Update Outlook Actionable Messages authentication to Microsoft Entra ID

Microsoft will retire External Access Token (EAT) authentication for Outlook Actionable Messages on March 31, 2026. Microsoft Entra ID token authentication is required for Outlook Actionable Messages.

Before you begin

Role required: admin

About this task

Warning:

After Microsoft retired External Access Token (EAT) authentication for Outlook Actionable Messages on March 31, 2026, actionable messages that rely on EAT will stop working.

To ensure uninterrupted functionality with actionable message, you must migrate to Microsoft Entra ID token authentication and update the Outlook Actionable Messages app registration in your ServiceNow instance.

Procedure

1. Complete the Microsoft Entra ID setup for Actionable Messages.
   For more information, refer to Enabling AAD token of Actionable Messages.

   Important:

   If you already have an AM provider with Microsoft, migrate and regenerate the AM provider ID. If you do not have one, generate a new provider ID.
2. After completing the setup, copy the App ID Uri and the Provider Id (originator).

   

   

3. On your ServiceNow instance, update the sn_ms_oam.outlookactionable.originator System property value with the new Provider Id (originator) copied from Step 2.
4. Navigate to All > System OAuth > Application Registry.
5. Select Outlook Actionable.
6. On the form, in the Client ID field, update the ID with the App ID Uri that you copied in Step 2.
7. In the OAuth OIDC Provider Configuration field, open the Microsoft Office record.
   On the Microsoft Office OIDC Provider Configuration form, do the following:

   

   1. Update the OIDC Metadata URL to this format: https://sts.windows.net/{tenant-id}/.well-known/openid-configuration.
   2. Set the User Claim field to upn.

      

   3. Save the form.
8. Save the form.

Result

You are now migrated to Microsoft Entra ID token authentication and the Outlook Actionable Messages app registration is updated in your ServiceNow instance.