoint On-line.
SharePoint On-line and SharePoint Server provide a website content material house the place website homeowners can view an inventory of all pages, libraries, and lists for his or her website. The location content material house additionally supplies entry so as to add lists, pages, doc libraries, and extra.
Pages are the contents saved on webpages; these are supposed to show data to the end-user.
A doc library supplies a safe place to retailer recordsdata the place you and your coworkers can discover them simply. You possibly can work on them collectively and entry them from any gadget at any time.
An inventory is likely one of the information storage mechanisms inside SharePoint. It supplies the UI to view the objects in an inventory. You possibly can add, edit, and delete objects or view particular person objects.
Overview of the SharePoint On-line connector for Amazon Q Enterprise
To crawl and index contents from SharePoint On-line, you possibly can configure the Amazon Q Enterprise SharePoint On-line connector as a knowledge supply in your Amazon Q enterprise software. If you join Amazon Q Enterprise to a knowledge supply and provoke the sync course of, Amazon Q Enterprise crawls and indexes paperwork from the information supply into its index.
Let’s take a look at what are thought of as paperwork within the context of Amazon Q enterprise SharePoint On-line connector. A doc is a group of data that consists of a title, the content material (or the physique), metadata (information concerning the doc), and entry management listing (ACL) data to ensure solutions are offered from paperwork that the person has entry to.
The next entities in SharePoint are crawled and listed as paperwork together with their metadata and entry management data:
- Information
- Occasions
- Pages
- Hyperlinks
- Attachments
- Feedback
Amazon Q Enterprise crawls information supply doc attributes or metadata and maps them to fields in your Amazon Q index. Seek advice from Amazon Q Enterprise SharePoint On-line information supply connector area mappings for extra particulars.
Configure and put together the Amazon Q connector
Earlier than you index the content material from Microsoft SharePoint on-line, your must first set up a safe connection between the Amazon Q Enterprise connector for SharePoint On-line together with your SharePoint On-line occasion. To determine a safe connection, it’s good to authenticate with the information supply.
The next are the supported authentication mechanisms for the SharePoint connector:
- Primary Authentication
- OAuth 2.0 with Useful resource Proprietor Password Credentials Move
- Azure AD App-Solely (OAuth 2.0 Certificates)
- SharePoint App-Solely with Shopper Credentials Move
- OAuth 2.0 with Refresh Token Move
Safe querying with ACL crawling, identification crawling, and person retailer
Safe querying is when a person runs a question and is returned solutions from paperwork that the person has entry to and never from paperwork that the person doesn’t have entry to. To allow customers to do safe querying, Amazon Q Enterprise honors ACLs of the paperwork. Amazon Q Enterprise does this by first supporting the indexing of ACLs. Indexing paperwork with ACLs is essential for sustaining information safety, as a result of paperwork with out ACLs are thought of public. At question time, the person’s credentials (e mail tackle) are handed together with the question in order that solutions from paperwork which are related to the question and which the person is permitted to entry are displayed.
A doc’s ACL accommodates data such because the person’s e mail tackle and the native teams or federated teams (if Microsoft SharePoint is built-in with an identification supplier (IdP) corresponding to Azure Energetic Listing/Entra ID) which have entry to the doc. The SharePoint on-line information supply might be optionally linked to an IdP corresponding to Okta or Microsoft Entra ID. On this case, the paperwork in SharePoint On-line can have the federated group data.
When a person logs in to an internet software to conduct a search, the person’s credentials (corresponding to an e mail tackle) must match that’s within the ACL of the doc to return outcomes from that doc. The online software that the person makes use of to retrieve solutions can be linked to an IdP or AWS IAM Identification Middle. The person’s credentials from the IdP or IAM Identification Middle are referred to right here because the federated person credentials. The federated person credentials corresponding to the e-mail tackle are handed together with the question in order that Amazon Q can return the solutions from the paperwork that this person has entry to. Nevertheless, typically this person’s federated credentials might not be current within the SharePoint On-line information supply or the SharePoint doc’s ACLs. As an alternative, the person’s native person alias, native teams that this native person alias is part of, or the federated teams that the federated person is part of can be found within the doc’s ACL. Due to this fact, there’s a must map the federated person credential to the native person alias, native teams, or federated teams within the doc ACL.
