SAM Pro integration with SSO

[JoaquinA2974062]

Team,

I'm trying to enable this SSO integration from ServiceNow SAM Pro to Azure Entra ID but it gives me an error, it says Auditlog.Read.ALL doesn't have the right permissions, even when Entra ID shows "Delegated" which is what ServiceNow suggests, any idea?

[NPatel21]

Hi @JoaquinA2974062 

I have successfully enabled SSO Integration to Azure Entra ID. 

For the Azure AD Part I had to ask an internal team to set it up as I don't have permissions.

Here are screenshots from my portal of Azure AD so you can compare with yours. I labelled it 1,2,3 matching the 3 sections i have put below:

1. Add permissions to access the Microsoft Graph API.

2. Add permissions to access Microsoft Graph

   In addition to accessing your own web API on behalf of the signed-in user, your application might also need to access or modify the user's (or other) data stored in Microsoft Graph. Or you might have service or daemon app that needs to access Microsoft Graph as itself, performing operations without any user interaction.

   Delegated permission to Microsoft Graph

   Configure delegated permission to Microsoft Graph to enable your client application to perform operations on behalf of the logged-in user, for example reading their email or modifying their profile. By default, users of your client app are asked when they sign in to consent to the delegated permissions you've configured for it.

   1. From the Overview page of your client application, select API permissions > Add a permission > Microsoft Graph
   2. Select Delegated permissions. Microsoft Graph exposes many permissions, with the most commonly used shown at the top of the list.
   3. Under Select permissions, select the following permissions:

   Expand table

   Permission	Description
   email	View users' email address
   offline_access	Maintain access to data you have given it access to
   openid	Sign users in
   profile	View users' basic profile

   1. Select Add permissions to complete the process.

   Whenever you configure permissions, users of your app are asked at sign-in for their consent to allow your app to access the resource API on their behalf.

   As an admin, you can also grant consent on behalf of all users so they're not prompted to do so. Admin consent is discussed later in the More on API permissions and admin consent section of this article.

3. Application permission to Microsoft Graph

   Configure application permissions for an application that needs to authenticate as itself without user interaction or consent. Application permissions are typically used by background services or daemon apps that access an API in a "headless" manner, and by web APIs that access another (downstream) API.

   In the following steps, you grant permission to Microsoft Graph's Files.Read.All permission as an example.

   1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
   2. If you have access to multiple tenants, use the Settings icon  in the top menu to switch to the tenant containing the app registration from the Directories + subscriptions menu.
   3. Browse to Entra ID > App registrations, and then select your client application.
   4. Select API permissions > Add a permission > Microsoft Graph > Application permissions.
   5. All permissions exposed by Microsoft Graph are shown under Select permissions.
   
   1. Select the permission or permissions you want to grant your application. As an example, you might have a daemon app that scans files in your organization, alerting on a specific file type or name. Under Select permissions, expand Files, and then select the Files.Read.All permission.
   2. Select Add permissions.
   3. Some permissions, like Microsoft Graph's Files.Read.All permission, require admin consent. You grant admin consent by selecting the Grant admin consent button, discussed later in the Admin consent button section.

Important Notes:

Make sure you have the latest plugin installed on your instance

And make sure you use Client Secret Value

Hope this works for you

Neena