---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Integrate Azure Monitor with OAuth authentication

# Integrate Azure Monitor with OAuth authentication {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Integrate Microsoft Azure with Event Management by
authenticating Azure V1 or V2 tokens in the Azure Monitor.

## Before you begin

Ensure that the Event Management Connectors (sn_em_connector) plugin is
installed on the ServiceNow AI Platform instance.

On the Azure portal, alert correlation rules are defined through the Correlate alerts setting within Alert Processing Rules. When Correlate alerts is
assigned on the Azure portal, the Azure Monitor alerts received on the ServiceNow® instance within 60 minutes are grouped using tag based alert clustering.

Roles required: evt_mgmt_admin, web_service_admin, and oauth_admin

## About this task

Configure the Event Management environment for the collection of events from
Azure Monitor. In your Azure Monitor portal, set your ServiceNow AI Platform
instance as the rest endpoint using V1 or V2 tokens.

## Procedure

1. In the Azure Monitor portal:
   1. Perform app registration and expose an API.  
      For more information about registering an app and exposing an API in Azure, see <https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-expose-web-apis>.
   2. Create an action group with a secure webhook, and provide the rest endpoint as https://\<instance-name\>.service-now.com/api/sn_em_connector/em/inbound_event?source=azuremonitor.  
      Note:  
      If you have multiple tenants on the Azure portal and you want to use bidirectional functionality to acknowledge, close, or reopen an alert on the Azure Portal, then the URL for the secure webhook has to be in the following format: `https://<username>:<password>@<instance-name>.service-now.com/api/sn_em_connector/em/inbound_event?source=azuremonitor&event_class=<new_connector_instance_name>`. The \<new_connector_instance_name\> is the new Azure pull connector instance that you need to create for each tenant with other Azure service principal credentials. To know how to create the pull connector, see [Configure Azure Monitor Bi-directional connector](https://www.servicenow.com/docs/nuG9p3TpeF6wrWdpXynRlw "The Azure Monitor Pull connector sends information from ServiceNow Event Management to the Azure Portal. The pull connector sends the alert state changes from the ServiceNow environment to the Azure Portal.").

      For servicenowservices.com instances, the rest endpoint has to be https://\<instance-name\>.servicenowservices.com/api/sn_em_connector/em/inbound_event?source=azuremonitor.

      For more information about adding a secure webhook to an action group, see <https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups>.
   3. Navigate to AlertsManage Alert Rules.
   4. In the Secure Webhook section, make sure that Yes is selected for the Enable the common alert schema option.
   5. Add the action group with the secure webhook to an alert rule.
   {#azure-events-authentication__substeps_cjb_vkf_ymb}
2. In the Azure Monitor portal, verify which Azure token is in use by your registered application.
   1. Navigate to App Registration, and select the registered application.
   2. In the Manage section, click Manifest.
   3. In the editor screen, select the Microsoft Graph App Manifest tab and locate the requestedAccessTokenVersion parameter or select the AAD Graph App Manifest tab and locate the accessTokenAcceptedVersion parameter.  
      If the value of requestedAccessTokenVersion or accessTokenAcceptedVersion is 2, the integration must use V2 tokens.

      If the value of
      requestedAccessTokenVersion or accessTokenAcceptedVersion is 1 or null, the integration must use V1 tokens.
   {#azure-events-authentication__substeps_ky3_xc2_1nb}
3. In your ServiceNow AI Platform instance, ensure that the ServiceNow user is assigned with the correct Application (client) ID or Application ID URI.  
   Also ensure the relevant ServiceNow sys_user is assigned the evt_mgmt_integration role.
   1. Navigate to System SecurityUsers and groupsUsers.  
      Note:  
      To ensure proper authentication, use the least privileged user with the evt_mgmt_integration role, rather than a high privileged user.
   2. Verify that the Source field for the ServiceNow sys_user is populated with the correct Application (client) ID or Application ID URI, as defined in the Azure Monitor portal.  
      If the application is using an Azure V1 token, the Source field must be populated with the Application ID URI of the registered application. If the application is using an Azure V2 token, the Source field must be populated with the Application (client) ID of the registered application.  
      If the Source field is not displayed, change the form layout to display this field. Click the context menu icon (![Context menu icon]()) and select Configure \> Form Layout. Move Source to the Selected list.  
      Note:  
      If your ServiceNow AI Platform instance version is earlier than Paris Patch 2 or Orlando Patch 9, the Source field value must be enclosed in square brackets. For example, \[api://azuretest\].
   {#azure-events-authentication__substeps_tzv_xb1_2nb}
4. In your ServiceNow AI Platform instance, navigate to Event ManagementIntegrationsAzure OAuth Config.
5. Click Azure OAuth OIDC Entry and enter the <kbd class="ph userinput">Client ID</kbd>.  
   If the registered application is using an Azure V2 token, the <kbd class="ph userinput">Client ID</kbd> should be the same as the <kbd class="ph userinput">Application (client) ID</kbd> of the app registrations defined in your Azure Monitor portal.

   If the registered application is using
   an Azure V1 token, the <kbd class="ph userinput">Client ID</kbd> should be the same
   as the <kbd class="ph userinput">Application ID URI</kbd> of the app registrations
   defined in your Azure Monitor portal (the exposed API).
6. In the OAuth OIDC Provider Configuration field, click the info icon (![Info icon]()).
7. In the OIDC Provider Configuration window, click Open Record.  

8. Enter the <kbd class="ph userinput">OIDC Metadata URL</kbd> according to the Azure token used by the registered application, as shown in the following table.

   | Azure token | OIDC Metadata URL |
   | V2 | In the OIDC Provider Configuration form, add the following URL to the OIDC Metadata URL field: https://login.microsoftonline.com/\<tenant-id\>/v2.0/.well-known/openid-configuration Ensure that \<tenant-id\> is replaced with the correct Azure Tenant ID. Note: If attempting to integrate Azure Gov Cloud with the ServiceNow Azure Monitor Connector, remember to change the claim value to <kbd class="ph userinput">f1f34126-d4ef-40e1-ad4b-bf5d47b4860d</kbd>. |
   | V1 | In the OIDC Provider Configuration form: * In the Claim Name column, change <kbd class="ph userinput">azp</kbd> to <kbd class="ph userinput">appid</kbd>. Note: If attempting to integrate Azure Gov Cloud with the ServiceNow Azure Monitor Connector, remember to change the claim value to <kbd class="ph userinput">f1f34126-d4ef-40e1-ad4b-bf5d47b4860d</kbd>. * In the OIDC Metadata URL field, add the following URL: https://login.microsoftonline.com/\<tenant-id\>/.well-known/openid-configuration Ensure that \<tenant-id\> is replaced with the correct Azure Tenant ID. {#azure-events-authentication__ul_d4d_fvt_ymb} |
   |-|-|

   {#azure-events-authentication__choicetable_rbx_wgs_ymb}

## Result

When an alert is created in Azure Monitor as part of the alert rule, the notification is sent to the ServiceNow AI Platform using the secure webhook endpoint. In your ServiceNow AI Platform instance, navigate to All Events to see the events. If you want to send alert state changes on the ServiceNow instance from the ServiceNow alerts to the Azure Portal, you need to enable the Azure Monitor Bi-directional connector. For more information, see [Configure Azure Monitor Bi-directional connector](https://www.servicenow.com/docs/nuG9p3TpeF6wrWdpXynRlw "The Azure Monitor Pull connector sends information from ServiceNow Event Management to the Azure Portal. The pull connector sends the alert state changes from the ServiceNow environment to the Azure Portal.") .

*[\>]: and then