To map this federated person’s e mail tackle to the native person aliases, native teams, or federated teams, sure Amazon Q Enterprise connectors, together with the SharePoint On-line connector, present an identification crawler to load the identification data (native person alias, native teams, federated teams, and their mappings, together with another mappings to a federated person) from the linked information sources right into a person retailer. At question time, Amazon Q Enterprise retrieves the related native person aliases, native teams, and any federated teams from the person retailer and makes use of that together with the question for securely retrieving passages from paperwork that the person has entry to.
If it’s good to index paperwork with out ACLs, you should be certain that they’re explicitly marked as public in your information supply.
Seek advice from How Amazon Q Enterprise connector crawls SharePoint (On-line) ACLs for extra particulars.
Amazon Q indexes the paperwork with ACLs and units the person’s e mail tackle or person principal title for the person and the group title [site URL hash value | group name] for the native group within the ACL. If the SharePoint On-line information supply is linked to an IdP corresponding to Azure AD/Entra ID or Okta, the AD group title seen within the SharePoint website is ready because the federated group ACL. The identification crawler units these the identical because the principals together with the accessible mappings within the person retailer. Any extra mappings have to be set within the person retailer utilizing the person retailer APIs.
Overview of answer
This publish presents the steps to create a certificates and personal key, configure Azure AD (both utilizing the Azure AD console or a PowerShell script), and configure Amazon Q Enterprise.
For this publish, we use a SharePoint On-line website named HR Insurance policies that hosts coverage paperwork in a Paperwork library and payroll tax paperwork in a Payroll Taxes library to stroll you thru the answer.
In one of many situations that we validate, a SharePoint person (Carlos Salazar) is a part of the SharePoint website members group, and he has entry solely to coverage paperwork within the Paperwork library.
Carlos Salazar can obtain responses for queries associated to HR insurance policies, as proven within the following instance.
Nevertheless, for questions associated to payroll tax, he didn’t obtain any response.
One other SharePoint person (John Doe) is a part of the SharePoint website homeowners group and has entry to each the Paperwork and Payroll Taxes libraries.
John Doe receives responses for queries associated to payroll taxes, as proven within the following instance.
Conditions
It’s best to meet the next stipulations:
- The person performing these steps needs to be a worldwide administrator on Azure AD/Entra ID.
- Configure Microsoft Entra ID and IAM Identification Middle integration.
- You want a Microsoft Home windows occasion to run PowerShell scripts and instructions with PowerShell 7.4.1+. Particulars of the required PowerShell modules are described later on this publish.
- The person ought to have administrator permissions on the Home windows occasion.
- Ensure that the person operating these PowerShell instructions has the suitable M365 license (for instance, M365 E3).
Create the certificates and personal key
In Azure AD, when configuring App-Solely authentication, you sometimes use a certificates to request entry. Anybody with the certificates’s non-public key can use the app and the permissions granted to the app. We create and configure a self-signed X.509 certificates that might be used to authenticate Amazon Q in opposition to Azure AD, whereas requesting the App-Solely entry token. The next steps stroll you thru the setup of this mannequin.
For this publish, we use Home windows PowerShell to run a number of PowerShell instructions. You should use an current Home windows occasion or spin up a Home windows EC2 occasion or Home windows workstation to run the PowerShell instructions.
You should use the next PowerShell script to create a self-signed certificates. It’s also possible to generate the self-signed certificates by the New-PnPAzureCertificate command.
- Run the next command:
You’ll be requested to present a password to encrypt your non-public key, and each the .PFX file and the .CER file might be exported to the present folder (the place you ran the PowerShell script from). Confirm that you just now have a .cer and .pfx file.
