--- sourceDocument: Australia Employee Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/pt-BR/employee-service-management Release : - australia ft:locale : - pt-BR ft:publication_title : - Australia Employee Service Management ft:clusterId : - emplsm bundleId : - emplsm workflow : - Employee --- # Setting up the SharePoint Online Search Connector # Setting up the SharePoint Online Search Connector {#ariaid-title1} Set up the SharePoint Online Search Connector by configuring and connecting the Microsoft SharePoint tenant with your instance. Validate the connection to avoid any setup failures before indexing the sites for search. ## Configure the Microsoft SharePoint tenant {#ariaid-title2} Configure your Microsoft SharePoint tenant to get started with the SharePoint Online Search Connector. ### Antes de Iniciar As a Microsoft SharePoint administrator, create a custom application by specifying the root URL (https:// \.sharepoint.com), app domain, redirect URL, and other settings. Importante: Starting with the Yokohama release, SharePoint Online Search Connector is being prepared for future deprecation. It's hidden and no longer activated on new instances but continue to be supported. For deprecation details, see the [Deprecation Process \[KB0867184\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0867184) article in the Now Support knowledge base. Ensure you complete the following prerequisites. * Follow the procedure to [Configure OAuth application in Microsoft Azure](https://www.servicenow.com/docs/access?context=configure-oauth-application-in-microsoft-azure&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). * Follow the procedure to [Set up Microsoft Entra ID spoke](https://www.servicenow.com/docs/access?context=set-up-azure&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). Microsoft Entra ID spoke (formerly known as Microsoft Azure Active Directory spoke) is a dependent plugin that needs to be set up before indexing the users. * Understand how to [Configure Microsoft SharePoint Graph connection](https://www.servicenow.com/docs/access?context=configure-microsoft-sharepoint-graph-connection&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). * Log in with your admin credentials to grant permissions. {#spoc-config__ul_v5x_wrp_m2c} Role required: admin ### Por Que e Quando Desempenhar Esta Tarefa Complete the following procedure from your Microsoft SharePoint account. For more information on creating and configuring custom applications, see the [SharePoint development](https://docs.microsoft.com/en-us/sharepoint/dev/) Nota: When the permissions assigned in the Azure apps have privilege issues, the following error message appears: Error message: Method failed: (/_api/web/XXXXXXX) with code: 401 - Invalid username/password combo. Address this issue with the instructions available in [KB1117977](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1117977). When you want the search results to display only the published versions of the documents, ensure you select Application permissions instead of the Delegated permissions while configuring the permissions explained in [Microsoft SharePoint Online Spoke](https://www.servicenow.com/docs/access?context=sharepoint-online-spoke&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). Nota: Admins can limit indexing to the published versions only, ensuring that drafts or unfinished work aren't displayed in the search results. ### Procedimento 1. Navigate to AzureActive DirectoryApp registrationsAll applications, and select an existing app. Use an existing application or create an application. Configured permissions 2. Navigate to App registrationsAPI permissions, and click Add a permission. 3. Select one of the following options: 1. Navigate to Microsoft GraphDelegated permissions for Graph. 2. Navigate to Microsoft GraphApplication permissions for Graph. {#spoc-config__substeps_plr_vtm_h1c} Add the Sites.ReadWrite.All permission from the Sites list. The Sites.ReadWrite.All permission helps with subscription creation. Add the User.Read permission from the Users list. These user permissions are used to crawl the Microsoft SharePoint data later. 4. Navigate to SharepointApplication permissionsSites, and select Sites.FullControl.All, Sites.Read.All, or Sites.Selected for REST. Enable the Sites.Selected permission by performing the following steps. 