Connecting Amazon Q Business to SharePoint (Online) using the console - Amazon Q Business

Connecting Amazon Q Business to SharePoint (Online) using the console

The following procedure outlines how to connect Amazon Q Business to SharePoint (Online) using the AWS Management Console.

Connecting Amazon Q to SharePoint (Online)

  1. Sign in to the AWS Management Console and open the Amazon Q console at https://console.aws.amazon.com/amazonq/business/.

  2. Complete the steps to create your Amazon Q application.

  3. Complete the steps for selecting an Amazon Q retriever.

  4. Then, from Data sources – Add an available data source to connect your Amazon Q application.

    You can add up to 5 data sources.

  5. Then, on the SharePoint (Online) page, enter the following information:

  6. Name – Name your data source for easy tracking.

    Note: You can include hyphens (-) but not spaces. Maximum of 1,000 alphanumeric characters.

  7. In Source, enter the following information:

    1. In Source, for Hosting Method – Choose SharePoint Online.

    2. Site URLs specific to your SharePoint repository – Enter the SharePoint host URLs. The format for the host URLs you enter is https://yourcompany.sharepoint.com/sites/mysite. The URL must start with https protocol. Separate URLs with a new line. You can add up to 100 URLs.

    3. Domain – Enter the SharePoint domain. For example, the domain in the URL https://yourdomain.sharepoint.com/sites/mysite is yourdomain.

  8. Authorization – Choose whether Amazon Q will crawl user and group access control list (ACL) information from your data source. Amazon Q can use this information to only generate responses from documents your end users have access to. See Authorization for more details.

    Note

    Using ACL data to filter responses is not a replacement for user authentication and authorization for your application. For information on setting up identity management for Amazon Q, see Integrating with an Identity Provider (IdP).

    Important

    If you don't specify a value, Email is considered as the default value.

  9. For Authentication, choose between Basic, Oauth 2.0, Azure AD App-Only authentication, SharePoint App-Only authentication, and OAuth 2.0 refresh token authentication based on your use case.

    Note

    OneNote can only be crawled by the connector using a Tenant ID, and with OAuth 2.0, OAuth 2.0 refresh token, or SharePoint (Online) App Only authentication activated.

    1. If using Basic Authentication, enter the following information:

      • For AWS Secrets Manager secret – Choose an existing secret or create a Secrets Manager secret to store your SharePoint authentication credentials. If you choose to create a secret, an AWS Secrets Manager secret window opens. Enter the following information in the window:

        • Secret name – A name for your secret.

        • Username – Username for your SharePoint account.

        • Password – Password for your SharePoint account.

    2. If using OAuth 2.0 authentication, enter the following information:

      • Tenant ID – Tenant ID of your SharePoint account.

      • For AWS Secrets Manager secret – Choose an existing secret or create a Secrets Manager secret to store your SharePoint authentication credentials. If you choose to create a secret, an AWS Secrets Manager secret window opens. Enter the following information in the window:

        • Secret name – A name for your secret.

        • Username – Username for your SharePoint account.

        • Password – Password for your SharePoint account.

        • Client ID – The Azure AD client ID generated when you register SharePoint in Azure AD.

        • Client secret – The Azure AD client secret generated when you register SharePoint in Azure AD.

    3. If using Azure AD App-Only authentication, enter the following information:

      • Tenant ID – Tenant ID of your SharePoint account.

      • Azure AD self-signed X.509 certificate – Certificate to authenticate the connector for Azure AD.

      • For AWS Secrets Manager secret – Choose an existing secret or create a Secrets Manager secret to store your SharePoint authentication credentials. If you choose to create a secret, an AWS Secrets Manager secret window opens. Enter the following information in the window:

        • Secret name – A name for your secret.

        • Client ID – The Azure AD client ID generated when you register SharePoint in Azure AD.

        • Private key – A private key to authenticate the connector for Azure AD.

    4. If using SharePoint App-Only authentication, enter the following information:

      • Tenant ID–Tenant ID of your SharePoint account.

      • For AWS Secrets Manager secret — Choose an existing secret or create a Secrets Manager secret to store your SharePoint authentication credentials. If you choose to create a secret, an AWS Secrets Manager secret window opens. Enter the following information in the window:

        • Secret name – A name for your secret.