- Add this .cer file to an S3 location that your Amazon Q IAM position has GetObject permissions for. You possibly can let Amazon Q create this position for you in future steps outlined later on this publish, and the proper permissions might be added for you for those who select.
Now you extract the non-public key contents from the .pfx file and put it aside for Amazon Q connector configuration. This .pfx file might be current within the folder the place you might have saved the certificates.
- Run the next command to extract the non-public key:
You’ll be prompted for the import password. Enter the password that you just used to guard your key pair once you created the .pfx file (shopper ID, in our case). You’ll be prompted once more to supply a brand new password to guard the .key file that you’re creating. Retailer the password to your key file in a safe place to keep away from misuse. (If you enter a password, the window exhibits nothing for those who’re utilizing the Home windows CMD window. Enter your password and select Enter.)
- Run the next command to decrypt the non-public key:
- Run the next command to extract the certificates:
This decrypted key and certificates might be utilized by the connector for authentication functions.
- Add the X.509 certificates (ending with .crt) to an S3 bucket. This might be used when configuring the SharePoint On-line connector for Amazon Q.
- Confirm the contents of the file
amazonqbusinessdemo-decrypted.key
begins with the usualBEGIN PRIVATE KEY
header. - Copy and paste the contents of the
amazonqbusinessdemo-decrypted.key
to be used later in our Amazon Q setup.
- Confirm the contents of the file
Configure Azure AD
You possibly can configure Azure AD utilizing both of the next strategies:
- Utilizing the Azure AD console GUI. It is a guide step-by-step course of.
- Utilizing the offered PowerShell script. That is an automatic course of that takes within the inputs and configures the required permissions.
Observe the steps for both choice to finish the Azure AD configuration.
Configure Azure AD utilizing the Azure AD console
To configure Azure AD utilizing the GUI, you first register an Azure AD software within the Azure AD tenant that’s linked to the SharePoint On-line/O365 tenant. For extra particulars, see Granting entry through Azure AD App-Solely.
- Open the Workplace 365 Admin Middle utilizing the account of a person member of the Tenant International Admins group.
- Navigate to Microsoft Azure Portal.
- Seek for and select App registrations.
- Select New registration.
- Enter a reputation on your software, choose who can use this software, and select Register.
An software might be created. You will notice a web page like the next screenshot.
- Observe the applying (shopper) ID and the listing (tenant) ID.
These IDs might be completely different than what’s proven within the screenshot.
Now you possibly can configure the newly registered software for SharePoint permissions.
- Select API permissions within the navigation pane.
- Select Add a permission so as to add the permissions to your software.
- Select SharePoint from the listing of purposes.
- Configure permissions.
There are two other ways to configure SharePoint permissions.
To configure permissions to entry a number of SharePoint Web site collections (utilizing Azure AD App-Solely permissions), choose Web site.FullControl.All to permit full management permissions to all of the SharePoint website collections and to learn the ACLs from these website collections.
This permission requires admin consent in a tenant earlier than it may be used. To take action, select Grant admin consent for
Alternatively, to configure permissions to entry particular SharePoint website collections, choose Websites.Chosen to permit entry to a subset of website collections with out a signed-in person. The precise website collections and the permissions granted might be configured in SharePoint On-line.
This permission requires admin consent in a tenant earlier than it may be used. To take action, select Grant admin consent for
Subsequent, you grant Azure AD app permissions to a number of SharePoint website collections. Ensure that the next stipulations are in place:
- You have to have Home windows Server/Workstation with PowerShell 7.4.1+.
- The person operating these PowerShell instructions should have the suitable M365 license (for instance, M365 E3).
