Configuring Amazon Quick with the Microsoft Teams Extension
Learn how to integrate Amazon Quick with Microsoft Teams so your users can chat with AI agents, retrieve business insights, and trigger automations — without leaving Teams. This step-by-step guide covers the complete administrator setup: Azure App Registration, AWS IAM Identity Center trusted token configuration, Secrets Manager credential storage, and IAM Role creation — followed by extension deployment in Quick and admin consent in the Microsoft Teams Admin Center.
This guide walks you through the complete setup of the Amazon Quick Microsoft Teams extension. Once configured, users can chat with Quick chat agents, and retrieve business insights — all without leaving Microsoft Teams. The guide covers four parts: Azure App Registration, AWS backend configuration (IAM Identity Center, Secrets Manager, IAM Role), Quick extension deployment, and Teams Admin Center consent. End-user setup is covered in Part 4.
Prerequisites
Before starting, confirm the following are in place:
| Requirement | All Setups | IAM Identity Center Only |
|---|---|---|
| Amazon Quick instance | Required | |
| Microsoft 365 Business subscription with Teams | Required | |
| Microsoft Entra ID (Azure AD) tenant | Required | |
| Microsoft 365 Tenant ID | Required — find at: Azure Portal → Azure Active Directory → Properties | |
| IAM Identity Center enabled on AWS account | Required | |
| Microsoft Entra ID as Identity Provider in IAM IC | Required | |
| SCIM identity propagation (Entra ID → IAM Identity Center) | Required | |
| Email addresses on all Entra ID users | Required |
This diagram illustrates the complete authentication and request flow between Microsoft Teams and Amazon Quick:
End-to-End Authentication Flow Diagram
- User in Microsoft Teams types a message to the Amazon Quick app.
- The Teams client routes the request to the Amazon Quick extension endpoint in AWS.
- Quick redirects the user to Microsoft Entra ID (Azure AD) for OAuth authentication, using the Azure App Registration created in Step 1 of Part 1.
- Entra ID issues a signed OAuth token containing the user's email address.
- Quick validates this token against the Trusted Token Issuer configured in the AWS IAM Identity Center, using the issuer URL: https://login.microsoftonline.com/{Tenant-ID}/v2.0.
- IAM Identity Center maps the Entra email address to the corresponding Quick user (via SCIM propagation).
- Quick grants access based on the user's assigned role and returns the AI response back through the Teams interface.
All credential exchange happens server-side via the IAM Role and Secrets Manager secret. The Teams client never handles raw AWS credentials. Access is role-based and governed by permissions defined in the Quick console.
PART 1 — Administrator Setup (Extension Access Configuration)
Completed by: AWS Administrator + Microsoft 365 Global Admin or Application Administrator.
This part wires the identity federation chain. Option A (below) covers the most common enterprise setup: IAM Identity Center with Microsoft Entra ID as the identity provider.
This part wires the identity federation chain. Option A (below) covers the most common enterprise setup: IAM Identity Center with Microsoft Entra ID as the identity provider.
Step 1: Create Azure App Registration
Permissions needed: Global Admin or App Registration permissions in Microsoft Entra ID.
Permissions needed: Global Admin or App Registration permissions in Microsoft Entra ID.
- Sign in to the Microsoft Entra admin center as at least an Application Developer .
- Browse to Entra ID → App registrations → click New registration.
- Under Supported account types, select: Accounts in this organizational directory only (Single tenant).
[Entra Admin Center: New App Registration Form]
- Click Register.
Step 1: Save Client ID and Tenant ID (continued)
After registration, the app overview page displays two critical values that must be saved:
• Application (Client) ID — a GUID that identifies your Azure app to Quick Suite
• Directory (Tenant) ID — your Microsoft 365 tenant identifier (36-character UUID)
• Directory (Tenant) ID — your Microsoft 365 tenant identifier (36-character UUID)
Copy both values and store them securely — they are required in Steps 4 and 6.
Step 1: Create Client Secret (continued)
- Go to Certificates & secrets in the left navigation of your app registration.
Certificates & Secrets: New Client Secret Created
- Click New client secret.
- Enter a description (e.g., 'Quick-Teams') and set an expiry period.
- Click Add.
IMPORTANT: Immediately copy the value column — it is only shown once and cannot be retrieved later.
