RemcoLengers
ServiceNow Employee
ServiceNow Employee

This post describes OAUTH 2.0 authentication method to integrate Azure Monitor into ServiceNow ITOM Event Management. 

 

In <this> blog I explained the simplest method to integrated Azure Monitor. However using Oauth 2.0 is considered to be more secure as the credentials are not transmitted with each REST call, only the temporary token which gets regularly renewed. The official documentation can be found <here>.

 

The high level steps are:

 

1. Configure an "App Registration" in Azure

2. Create an Integration User in ServiceNow

3. Configure "Azure OAuth Config" in ServiceNow

4. Setup an Azure Event integration in the "Service Operations Workspace", "Integration Launch pad"

5. Configure the "Action Group" in Azure Monitor and test the integration

 

* One thing to note is the Oauth 2.0 can use v1 and v2  tokens so depending on which one you need to use the procedure is the same but the data entered has slight variations.

 

The screenshots are with v1 tokens, the changes needed for v2 tokens are pointed out in the text but are summarised below for clarity.

 

There are 4 places in the configuration process where there are differences 

- Manifest file "accessTokenAcceptedVersion" (null, 1 (v1) or 2 (v2))

- Application string to use  "Application ID URI" (v1)  or  "Application (client) ID" (v2)

- Remove "v2.0" from the  "OIDC Metadata URL" when using v1 tokens

- Claim name to use appid (v1) or azp (v2)

 

Configure an "App Registration" in Azure

 

Create a new App in "App registrations"

 

RemcoLengers_0-1756994127659.png

Generate a new "Application ID URI"

RemcoLengers_1-1756994362401.png

 

Add an "Application ID URI" 

 

RemcoLengers_2-1757001195103.png

 

Add and Save

RemcoLengers_3-1757001254869.png

This will have the following result:

For V1 tokens copy the "Application ID URI" field.

For V2 tokens copy the "Application (client) ID" field. 

RemcoLengers_0-1757004513233.png

From the "Endpoints" copy the "OpenID Connect metadata document" :

RemcoLengers_0-1757004670845.png

 

In the "App registration" "Manifest" file the "accessTokenAcceptedVersion": null," or 1 is correct for v1 tokens. For v2 tokens use 2. 

RemcoLengers_1-1757060952823.png

 

You may need to add yourself as the owner of the App registration so it will show up in the Action Group at the end later.

 

RemcoLengers_2-1757009632080.png

 

Create an Integration User in ServiceNow

Go to "User Administration - Users" and

1. create a new user and

2 assign the "evt_mgmt_integration" role.

3. Add the "Source" Field to the form and copy the V1 "Application ID URI".

 

So the result looks like

RemcoLengers_0-1757005688654.png

 

Config "Azure OAuth Config" in ServiceNow

In the ServiceNow instance goto "Azure Oauth Config"

RemcoLengers_0-1757006014462.png

 

And edit the existing "Azure OAuth OIDC Entity"

RemcoLengers_1-1757006127555.png

 

Step 1 Update the "Client ID" with  the V1 "Application ID URI" and Save.

RemcoLengers_0-1757006548888.png

 

 

Step 2 Open the record with the label "OAuth OIDC Provider Configuration" and edit the record to enter the "OpenID Connect metadata document" data in the "OIDC Metadata URL" field. Note for v1 tokens remove the "v2.0" part from the URL:

 

RemcoLengers_1-1757006853659.png

And Save.

 

Final configuration on the same record is the "JWT Claim Validations". for V1 tokens the claim name needs to be "appid" and for v2 tokens it needs to be "azp" which is the default.

RemcoLengers_1-1757007331523.png

 

Setup an Azure Event integration in the "Service Operations Workspace", "Integration Launch pad".

RemcoLengers_3-1757009034263.png

 

Give the integration a name

 

 

RemcoLengers_0-1757009285597.png

Save and activate and copy the URL.

RemcoLengers_1-1757009349459.png

 

Configure the "Action Group" in Azure Monitor and test the integration

Goto Monitor, Alerts and then "Action Groups". Edit and existing action group or create a new one.

RemcoLengers_0-1757007535738.png

And "Edit"

RemcoLengers_1-1757008665512.png

In "Actions" add a line with a "Secure Webhook". Use the correct Object ID (App registration) and the URI needs to be the URL you collected from the Integration Launch Pad -  Azure Event Integration. 

RemcoLengers_0-1757059111004.png

 

Then select "Test action group"

RemcoLengers_1-1757059357861.png

 

And if all is well:

RemcoLengers_0-1757059496663.png

 

See the Event show up in the Event Management Integration. Nice!

RemcoLengers_0-1757066812904.png

 

 

If you think this is helpful and it is worth investing time in writing these blog posts click the "ThumbsUp" button.