- Set up the PowerShell modules utilizing
Set up-Module -Identify PnP.PowerShell -AllPreRelease
. - If that is your first-time operating PowerShell instructions, run the
Join-PnPOnline -Url
PowerShell command and full the consent course of to make use of PnP cmdlets. Alternatively, run the-PnPManagementShell Register-PnPManagementShellAccess
cmdlet, which grants entry to the tenant for the PnP administration shell multi-tenant Azure AD software.
- Open PowerShell and hook up with SharePoint On-line utilizing the Join-PnPOnline command:
- Add the Azure AD app to a number of particular website assortment permissions utilizing Grant-PnPAzureADAppSitePermission:
If you wish to configure permissions to a couple of SharePoint On-line website assortment, then you should repeat the previous PowerShell instructions for each assortment.
Now you’re prepared to attach the certificates.
- Select Certificates & secrets and techniques within the navigation pane.
- On the Certificates tab, select Add certificates.
- Select the .cer file you generated earlier and select Add to add it.
This completes the configuration on the Azure AD aspect.
Configure Azure AD utilizing the offered PowerShell script
The person operating this PowerShell script needs to be an Azure AD tenant admin or have tenant admin permissions. Moreover, as a prerequisite, set up the MS Graph PowerShell SDK.
Full the next steps to run the PowerShell script:
- Run the PowerShell script and comply with the directions.
This script will do the next:
- Register a brand new software in Azure AD/Entra ID
- Configure the required SharePoint permissions
- Present admin consent for the permissions
The output from the PowerShell script will appear like the next screenshot.
- When you selected Chosen because the permission to focus on a selected SharePoint Web site assortment, proceed with the steps to configure a selected SharePoint Web site assortment as talked about earlier.
- When you have a couple of SharePoint website assortment to be crawled, repeat the earlier step to configure every assortment.
Configure Amazon Q
Be sure you have arrange Amazon Q Enterprise with Entra ID as IdP as talked about within the stipulations. Additionally, be certain that the e-mail ID is in lowercase letters whereas creating the customers in Entra ID.
Observe the directions in Connecting Amazon Q Enterprise to SharePoint (On-line) utilizing the console.
For Step 9 (Authentication), we select Azure AD App-Solely authentication and configure it as follows:
- For Tenant ID, enter the tenant ID of your SharePoint account. This might be listing (tenant) ID in your registered Azure software, within the Azure Portal, as proven within the following screenshot (the IDs might be completely different on your setup).
- For Certificates path, enter the full S3 path to your certificates (for instance,
s3://certBucket/azuread.crt
). That is the Azure AD self-signed X.509 certificates to authenticate the connector for Azure AD. This certificates was created earlier. - For AWS Secrets and techniques Supervisor secret, create a secret in AWS Secrets and techniques Supervisor to retailer your SharePoint authentication credentials:
- For Secret title, enter a reputation on your secret.
- For Shopper ID, enter the Azure AD shopper ID generated once you registered SharePoint in Azure AD. That is the applying (shopper) ID created within the Azure Portal when registering the SharePoint software in Azure, as described earlier.
- For Non-public key, enter a non-public key to authenticate the connector for Azure AD. That is the contents of the .pfx file you created when registering your Azure SharePoint software, as described earlier. Enter the decrypted contents of that .pfx file in its entirety. Select Present non-public key to confirm it matches the contents on your .pfx file.
Proceed with the remainder of the steps in Connecting Amazon Q Enterprise to SharePoint (On-line) utilizing the console.
Entry the online expertise on Amazon Q
To entry the online expertise, full the next steps:
- On the Amazon Q Enterprise console, select Functions within the navigation pane.
- Select the applying you created.
- Select the hyperlink below Net expertise URL to browse Amazon Q.
- When prompted, authenticate with Entra ID/Azure AD.
After you’re authenticated, you possibly can entry Amazon Q. You possibly can ask Amazon Q a query and get a response based mostly on the permissions of the logged-in person.