1. In the Microsoft Azure application, enable the Sites.Selected and the User.Read.All permissions. Use any API client to provide read access for the following site collections. * Application X that is connected to a ServiceNow instance and has the Sites.Selected permission. * Application Y that is an admin application and has the Sites.Full.Control permission for Graph connection. {#spoc-config__ul_yz1_d4w_dcc} 2. Get a bearer token by calling the API method https://login.microsoftonline.com/{Tenant Id}/oauth2/v2.0/token. Payload: client_id={App Y client id} &scope=https%3A%2F%2Fgraph.microsoft.com%2F.default &client_secret={App Y client secret} &grant_type=client_credentials 3. Pass the token received in step b as the authorization token while calling the API method https://graph.microsoft.com/v1.0/sites/{site id}/permissions. Payload: { "roles": [ "read" ], "grantedToIdentities": [ { "application": { "id": "App X client id", "displayName": "App X" } } ] } {#spoc-config__substeps_og3_jjw_dcc} 5. Ensure you configure the required API permissions as shown in the following image: Figura 1. Configured permissions list For more information, see [Configure Microsoft SharePoint Graph connection](https://www.servicenow.com/docs/access?context=configure-microsoft-sharepoint-graph-connection&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). 6. Click Grant admin consent, select Yes, and click Save and Continue. 7. Navigate to AuthenticationWebRedirect URLs and add the URL in this format https://\/oauth_redirect.do, for example, and click Save. 8. Navigate to [Microsoft SharePoint Online Spoke](https://www.servicenow.com/docs/access?context=sharepoint-online-spoke&version=australia&pubname=australia-integrate-applications&ft:locale=en-US) and register the certificate and secret for your application. 9. Click Add user on the [Microsoft admin portal](http://admin.microsoft.com/AdminPortal/Home#/users), specify the user details, and click Finish. Nota: The search crawls the sites that you can access. Ensure that you select the user with appropriate permissions for only the required content. For more information, see [user permissions](https://docs.microsoft.com/en-us/sharepoint/customize-sharepoint-site-permissions). Selecting a high-level user can import more documents than you want to import. For more information, see [Granting access via Azure AD App-Only](https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread). ### O que Fazer Depois Complete the integration from your ServiceNow AI Search account. For more information, see [Integrate the Microsoft SharePoint search sources with the AI Search profiles](https://www.servicenow.com/docs/uKwI_fRoFp85_xhkYITuAA#link-search-sources-spoc "Link search sources to a search profile to specify the content users can search through the linked search profile."). ## Integrate the Microsoft SharePoint search sources with the AI Search profiles {#ariaid-title3} Link search sources to a search profile to specify the content users can search through the linked search profile. ### Antes de Iniciar Role required: admin ### Procedimento 1. Navigate to Search ApplicationsSearch Application Configurations (sys_search_context_config). 2. Update the following values, for Virtual Agent Default Search Application * Search Engine: AI Search. * Search Profile: ESC Portal Default Search Profile. This dynamic field value is visible after you change the Search Engine value. {#link-search-sources-spoc__ul_mfb_fft_p4b}For more information, see [Create a search application configuration for AI Search](https://www.servicenow.com/docs/access?context=create-search-app-config-ais&version=australia&pubname=australia-platform-administration&ft:locale=en-US). {#link-search-sources-spoc__steps_el2_nds_vwb} ### O que Fazer Depois Connect the ServiceNow® instance with the Microsoft SharePoint tenant. Complete the steps from your ServiceNow® account. For more information, see [Connect your ServiceNow instance to a Microsoft SharePoint tenant](https://www.servicenow.com/docs/uKwI_fRoFp85_xhkYITuAA#sharepoint-configure-connections "Connect your ServiceNow instance with a Microsoft SharePoint tenant. Create custom ServiceNow OAuth connections for Microsoft SharePoint to authenticate ServiceNow requests."). ## Connect your ServiceNow instance to a Microsoft SharePoint tenant {#ariaid-title4} Connect your ServiceNow instance with a Microsoft SharePoint tenant. Create custom ServiceNow OAuth connections for Microsoft SharePoint to authenticate ServiceNow requests. ### Antes de Iniciar * Ensure that you have working knowledge of the [SharePoint developer program](https://developer.microsoft.com/en-us/microsoft-365/dev-program) tools and other resources to configure the application. * Ensure that you're aware of the ServiceNow® integrations. {#sharepoint-configure-connections__ul_jq4_l3y_j4b}Role required: sn_sp_con.admin and admin. ### Procedimento 1. Navigate to ServiceNow instanceSystem OAuthApplication Registry. 