Set up service credentials

Before you create the knowledge base in Amazon Quick, complete the following configuration steps in AWS and Microsoft Entra ID. You create a KMS signing key, generate a certificate, register an application in Entra, and grant Amazon Quick permission to use the key.

This setup involves multiple systems and might require coordination between different administrators in your organization. The following table summarizes each step and the role needed to complete it.

Prerequisites

Before you begin, make sure that you have the following:

Permissions

The permissions you assign depend on two choices:

Choose your permission scope

By default, the Entra app registration uses Sites.Read.All or Sites.FullControl.All, which grants access to all SharePoint sites in your tenant. If your organization requires least-privilege access, you can use Sites.Selected instead. With Sites.Selected, the app can only access sites that you explicitly grant permission to.

All sites – content only (no ACL)

All sites – with ACL crawling

Sites.Selected – content only (no ACL)

Sites.Selected – with ACL crawling

Values collected during setup

The following table summarizes the values you create or collect during setup and where you use them.

Step 1: Create an AWS KMS asymmetric signing key

Amazon Quick uses an AWS KMS asymmetric key to sign OAuth assertions when authenticating with Microsoft Entra ID. The private key never leaves KMS. Only the public key is exported and embedded in a certificate that gets uploaded to your Entra app registration.

Create the KMS key

Configure the key

On the Configure key page, set the following values:

Add labels

On the Add labels page, enter an alias for the key. For example: quick-sharepoint-service-auth.

Choose Skip to review, then choose Finish to create the key.

Record the Key ARN

After the key is created, open the key detail page and record the Key ARN. The ARN has the following format:

arn:aws:kms:us-west-2:123456789012:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

You need this value in Steps 2, 4, and when you create the knowledge base in Quick.

Step 2: Generate a self-signed certificate

Microsoft Entra ID requires an X.509 certificate to validate signed assertions. Because the KMS private key never leaves AWS KMS, you cannot use it directly with OpenSSL. Instead, you generate a temporary local key pair and create a certificate signing request. Then, use the OpenSSL -force_pubkey option to inject the KMS public key into the final certificate. The result is a self-signed certificate whose public key matches the KMS key pair.

Prerequisites

Generate the certificate

Run the following commands in a terminal. Replace the placeholder values with your own.

Verify OpenSSL version

openssl version

Confirm the output shows version 3.0 or later.

Export the KMS public key

aws kms get-public-key \
    --key-id KMS_KEY_ARN \
    --region REGION \
    --output text \
    --query PublicKey | base64 --decode > public_key.der

Convert the public key to PEM format

openssl rsa -pubin -inform DER -in public_key.der -outform PEM -out kms_public_key.pem

Generate a temporary local key pair

openssl genrsa -out temp_private_key.pem 2048

Create a certificate signing request

openssl req -new \
    -key temp_private_key.pem \
    -out cert.csr \
    -subj "/CN=QuickSharePointServiceAuth/O=YourOrganization/C=US"

Generate the certificate with the KMS public key

openssl x509 -req \
    -in cert.csr \
    -signkey temp_private_key.pem \
    -out certificate.pem \
    -days 730 \
    -force_pubkey kms_public_key.pem

Convert to DER format for Entra upload

openssl x509 -in certificate.pem -outform DER -out certificate.cer

Clean up temporary files

rm -f temp_private_key.pem cert.csr public_key.der kms_public_key.pem certificate.pem

Calculate the certificate thumbprint

Run the following command to calculate the base64url-encoded SHA-1 thumbprint of the certificate:

openssl dgst -sha1 -binary certificate.cer | base64 | tr '+/' '-_' | tr -d '='

Record this value. You enter it when you create the knowledge base in Quick.

Step 3: Register an application in Microsoft Entra ID

This step is required regardless of whether you use all-sites permissions or Sites.Selected. The only difference is which API permissions you assign in the Configure API permissions section.