References
- You possibly can check if the
Grant-PnPAzureADAppSitePermission
cmdlet labored by connecting to the SharePoint website utilizing the Azure AD app that has the SharePoint.Websites.Chosen permission and run a number of SharePoint API calls:
-
- Make a remark of the certificates thumbprint as proven earlier.
- Set up the certificates for the present person within the Home windows Certificates Administration Retailer.
- Run the next PowerShell cmdlet to connect with the SharePoint website assortment utilizing
PnPOnline
:
-
- Run
Get-PnPList
to listing all of the SharePoint lists within the website assortment and ensure that the permissions are configured accurately:
- Run
Troubleshooting
For troubleshooting steerage, confer with Troubleshooting your SharePoint (On-line) connector.
Clear up
Full the next steps to wash up your sources:
- Open the Workplace 365 Admin Middle utilizing the account of a person member of the Tenant International Admins group.
- Navigate to the Microsoft Azure Portal.
- Seek for and select App registrations.
- Choose the app you created earlier, then select Delete.
- On the Amazon Q Enterprise console, select Functions within the navigation pane.
- Choose the applying you created, and on the Actions menu, select Delete.
Conclusion
On this publish, we explored how Amazon Q Enterprise can seamlessly combine with SharePoint On-line to assist enterprises unlock the worth of their information and information. With the SharePoint On-line connector, organizations can empower their staff to search out solutions shortly, speed up analysis and evaluation, streamline content material creation, automate workflows, and improve collaboration.
We walked you thru the method of organising the SharePoint On-line connector, together with configuring the mandatory Azure AD integration and authentication mechanisms. With these foundations in place, you can begin unlocking the total potential of your SharePoint funding and drive better productiveness, effectivity, and innovation throughout your online business.
Now that you just’ve discovered the right way to combine Amazon Q Enterprise together with your Microsoft SharePoint On-line content material, it’s time to unlock the total potential of your group’s information and information. To get began, join an Amazon Q Enterprise account and comply with the steps on this publish to arrange the SharePoint On-line connector. Then you can begin asking Amazon Q pure language questions and watch because it surfaces essentially the most related data out of your firm’s SharePoint websites and paperwork.
Don’t miss out on the transformative energy of generative AI and the Amazon Q Enterprise platform. Enroll right this moment and expertise the distinction that Amazon Q could make on your group’s SharePoint-powered information and content material administration.
In regards to the Authors
Vijai Gandikota is a Principal Product Supervisor on the Amazon Q and Amazon Kendra staff of Amazon Net Companies. He’s liable for the Amazon Q and Amazon Kendra connectors, ingestion, safety, and different elements of Amazon Q and Amazon Kendra.
Satveer Khurpa is a Senior Options Architect on the GenAI Labs staff at Amazon Net Companies. On this position, he makes use of his experience in cloud-based architectures to develop progressive generative AI options for shoppers throughout numerous industries. Satveer’s deep understanding of generative AI applied sciences allows him to design scalable, safe, and accountable purposes that unlock new enterprise alternatives and drive tangible worth.
Vijai Anand Ramalingam is a Senior Modernization Architect at Amazon Net Companies, specialised in enabling and accelerating prospects’ software modernization, transitioning from legacy monolith purposes to microservices.
Ramesh Jatiya is a Senior Options Architect within the Impartial Software program Vendor (ISV) staff at Amazon Net Companies. He’s obsessed with working with ISV prospects to design, deploy, and scale their purposes within the cloud to derive enterprise worth. He’s additionally pursuing an MBA in Machine Studying and Enterprise Analytics from Babson School, Boston. Exterior of labor, he enjoys operating, taking part in tennis, and cooking.
Neelam Rana is a Software program Improvement Engineer on the Amazon Q and Amazon Kendra engineering staff. She works on Amazon Q connector design, improvement, integration, and check operations.
Dipti Kulkarni is a Software program Improvement Supervisor on the Amazon Q and Amazon Kendra engineering staff of Amazon Net Companies, the place she manages the connector improvement and integration groups.