Overview
This document will cover the process of configuring a AWS Knowledge Bases to collect and index information Microsoft Sharepoint site. This document can help with this setup, but please know none of the screens you will see or setup is SurePath AI specific. After making this connection, you will need to setup a data source with the new AWS Knowledge Base.
High Level Steps
Create a Service Account (no SSO requirements) to be used as the authorization to get to the SharePoint Site
Create a new App Registration in Azure Entra that allows access to all SharePoint sites for your organization (granular control comes after this).
Configure the AWS Knowledge Base with the credentials you created
Sync the data from SharePoint to Knowledge Base
Add Data Contexts using this new Connector
Azure Setup
Prerequisites
You will need the following values to complete your configuration. Information on how to retrieve them will be included below.
Azure Entra administrative rights
Admin rights to AWS
Admin rights to the Sharepoint Site you would like to index
Admin rights to SurePath AI https://admin.surepath.ai
Output Checklist
Please collect the following information at the end of this process:
Application (client) ID
Directory (tenant) ID
SharePoint URL
App Registration secret
Create a service worker login
Please use the search bar if the icon or name is not visible.
Login to Microsoft Azure Portal:
Select Microsoft Entra ID
Navigate to Users -> New user
Add the new service account with a descriptive name
Be sure to disable two factor authentication for this account.
Once it's been added, this User Name needs to be added to the "Site Members" in the SharePoint site that you want to index.
Example: https://{domain}-admin.sharepoint.com
Please note that MS Teams sites look a little different, so be SURE that you add the new user to Site Members and not the teams members list that could show up.
Create a new App Registration
Login to Microsoft Azure Portal:
Select Microsoft Entra ID
Select App registrations > New Application
Enter the name AWS SharePoint Connector or another identifiable name.
Redirect URI (optional): Web
Leave the URI blank next to where you selected “Web”.
Select Register at the bottom of the page when done.
Capture the values from the following two items and get them to the SurePath engineers. In the future you will enter these into a self provisioning form in the SurePath Admin console.
Application (client) ID
Directory (tenant) ID
Select Manage > API permissions > Add a permission
Select the tile SharePoint
Select Application permissions
Select Sites.Read.All
Click the button Add permission at the bottom
Select Grant admin consent for {your organization here}
Select Yes on the pop-up screen.
The Status should have green checks on them now.
Add a secret that will be used in AWS
Select Certificates & Secrets -> Client secrets (0) -> New client secret
Enter a name of the secret and set the expire date
Be sure to capture your secret Value as this is your only chance to capture it.
AWS Setup
Prerequisites
You will need the following values to complete your configuration. Information on how to retrieve them will be included below.
Application (client) ID
Directory (tenant) ID
SharePoint URL
Username and user Password with access to the SharePoint site
App Registration secret
Admin rights to AWS
Output Checklist
Please collect the following information at the end of this process:
Application (client) ID
Directory (tenant) ID
SharePoint URL
App Registration secret
Create an AWS Secret
Login to AWS and navigate to the Secrets Manager > Store a new secret
Select Other type of secret
Enter the four (4) Key's and their associated values into the UI. The text/case must match exactly on the keys
clientId (value is from the Azure App Registration)
clientSecret (value is the secret you created in the Azure App Registration)
username (value is the service account you created)
password (value is the service account password you created)
Click Next when done
Enter a Secret name
Please note there can be no spaces
Click Next and Save until you are done and back at the main Secret screen
Setup a new AWS Knowledge Base
Access AWS BedRock > Builder Tools > Knowledge Bases > Create
Select Knowledge Base with vector store
Enter a Knowledge Base name or leave the default
Leave IAM permissions > Create and use a new service role
Update the Service role name or leave default
Scroll down a bit and select Sharepoint - Preview
Then select Next (not shown)
Enter a data source Name or leave the default
Set the Source > Site URLs
URLs can be no more specific than the site name.
Example: https://lucidwayio.sharepoint.com/sites/help_desk
Only click Add new url if you need more than one SharePoint Site
Enter the Domain
This needs to be the name of your domain in Sharepoint and is not a DNS domain. This is the first part of the Sharepoint link from the previous step.
Example: Correct domain = lucidwayio Incorrect domain = lucidwayio.com
See graphic below
In Authentication, leave it set to OAth 2.0 authentication
Enter the Tenant ID from Azure
Enter the AWS Secrets Manager secret you created earlier
This needs to be the full arn. You can get this from looking at the details of the Secret in Secret Manager and copying it directly from the screen.
Leave everything else default, and select Next at the bottom of the page.
Click on Select Model > Titan Text Embeddings V2
Click Apply
Leave everything on the rest of the page default, and select Next.
Review and select Create Knowledge Base when done.
Your new Knowedge Base will be created and will Sync the data
NOTE: Your new Knowledge Base will not Sync automatically. It must either be done or an automated process can be created to do this for you on a regular schedule.
SurePath AI Setup
Create a new Connector
Note: If you already have an AWS Connector for a Private Model, you can skip this part. The connector is the same for S3 buckets, Private Models, and Knowledge Bases.
Please add a connector using the Create an AWS Connector instructions here
Create the Data Source
A Data Source can now be created and you can provide access to it using the following document