This secret value (combined with the Client ID) is stored in AWS Secrets Manager in Step 4.
Step 2: Add Callback (Redirect) URLs
Permissions needed: Application Administrator or Global Admin in Microsoft Entra ID.
- In your app registration, click the Authentication tab.
- Under Platform configurations, click Add a platform → Web.
Authentication Tab: Redirect URI Configuration
- Enter the redirect URI in this format (replace {your-region}):
https://qbs-cell006.dp.appintegrations.{your-region}.prod.plato.ai.aws.dev/auth/idc-tti/callbackClick Configure. - Click Configure.
Supported AWS Regions: us-east-1 (N. Virginia), us-west-2 (Oregon) and eu-west-1 (Ireland)
Use the region where your Amazon Quick instance is deployed.
Use the region where your Amazon Quick instance is deployed.
1
Example Redirect URI (us-east-1):https://qbs-cell006.dp.appintegrations.us-east-1.prod.plato.ai.aws.dev/auth/idc-tti/callback Step 3: Configure Trusted Token Issuer in IAM Identity Center
Permissions needed: AWS Administrator access with IAM Identity Center permissions.
- In the AWS Console, navigate to IAM Identity Center.
- Go to Settings → Authentication tab.
- Click Create trusted token issuer.
- Set the Issuer URL (replace {Tenant-ID} with your Microsoft 365 Tenant ID from Step 1).
https://login.microsoftonline.com/Tenant-ID/v2.0
- For both 'Identity Provider attribute' and 'IAM Identity Center attribute', choose: Email.
- Complete the wizard and save the Trusted Token Issuer ARN for use in Step 6.
1
2
3
4
5
6
7
8
9
10
11
12
13
Trusted Token Issuer URL format:
https://login.microsoftonline.com/{Tenant-ID}/v2.0
Example:
https://login.microsoftonline.com/a1b2c3d4-e5f6-7890-abcd-ef1234567890/v2.0
Attribute mapping:
Identity Provider attribute : Email
IAM Identity Center attribute: Email
Save the resulting ARN:
arn:aws:sso::123456789012:trustedTokenIssuer/ssoins-xxx/tti-xxxStep 4: Create AWS Secrets Manager Secret
Permissions needed: AWS Administrator access with Secrets Manager permissions.
- In the AWS Console, go to AWS Secrets Manager.
- Click Store a new secret.
- Select Other type of secret, then click the Plaintext tab.
- Enter the JSON below (use values saved in Step 1).
- Complete the wizard and save the Secret ARN for Step 6.
1
2
3
4
5
Secret JSON (Plaintext format):
{
"client_id": "your-app-registration-client-id",
"client_secret": "your-app-registration-client-secret"
}- Navigation:
AWS Console → Secrets Manager → Store a new secret → Other type of secret → Plaintext tab
Step 5: Create IAM Role for Quick Suite Extension
Permissions needed: AWS Administrator access with IAM permissions.
Permissions needed: AWS Administrator access with IAM permissions.
- In the AWS Console, go to IAM → Roles → Create role.
- Choose Custom trust policy and paste the trust policy below (replace {your-region}).
- Name the role, create it, then add the inline permissions policy below.
- Save the Role ARN for Step 6.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
Trust Policy (replace {your-region}):
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Service": "{your-region}.prod.appintegrations.plato.aws.internal"},
"Action": "sts:AssumeRole"
}]
}
Inline Permissions Policy:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue",
"sso:DescribeTrustedTokenIssuer"
],
"Resource": "*"
}]
Step 6: Create Extension Access in Quick Suite Console
Permissions needed: Quick Suite Administrator or Author role.
- Sign in to the Amazon Quick Suite console.
- Click your profile icon (top right) → Manage account.
- Under AWS Resources, select AWS Secrets Manager → choose your secret → Finish → Save.
- Under Permissions, select Extension access → click Add extension access.
- Fill in the Trusted Token Issuer ARN (Step 3) and Aud claim Client ID (Step 1) → click Add.
- Select Microsoft Teams → Next.