Register the application

Record application details

On the application Overview page, record the following values:

Configure API permissions

Add the permissions that match your use case. Choose the permissions from the tables in the Permissions section. Base your selection on your permission scope (all sites or Sites.Selected) and whether you enable ACL crawling.

Content only – Microsoft Graph

Content only – SharePoint

ACL crawling – Microsoft Graph (additional)

ACL crawling – SharePoint

Grant admin consent

Upload the certificate

Step 3b: Grant site-level permissions (Sites.Selected only)

If you chose Sites.Selected as your permission scope, you must explicitly grant your Amazon Quick Entra app access to each SharePoint site. This requires a temporary admin app with Sites.FullControl.All permission to call the Microsoft Graph API.

Skip this step if you are using the all-sites permission scope (Sites.Read.All or Sites.FullControl.All).

Get the Site ID for each SharePoint site

You need the Site ID for each SharePoint site you want to grant access to. To get a Site ID:

Repeat for each site you want to include in the knowledge base.

Create a temporary admin app

The admin app is used only to grant site-level permissions to your Amazon Quick app. You can delete it after completing this step.

Get an access token

Use the admin app credentials to retrieve an OAuth token from Microsoft Entra. Replace the placeholder values with your admin app's client ID, secret value, and tenant ID.

macOS and Linux (bash)

curl -s --location "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=ADMIN_APP_CLIENT_ID" \
  --data-urlencode "client_secret=ADMIN_APP_SECRET_VALUE" \
  --data-urlencode "scope=https://graph.microsoft.com/.default"

Windows (PowerShell)

$tokenResponse = Invoke-RestMethod `
  -Uri "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token" `
  -Method Post `
  -ContentType "application/x-www-form-urlencoded" `
  -Body @{
    grant_type    = "client_credentials"
    client_id     = "ADMIN_APP_CLIENT_ID"
    client_secret = "ADMIN_APP_SECRET_VALUE"
    scope         = "https://graph.microsoft.com/.default"
  }
$adminToken = $tokenResponse.access_token

The response contains an access_token field. Record this value for the next step.

Grant site-level permissions

Use the admin token to grant your Amazon Quick Entra app fullcontrol access to each SharePoint site. Replace the placeholder values with your Site ID, admin token, and the client app ID and display name from Step 3.

macOS and Linux (bash)

curl -s --location "https://graph.microsoft.com/v1.0/sites/SITE_ID/permissions" \
  --header "Content-Type: application/json" \
  --header "Authorization: Bearer ADMIN_TOKEN" \
  --data '{
    "roles": ["fullcontrol"],
    "grantedToIdentities": [{
      "application": {
        "id": "CLIENT_APP_ID",
        "displayName": "CLIENT_APP_NAME"
      }
    }]
  }'

Windows (PowerShell)

$body = @{
    roles = @("fullcontrol")
    grantedToIdentities = @(
        @{
            application = @{
                id          = "CLIENT_APP_ID"
                displayName = "CLIENT_APP_NAME"
            }
        }
    )
} | ConvertTo-Json -Depth 10

Invoke-RestMethod `
  -Uri "https://graph.microsoft.com/v1.0/sites/SITE_ID/permissions" `
  -Method Post `
  -Headers @{
    "Content-Type"  = "application/json"
    "Authorization" = "Bearer $adminToken"
  } `
  -Body $body

A successful response includes "roles": ["fullcontrol"] and the client app ID in the grantedToIdentities field.

Clean up

After you have granted permissions to all required sites, you can delete the temporary admin app from the Microsoft Entra admin center. The site-level permissions you granted remain in effect independently of the admin app.

Step 4: Grant Amazon Quick permission to the KMS key

Amazon Quick needs permission to use the KMS key for signing OAuth assertions. You grant this permission from the Amazon Quick admin console.

Next steps

After you complete the setup, create the SharePoint Online knowledge base connection in Amazon Quick. For instructions, see Create the knowledge base in Amazon Quick.