Microsoft SharePoint Online External Content Connector Error: Unable to create credential in Zurich

[bhakti2]

Hi Everyone,

I am facing an issue while setting up the Microsoft SharePoint Online External Content Connector in our Zurich Patch 7b instance.

Our Requirement:
We need to retrieve SharePoint Sites and make their content and metadata searchable in AI Search applications (specifically for Now Assist Virtual Agent and Teams Bot / Copilot).

Reference Document

https://www.servicenow.com/docs/r/platform-administration/search-administration/microsoft-
sharepoint-online-external-content-connector.html
https://www.servicenow.com/docs/r/platform-administration/search-administration/microsoft-sharepoint...

Configuration Details:

• Instance Version: Zurich Patch 7b
• OAuth 2.0 app configured in Microsoft Entra ID.
• Details provided by SharePoint Team: Application (client) ID, Directory (tenant) ID, JKS Certificate, JKS certificate password, and JKS certificate thumbprint.

Steps Performed:

1. Navigated to All > External Content Connectors > External Content Admin Home.
2. Selected the SharePoint Online tile and clicked Next.
3. Filled in all the required fields in the Settings tab using the details provided by the SharePoint team.
4. Clicked on Save and Validate.

Error Message:
As soon as we click Save and Validate, the system throws the following error:

Failed to create connection. Check the connection settings. Error : Unable to create/update connection configuration Detail : Error while creating credential.

System log Errors:
1. Failed to create jwt_provider record: Unable to validate keystore: Keystore was tampered with, or password was incorrect: no thrown error

2. Error while creating jwt provider records. Failed to create jwt_provider record: Unable to validate keystore: Keystore was tampered with, or password was incorrect: no thrown error

#AI Search, #GenAI, #Now Assist, #Virtual Agent, #SharePoint Connector

[Tanushree Maiti]

Hi @bhakti2 

Validate your connection setting using this KB: KB2106306 Validation Failure in External Content Connector 

Also check: Troubleshooting Flow Designer: "Error while retrieving Connection Record for Connection ID"

[Vikram Reddy]

Hello @bhakti2,

I'm assuming the .jks file the SharePoint team handed you was generated with a modern keytool, Java 9 or later, without explicitly forcing the keystore type, because that's almost always what sits behind this exact "Keystore was tampered with, or password was incorrect: no thrown error" message. Since Java 9, keytool defaults to PKCS12 even when the output file is named with a .jks extension, so ServiceNow's jwt_provider validation, which expects a genuine JKS keystore, throws this error regardless of whether the password is actually correct. It's a misleading message, it reads like a password problem when the real issue is the file format.

Have the SharePoint team regenerate the keystore with -storetype JKS on the keytool command, or -deststoretype JKS if they converted it from a .pfx, rather than just naming the output file .jks. While you're at it, confirm the password entered on the Certificate record matches the password entered on the JWT Keys record exactly, that's the second most common cause of this same error and an easy thing to fat-finger across two forms. Once the certificate loads clean, also check the thumbprint on the connection record is Base64 and not hex, a mismatch there throws a separate error later in validation and gets confused with this one.

Thank you,
Vikram Karety
Octigo Solutions INC