2. Click New. The system displays the message What kind of OAuth application? 3. Select Connect to a third-party OAuth Provider. 4. Create the following registries: 1. On the Graph connection form, fill in the fields. For a description of the field value, see [Graph connection form](https://www.servicenow.com/docs/9kdsoBkLCwFmOGOh2DPrkQ "The following are the available fields in the Graph connection form to create a Graph connection for Microsoft SharePoint connectivity configuration."). 2. On the REST connection form, fill in the fields. For a description of the field value, see [REST connection form](https://www.servicenow.com/docs/IKINwP8Yz7jh0OJm8EZN9Q "The following are the available fields in the REST connection form to create a REST connection for Microsoft SharePoint connectivity configuration."). 3. Right-click the form header and click Save. {#sharepoint-configure-connections__substeps_o55_xqj_s1c} OAuth Entity Profile 5. Navigate to the OAuth Entity Profiles \[oauth_entity_profile\] table to find the following entries: * `.default_profile` * `.default_profile` {#sharepoint-configure-connections__ul_pdp_35y_l4b} Two system-generated OAuth entity profiles (REST and Graph) are created in the OAuth Entity Profiles \[oauth_entity_profile\] table. For more information, see [Specify an OAuth profile](https://www.servicenow.com/docs/access?context=t_SpecifyAnOAuthProfile&version=australia&pubname=australia-api-reference&ft:locale=en-US) OAuth Entity Scopes 6. Insert a row with the following values in the OAuth Entity Scopes \[oauth_entity_scope\] table: {#sharepoint-configure-connections__table_vvw_4rl_s1c__entry__2} | Graph | REST | |-|-| | Name: Any name of your choice | Name: Any name of your choice | | OAuth Provider: Graph Application Registry record | OAuth Provider: REST Application Registry record | | Application: Global | Application: Global | | (For Delegated permissions) OAuthscope: `offline_access https://graph.microsoft.com/Sites.ReadWrite.All` (For Application permissions) OAuthscope: `https://graph.microsoft.com/.default` | OAuth Scope:`https://.sharepoint.com/` | [Tabela 1. OAuth Entity Scopes] {#sharepoint-configure-connections__table_vvw_4rl_s1c}For more information, see [Specify an OAuth scope](https://www.servicenow.com/docs/access?context=t_SpecifyAnOAuthScope&version=australia&pubname=australia-api-reference&ft:locale=en-US). OAuth Entity Profiles Scopes 7. Insert a row with the following values in the OAuth Entity Profiles Scopes \[oauth_entity_profile_scope\] table: {#sharepoint-configure-connections__table_qgb_pwz_s1c__entry__2} | Graph | REST | |-|-| | OAuth Entity Profile: Graph entity profile generated in the OAuth Entity Profiles \[oauth_entity_profile\] table. | OAuth Entity Profile: REST entity profile generated in the OAuth Entity Profiles \[oauth_entity_profile\] table. | | OAuth Entity Scope: Select the graph OAuth Entity Scope \[oauth_entity_profile_scope\] table. | OAuth Entity Scope: Select the REST OAuth Entity Scope \[oauth_entity_profile_scope\] table. | | Application: Global | Application: Global | [Tabela 2. OAuth Entity Profiles Scopes] {#sharepoint-configure-connections__table_qgb_pwz_s1c} Credentials 8. Navigate to Connections \& CredentialsCredentials, and create the OAuth 2.0 credentials: 1. On the Graph or REST credential forms, fill in the fields. {#sharepoint-configure-connections__table_qyn_qtg_ywb__entry__2} | Field | Description | |-|-| | Name | Name of your choice. | | OAuth entity profile | (For Graph) Graph entity profile identified. (For REST) REST entity profile identified. | [Tabela 3. OAuth 2.0 credential form] {#sharepoint-configure-connections__table_qyn_qtg_ywb} 2. Right-click the form header and click Save. Nota: For more information on Entities, Connection \& Credential Aliases, see [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](https://www.servicenow.com/docs/access?context=conf-graph-root&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). {#sharepoint-configure-connections__substeps_hyx_llz_s1c} Connection 9. Navigate to Connections \& CredentialsConnection, and click New to create HTTP(s) connections for the following Graph or REST. 1. On the form, fill in the