- Fill in the extension fields (see table below) → click Add
| Field | Value / Source |
|---|---|
| Trusted Token Issuer ARN | ARN from Step 3 (IAM Identity Center trusted token issuer) |
| Aud claim (Client ID) | Application (client) ID from Entra App Registration (Step 1) |
| Name | Descriptive name for the extension (e.g., QuickSuite-Teams-Prod) |
| Description | Optional free-text description |
| M365 Tenant ID | 36-character Microsoft 365 Directory Tenant ID (from Step 1) |
| Secrets Role ARN | IAM Role ARN created in Step 5 |
| Secrets ARN | Secrets Manager Secret ARN from Step4 |
PART 2 — Deploy the Extension
Completed by: Quick Suite Administrator or Author.
This part deploys the Teams extension within Quick Suite and prepares it for Teams Admin Center installation.
This part deploys the Teams extension within Quick Suite and prepares it for Teams Admin Center installation.
Step 1: Open Extensions
Sign in to the Amazon Quick Suite console. In the left navigation panel, select Extensions.
Step 2: Create Extension
Click Create extension. A setup wizard opens.
Step 3: Select Microsoft Teams
From the available extension types, select Microsoft Teams → click Next.
Step 4: Configure
Fill in:
• Name: Edit the pre-filled name if desired
• Description: Optional
• Installation type: OAuth (default — do not change)
Click Next.
• Name: Edit the pre-filled name if desired
• Description: Optional
• Installation type: OAuth (default — do not change)
Click Next.
Step 5: Install the Extension
- From the Extension summary page, find your extension.
- Click Actions → Install → click Install in the confirmation dialog.
- After the success message, click 'Install extension'.
- A link to Microsoft Teams Admin Center is provided — save it for Part 3.
PART 3 — Add App to Microsoft Teams Admin Center
Completed by: Microsoft 365 Global Admin or Teams Administrator (AppCatalog.ReadWrite.All permission).
This part grants the Quick Suite app consent in Teams, making it available to all users in your tenant.
This part grants the Quick Suite app consent in Teams, making it available to all users in your tenant.
Step 1: Open Teams Admin Center
Open the link from Part 2 Step 5, or navigate to https://admin.teams.microsoft.com.
Step 2: Sign in
Log in as Global Admin or with Teams Administrator + AppCatalog.ReadWrite.All permissions.
Step 3: Find Amazon Quick Suite
In the left navigation, choose Teams apps. Search for or locate 'Amazon Quick Suite' in the apps list.
Step 4: Grant Admin Consent
Select the Quick Suite app → go to the Permissions tab → click Grant admin consent.
Authenticate when prompted → click Accept to grant the required OAuth permissions.
Authenticate when prompted → click Accept to grant the required OAuth permissions.
Step 5: Verify Consent Granted
After accepting, return to the Permissions tab.
Confirm the status reads: 'Admin consent granted for all required permissions'.
This confirmation is required before any end user can sign in through Teams.
Confirm the status reads: 'Admin consent granted for all required permissions'.
This confirmation is required before any end user can sign in through Teams.
PART 4 — End User Setup
Completed by: Standard Microsoft Teams users.
Once Parts 1–3 are complete, users can add Quick Suite themselves — no IT involvement needed.
Once Parts 1–3 are complete, users can add Quick Suite themselves — no IT involvement needed.
Step 1: Open Microsoft Teams
Launch the Microsoft Teams desktop or web client.
Step 2: Find Quick Suite in Apps
Click Apps in the left navigation. In the search bar, type 'Quick Suite'.
Step 3: Add the App
Select Quick Suite from results and click Add. The Quick Suite icon now appears in the Teams sidebar.
Step 4: Start Chatting
Click the Quick Suite icon to open a direct conversation. Use the gear icon to select a specific agent or space.
Using Quick in Microsoft Teams
| Mode | How to Use | Notes |
|---|---|---|
| Direct Chat | Click the Quick Suite icon in sidebar → type your question or request | Use gear icon to select a specific agent or space |
| Channel Mention | In any channel, type @Amazon Quick Suite followed by your question | Quick replies in the thread context |
| Actions | In direct messages, ask Quick Suite to perform tasks via configured connectors | Supports ServiceNow, Jira, Asana, PagerDuty and more |
| New Conversation | Type /new_conv to start a fresh session | Clears previous conversation context |
Security Note: When Quick Suite is invoked in a public Teams channel, responses are based on the invoking user's permissions. This may include content that other channel members are not authorized to see. Evaluate carefully before enabling Quick Suite in public channels. Prefer private channels or direct messages for sensitive queries.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article