Building an Enterprise RAG System with SharePoint Online and Amazon Quick

This article demonstrates how to build an enterprise RAG system using Amazon Quick and SharePoint Online while preserving document-level permissions through Microsoft Entra ID integration.

• Amazon Quick collapses multi-component RAG stack into managed service with automatic crawling and indexing of SharePoint content
• Federate Microsoft Entra ID identities to AWS IAM Identity Center for accurate access control enforcement at query time
• Create AWS KMS asymmetric RSA-2048 signing key and register connector application in Entra ID with required API permissions
• Enable document-level ACL control in Quick knowledge base to sync SharePoint permissions and perform real-time access checks
• Solution enforces two-stage access: syncs SharePoint ACLs on 24-hour schedule and validates user permissions at query time
• Requires Enterprise edition Quick subscription, KMS signing key charges, and vector storage costs based on document volume

The managed approach eliminates building custom RAG pipelines while maintaining enterprise security and permission models for SharePoint-based institutional knowledge.