fields. {#sharepoint-configure-connections__table_prf_1zz_s1c__entry__2} | Field | Description | |-|-| | Name: Any name of your choice for Graph | Name: Any name of your choice for REST | | Credentials: Select the graph Credentials | Credentials: Select the REST Credentials | | Connection alias: sn_sp_spoke.MicrosoftSharePointGraph | Connection alias: sn_sp_spoke.MicrosoftSharepointOnline | | Connection URL: https://graph.microsoft.com/v1.0/ | Connection URL: https://<Host URL of your SharePoint instance>/ | | Domain: Global | Domain: Global | [Tabela 4. Connection form] {#sharepoint-configure-connections__table_prf_1zz_s1c} 2. Right-click the form header and click Save. For more information, see [Connections and Credentials](https://www.servicenow.com/docs/access?context=r-credentials&version=australia&pubname=australia-platform-security&ft:locale=en-US) and [Create an HTTP(s) connection](https://www.servicenow.com/docs/access?context=create-https-connection&version=australia&pubname=australia-platform-security&ft:locale=en-US). Tenants 10. Navigate to Microsoft Sharepoint OnlineTenants. 1. Click New to create Graph or REST connections. 2. On the form, fill in the fields. {#sharepoint-configure-connections__table_cpv_vvg_ywb__entry__2} | Field | Description | |-|-| | Name | Name of your choice. | | Alias | For Graph: sn_sp_spoke.MicrosoftSharePointGraph For REST: sn_sp_spoke.MicrosoftSharepointOnline | | SharePoint root URL | Root URL as \.sharepoint.com | | Tenant ID | Tenant ID required for the Graph or REST connection. | | Domain | Global | [Tabela 5. Tenant connection form] {#sharepoint-configure-connections__table_cpv_vvg_ywb} 3. Right-click the topic header and click Save. {#sharepoint-configure-connections__substeps_n43_4tl_s1c} For more information, see [Define tenants](https://www.servicenow.com/docs/access?context=create-tenant&version=australia&pubname=australia-integrate-applications&ft:locale=en-US), [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](https://www.servicenow.com/docs/access?context=conf-graph-root&version=australia&pubname=australia-integrate-applications&ft:locale=en-US), and [Create aliases for multiple tenants](https://www.servicenow.com/docs/access?context=create-aliases-sharepoint&version=australia&pubname=australia-integrate-applications&ft:locale=en-US) Certificates 11. Navigate to System definitionCertificatesMicrosoft SharePoint Online Certificate. 1. Attach the file generated Java Key Store certificate on the Azure AD portal. For more information, see [Attach a Java Key Store certificate](https://www.servicenow.com/docs/access?context=set-up-microsoft-sharepoint-online-and-connection-record&version=australia&pubname=australia-integrate-applications§ion=ms-sharept-attachjks&ft:locale=en-US). 2. Update the Key store password with the password of the Java Key Store (.jks) file. 3. Update the type to the Java key store. 4. Right-click the topic header and click Save. {#sharepoint-configure-connections__substeps_vgh_bt1_lsb} For more information, see [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](https://www.servicenow.com/docs/access?context=conf-graph-root&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). JWT keys 12. Navigate to System OAuthJWT keysMicrosoft SharePoint Online JWT Keys. 1. Update signing key with password of Certificate (.cer) file. 2. Right-click the topic header and click Save. {#sharepoint-configure-connections__substeps_l4y_rt1_lsb} 13. Navigate to System OAuthJWT providersMicrosoft SharePoint Online JWT Provider. 1. Update the aud claim with https://login.microsoftonline.com/\/oauth2/token. 2. Update the iss and sub claim with the respective client ids on the Azure ad app registrations. 3. Click Save. {#sharepoint-configure-connections__substeps_m4y_rt1_lsb} Connection 14. Navigate to Connections \& CredentialsConnection. 1. Open the REST connection record and on the Attributes tab, specify the Base 64 encoded certificate Thumbprint. Nota: The SharePoint app thumbprint value is hex encoded. Encode the same in the Base64 format in the connection record. 