        • SharePoint client ID – The SharePoint client ID you generated when you registered App-Only at Tenant Level. ClientID format is ClientID@TenantId. For example, ffa956f3-8f89-44e7-b0e4-49670756342c@888d0b57-69f1-4fb8-957f-e1f0bedf82fe.

        • SharePoint client secret – The SharePoint client secret generated when your register for App-Only at Tenant Level.

        • Client ID – The Azure AD client ID generated when you register SharePoint in Azure AD.

        • Client secret – The Azure AD client secret generated when you register SharePoint to Azure AD.

  10. Configure VPC and security group – optional – Choose whether you want to use a VPC. If you do, enter the following information:

    1. Subnets – Select up to 6 repository subnets that define the subnets and IP ranges the repository instance uses in the selected VPC.

    2. VPC security groups – Choose up to 10 security groups that allow access to your data source. Ensure that the security group allows incoming traffic from Amazon EC2 instances and devices outside your VPC. For databases, security group instances are required.

    For more information, see VPC.

  11. Identity crawler – Choose to activate Amazon Q identity crawler to sync identity information. Only Local Group Members will be crawled using Identity crawler. For more information, see Identity crawler.

    Note

    Crawl AD Group mapping is available only for OAuth 2.0, OAuth 2.0 refresh token, and SharePoint (Online) App-Only authentication.

  12. IAM role – Choose an existing IAM role or create an IAM role to access your repository credentials and index content.

    For more information, see IAM role.

  13. In Sync scope, choose from the following options :

    1. Select entities – Choose the entities that you want to crawl. You can select to crawl All entities or any combination of Files, Attachments, Links, Pages, Events, Comments, and List Data.

    2. For Maximum single file size – Specify the file size limit in MBs that Amazon Q will crawl. Amazon Q will crawl only the files within the size limit you define. The default file size is 50MB. The maximum file size should be greater than 0MB and less than or equal to 50MB.

    3. In Additional configuration – optional, for Entity regex patterns – Add regular expression patterns for Links, Pages, and Events to include specific entities instead of syncing all your documents.

    4. In Additional configuration, for Regex patterns – Add regular expression patterns to include or exclude files by File path, File name, File type, OneNote section name, and OneNote page name instead of syncing all your documents. You can add up to 100 patterns.

      Note

      OneNote crawling is available only for OAuth 2.0, OAuth 2.0 refresh token, and SharePoint App Only authentication.

  14. In Sync mode, choose how you want to update your index when your data source content changes. When you sync your data source with Amazon Q for the first time, all content is synced by default.

    • Full sync – Sync all content regardless of the previous sync status.

    • New or modified content sync – Sync only new and modified documents.

    • New, modified, or deleted content sync – Sync only new, modified, and deleted documents.

    For more details, see Sync mode.

  15. In Sync run schedule, for Frequency – Choose how often Amazon Q will sync with your data source. For more details, see Sync run schedule.

  16. Tags - optional – Add tags to search and filter your resources or track your AWS costs. See Tags for more details.

  17. Field mappings – A list of data source document attributes to map to your index fields. Add the fields from the Data source details page after you finish adding your data source. You can choose from two types of fields:

    1. Default – Automatically created by Amazon Q on your behalf based on common fields in your data source. You can't edit these.

    2. Custom – Automatically created by Amazon Q on your behalf based on common fields in your data source. You can edit these. You can also create and add new custom fields.

      Note

      Support for adding custom fields varies by connector. You won't see the Add field option if your connector doesn't support adding custom fields.

    For more information, see Field mappings.

  18. To finish connecting your data source to Amazon Q, select Add data source.

    You are taken to the Data source details, where you can view your data source configuration details.

  19. In Data source details, choose Sync now to allow Amazon Q to begin syncing (crawling and ingesting) data from your data source. When the sync job finishes, your data source is ready to use.

    Note

    You can also choose to view CloudWatch logs for your data source sync job by selecting View CloudWatch logs. If you get a Resource not found exception when you try to view your CloudWatch logs for a data source sync job in progress, it can be because the CloudWatch logs are not available yet. Wait for some time and check again.