---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Set up Microsoft Entra ID spoke

# Set up Microsoft Entra ID spoke {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Integrate the ServiceNow instance and your Microsoft Entra account by creating a custom OAuth application in Microsoft Entra ID to authenticate ServiceNow requests.

## Before you begin

* Request an Integration Hub subscription.
* Activate the Microsoft Entra ID spoke.
* Role required: admin.
{#set-up-azure__ul_k2k_mph_gfa}

## Create an Microsoft Entra ID application {#ariaid-title2}

Create a custom app using your Azure portal to enable OAuth 2.0 authentication with the Microsoft Entra ID spoke.

### Before you begin

* Request Integration Hub subscription.
* Activate the Microsoft Entra ID spoke.
* Microsoft Entra ID spoke requirements:
  * Microsoft Entra ID account
  * Microsoft Entra ID administrator credentials
  {#configure-azure-ad-account__ul_v15_5vl_blb}
* Role required: admin
{#configure-azure-ad-account__ul_l2l_mph_gfb}

### About this task

Complete these steps from your Azure portal. See the [Microsoft identity platform documentation](https://learn.microsoft.com/en-us/entra/identity-platform/) documentation for instructions on creating and configuring custom applications.

### Procedure

1. From your Azure portal, access Microsoft Entra ID.
2. Create an Microsoft Entra ID application.  
   Alternatively, you can use an existing application. Ensure that you configure the existing application as outlined here.
3. Navigate to App registrations and click New registration.
4. On the form, fill the values.
5. In Redirect URI, enter your ServiceNow instance URL in this format: <kbd class="ph userinput">https://&lt;Instance-Name&gt;.service-now.com/oauth_redirect.do</kbd>.  
   See [Create a Microsoft Entra application and service principal that can access resources](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) for instructions on registering and configuring an application.  
6. Click Register.  
   The application is created and the required details are displayed.
7. Copy and record the value of Directory ID.  
   This value is required to register the app as a third-party OAuth provider on your ServiceNow instance.  
8. Click Certificates \& secrets.
9. Click New client secret.  
   Secret is generated and displayed.
10. Copy and record the value.  
    This value is required to register the app as a third-party OAuth provider on your ServiceNow instance.  
11. Click API permissions.
12. Click Add a permission to add the required permissions to access the APIs.  
    For information about permissions needed to perform the required actions, see the Spoke actions section here: [Spoke actions](https://www.servicenow.com/docs/_m4XzxyR5S_cY1AN~6hqXA#microsoft-azure-ad-spoke__section_aqj_3hf_kfb).
13. Grant admin consent to your application.  
    See [Quickstart: Configure a client application to access a web API](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis#understanding-api-permissions-and-admin-consent-ui) for more information.
{#configure-azure-ad-account__steps_vs3_4wl_blb}

## Configure a connection for the Microsoft Entra ID spoke {#ariaid-title3}

Configure a connection to your Microsoft Entra ID account. The Microsoft Entra ID spoke connection and credential aliases use these connections to perform actions in the Microsoft Entra ID.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllProcess AutomationWorkflow Studio.
2. Click the Integrations tab.
3. Under Connections, toggle and enable the Outbound connections.
4. Locate the alias for AzureAD and click View Details.  
   * To configure the default connection and credential alias record that is shipped along with the Entra ID spoke, click View Details.

   * To manage more than one Entra ID spoke connection records, you should create a new child alias record by clicking Add Connection. For more information about using multiple connections, see [Supporting multiple connections](https://www.servicenow.com/docs/_lq_yIU58hH6WV7QrgzfAg "Support several connections to a single integration provider. Select connections for flows, subflows, and actions directly from a flow.").

   {#ms-azure-ad-temp__ul_rb41_w2e_pbc}

   If you are configuring the spoke for the first time, click Configure. Otherwise, click Edit.

5. On the form, fill in these fields:  
   {#ms-azure-ad-temp__table_r1j_dby_hcc__entry__2}

   | Field | Value required |
   |-|-|
   | Connection Information ||
   | Name | Auto-generated name to identify the connection record. |
   | Credential Information ||
   | Auth URL | Authorization URL in this format: <kbd class="ph userinput">https://login.microsoftonline.com/&lt;Directory ID&gt;/oauth2/v2.0/authorize</kbd>. Replace <kbd class="ph userinput">&lt;Directory ID&gt;</kbd> with the directory ID in your Entra ID configuration. |
   | Token URL | Token URL in this format: <kbd class="ph userinput">https://login.microsoftonline.com/&lt;Directory ID&gt;/oauth2/v2.0/token</kbd>. Replace <kbd class="ph userinput">&lt;Directory ID&gt;</kbd> with the directory ID in your Microsoft Entra ID configuration properties. |
   | Revoke token URL | Revoke token URL in this format: <kbd class="ph userinput">https://login.microsoftonline.com/&lt;Directory ID&gt;/oauth2/v2.0/revoke</kbd>. Replace <kbd class="ph userinput">&lt;Directory ID&gt;</kbd> with the directory ID in your Entra ID configuration properties. |
   | OAuth Client ID | Client ID you created during the Entra ID application registration. |
   | OAuth Client Secret | Key value you created during the Entra ID application registration. |
   | OAuth Redirect URL | Redirect URL of your ServiceNow instance in this format: <kbd class="ph userinput">https://&lt;instance-name&gt;.service-now.com/oauth_redirect.do</kbd>. |
   [ ]

   {#ms-azure-ad-temp__table_r1j_dby_hcc}

6. Click Configure and Get OAuth Token.
{#ms-azure-ad-temp__steps_ppg_zzx_hcc}

### Result

The Microsoft Entra ID spoke is set up and integrated with the ServiceNow instance.  
Note:  
By default, the grant type of the application registry record is set to Authorization Code.

* If you want to use credentials of an Azure user to obtain the OAuth token and run all flows with that user delegation, use Authorization Code. Currently, delegation of permission to each logged in ServiceNow user isn't supported.
* If you want to grant permission to an app instead of an individual user, change the grant type to Client Credentials. This ensures that all flows, either interactive or background, will use the app permissions to execute the flows. For more information on how to use Client Credentials, see [KB0993701](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0993701).
* In situations where you can't use one grant type but require both the Authorization Code and Client Credentials grant types to perform the actions, create a child alias.
{#ms-azure-ad-temp__ul_opn_b4l_jyb}

## Regenerate Entra ID OAuth token {#ariaid-title4}

Regenerate the Entra ID OAuth token when it expires.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to AllConnections \& CredentialsCredentials.
2. Select the Entra ID spoke OAuth Credential record.  
   For example, select Azure AD Credentials.
3. From Related Links, click Get OAuth Token.
{#regenerate-azure-ad-oauth-token__steps_o4n_2qw_qfb}

*[\>]: and then