2. Select the following Credentials option: * (For Graph): Navigate to the \[Credentials\] table (oauth_2_0_credentials), open Graph, and click Get OAuth Token. Ensure that you log in to your Microsoft SharePoint instance with the credentials of the user that you created to get the OAuth token for the Graph connection. Store the credentials in the instance. * (For REST): Go to the \[Credentials\] table (oauth_2_0_credentials), open REST, and click Get OAuth Token. Ensure that you log in to your Microsoft SharePoint instance with the Tenant administrator credentials to get the OAuth token for the REST connection. Store the credentials in the instance. Validate the credential to avoid any configuration failure. For more information on validating the SharePoint connection, see [Validate the Microsoft SharePoint connection](https://www.servicenow.com/docs/uKwI_fRoFp85_xhkYITuAA#validate-sharepoint-connection "Run a validation after you connect your ServiceNow instance with a Microsoft SharePoint tenant to check for any errors in the configuration."). {#sharepoint-configure-connections__ul_jwz_dkf_t1c} 3. Click Save. {#sharepoint-configure-connections__substeps_mvx_wlf_t1c} Trusted Domains 15. Go to Trusted Domains table (sn_ais_spoke_trusted_domains) and click New to create a domain record. 1. On the form, fill in the fields. {#sharepoint-configure-connections__table_ql3_xfh_ywb__entry__2} | Field | Description | |-|-| | Name | Name of your choice. | | Domain | \. | [Tabela 6. Domain record form] {#sharepoint-configure-connections__table_ql3_xfh_ywb} 2. Click Save. For more information, see [Set up the AI Search spoke](https://www.servicenow.com/docs/access?context=setup-ais-spoke&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). Nota: Ensure you create a trusted domain record for each tenant, when there are multiple tenants. {#sharepoint-configure-connections__substeps_xp3_wlz_s1c} Sharepoint Ingest User 16. Navigate to Connections \& CredentialsConnection \& Credential AliasesSharepoint Ingest User (sn_sp_con.Sharepoint_Ingest_User). 1. Click New on Credentials to create a Basic Auth Credential for ingesting external content by AIS. 2. Specify the User name and Password of the user (sys_user) who has the ais_external_content role. Nota: In the example screenshot, the user abel.tuter is the sys_user who has the ais_external_content role assigned. 3. Click Submit. For more information, see [Create aliases for multiple tenants](https://www.servicenow.com/docs/access?context=create-aliases-sharepoint&version=australia&pubname=australia-integrate-applications&ft:locale=en-US). 4. Configure the [AI Search server connection](https://www.servicenow.com/docs/access?context=setup-ais-spoke&version=australia&pubname=australia-integrate-applications&ft:locale=en-US) before you proceed with the next steps. {#sharepoint-configure-connections__substeps_yqv_mmz_s1c} The Entity View Action Mapper (EVAM) configuration is available by default with Employee Center Pro version 32.0. For more information on EVAM definition, see [Create an EVAM action definition](https://www.servicenow.com/docs/access?context=define-evam-action&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US) and [Create a multi-data source list display in Entity View Action Mapper](https://www.servicenow.com/docs/access?context=tutorial-create-evam&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). ### Resultado Your configuration is complete. ### O que Fazer Depois [Validate the Microsoft SharePoint connection](https://www.servicenow.com/docs/uKwI_fRoFp85_xhkYITuAA#validate-sharepoint-connection "Run a validation after you connect your ServiceNow instance with a Microsoft SharePoint tenant to check for any errors in the configuration.") to rule out any configuration failure before indexing a sample site. ## Validate the Microsoft SharePoint connection {#ariaid-title5} Run a validation after you connect your ServiceNow instance with a Microsoft SharePoint tenant to check for any errors in the configuration. ### Antes de Iniciar Role required: admin ### Por Que e Quando Desempenhar Esta Tarefa The validation rules out any configuration failure and ensures a seamless setup process. ### Procedimento 1. Navigate to System UIUI PagesSharepoint utility. 2. Select Try it to navigate to the SharePoint Connection validation page. 3. Enter the required details and select Validate. The errors, if any, are displayed in the Response section. 4. Check the Table name links and fix the errors based on the Current Value and Expected Value displayed in the Response section. If any information is missing, the Error field shows the data. If there are no errors, the Response section displays a successful validation. ### O que Fazer Depois Index sites for search. For more information, see [Index sites for search](https://www.servicenow.com/docs/3j0KvhUUGJPqCA_johObOA "Configure the SharePoint Online Search Connector to crawl the content from the eligible sites, subsites, drives, and more.").