---
sourceDocument: Xanadu Create Integrations with Applications
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/integrate-applications

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Create Integrations with Applications

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Configure Microsoft SharePoint Online connection record

# Configure Microsoft SharePoint Online connection record {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read

Integrate your ServiceNow instance with the Microsoft SharePoint Online by setting up the Microsoft SharePoint Online and a connection record.

## Before you begin

* Request Integration Hub subscription
* Activate [Microsoft SharePoint Online Spoke](https://www.servicenow.com/docs/PMkxEIgC6~tOHu_EdAC_gw "The Microsoft SharePoint Online spoke integrates your ServiceNow instance with Microsoft SharePoint Online so that you can automate various predefined actions as part of a Workflow. For example, you can rename a folder on Microsoft SharePoint Online when a record in the database is updated.")
* Create an OAuth application on Microsoft Azure portal.
* Access to Microsoft Azure portal
* Role required: admin
{#set-up-microsoft-sharepoint-online-and-connection-record__ul_k2k_mph_gfaff}

## Generate certificate for Windows {#ariaid-title2}

Generate a digital certificate file in the .cer format to upload it to Microsoft Azure.

### Before you begin

Role required: admin

### Procedure

1. Navigate to <https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread#setting-up-an-azure-ad-app-for-app-only-access>.
2. Execute the PowerShell script.  
   The script generates two files with .PFX and .CER extensions.  
   Note:  
   Store or remember the password that is used to encrypt private key to generate the .PFX file and .CER files.
3. Use the .PFX file to create a Java Key Store (JKS) file.  
   Note:  
   Store or remember the password that is used to generate the .JKS file from the .PFX file.

## Generate self-signed certificate for Mac {#ariaid-title3}

Generate a digital certificate file in the .cer format to upload it to Microsoft Azure.

### Before you begin

Role required: admin

### Procedure

1. Open the terminal on your Mac machine.
2. Replace the placeholder <kbd class="ph userinput">&lt;filename&gt;</kbd> with a file name of your choice and execute this script <kbd class="ph userinput">keytool -genkey -keyalg RSA -alias selfsigned -keystore &lt;filename&gt;.jks -storepass &lt;enter password for keystore&gt; -validity 720 -keysize 2048</kbd>.  
   Note:  
   The password to the keystore must contain at least six characters.  
   The keystore asks you to enter certain information.
3. Enter your custom information, as given in the image for illustration.
4. Press Return.  
   You are advised to migrate to PKCS12 format.
5. Replace the placeholder <kbd class="ph userinput">&lt;filename&gt;</kbd> with a file name of your choice and execute this script <kbd class="ph userinput">keytool -importkeystore -srckeystore &lt;filename&gt;.jks -destkeystore &lt;filename&gt;.jks -deststoretype pkcs12</kbd>.
6. Enter the source keystore password.  
   The migration to PKCS12 is successful.
7. Replace the placeholder <kbd class="ph userinput">&lt;filename&gt;</kbd> with a file name of your choice and execute this script <kbd class="ph userinput">keytool -exportcert -keyalg RSA -alias selfsigned -keystore &lt;filename&gt;.jks -storepass &lt;password to the keystore&gt; -rfc -file &lt;filename&gt;.cer</kbd>.  
   The script generates the .cer file.
8. To locate the .cer file, navigate to the location on your local disk.  

## Configure an application in Microsoft Azure {#ariaid-title4}

Create a custom app using your Azure portal to authenticate requests.

### Before you begin

* Access to Microsoft Azure portal
* Role required: admin
{#ms-sharept-azure-app__ul_ply_dpc_y1c}

### Procedure

1. Upload the certificate to Microsoft Azure portal.
   1. Log in to <https://portal.azure.com/>.
   2. Select App registrations.  
   3. Select All applications or Owned applications.  
   4. In the search field, enter the name of the OAuth application you had created.  
      To learn how to configure an OAuth application, see [Configure OAuth application in Microsoft Azure](https://www.servicenow.com/docs/Fh0aR1go6U4vW3fpeLZJTQ "Create an OAuth application in Microsoft Azure to verify and authorize connection requests from your ServiceNow instance.").
   5. On the left panel, under Manage heading, select Certificates \& secrets.  
   6. Under Certificates \& secrets, select Certificates.  
   7. Select Upload certificate.
   8. In the Upload certificate window, select the folder icon (![Folder icon.]()) to navigate to the .cer file you had generated.
   9. In the Description field, enter a description of the certificate.
   10. Select Add.  
       The certificate is uploaded.
   11. Under the Thumbprint column, copy the thumbprint value and store it at a secure place.  
       Note:  
       Ensure that you copy the entire value of Thumbprint.

       Alternatively, you can copy the Thumbprint by clicking
       Manifest.

   12. Encode the Thumbprint value to a Base64 value and record the value for later use.

   {#ms-sharept-azure-app__substeps_ygq_phz_gyb}  
   Note:  
   You can use a Hexadecimal to Base64 (Hex to Base64) converter tool to encode the Thumbprint value to a Base64 value.
2. Obtain permissions to access the REST APIs that the spoke needs to automate actions.
   1. On the left panel, under the Manage heading, select API permissions.  
   2. Under the Configured permissions heading, select + Add a permission.
   3. In the Request API permissions window, select SharePoint.  
   4. Select Application permissions.  
   5. Expand the Sites list.
   6. Select Sites.FullControl.All.  
      Your ServiceNow instance now has full control of all sites in Microsoft SharePoint Online.
   7. Select Add permissions.  
      The permissions are added.

   8. To grant admin consent, select Grant admin consent for ServiceNow.
   9. In the Grant admin consent confirmation window, select Yes.  
      The admin consent is granted.

      Tip:  
      If you want to use other permissions apart from <kbd class="ph userinput">Sites.FullControl.All</kbd>, contact your SharePoint and Azure administrators to determine the exact permissions that are needed for your organisational policies.
   {#ms-sharept-azure-app__substeps_af1_v2l_hyb}

## Attach a Java Key Store certificate {#ariaid-title5}

Enable the JWT Bearer Grant token authentication by attaching a valid Java Key Store
(JKS) certificate.

### Before you begin

* Valid Java Key Store certificate
* Role required: admin
{#ms-sharept-attachjks__ul_wlk_hqx_dsb}

### Procedure

1. Navigate to System DefinitionCertificates.
2. Open the record Microsoft SharePoint Online Certificate.  
   Note:  
   Ensure that you use the default record Microsoft SharePoint Online Certificate only.
3. Enter the password associated with the JKS file in Key store password.
4. Select Java Key Store as the Type.
5. Click the attachments icon (![Attachments icon]()) and attach the JKS certificate you had generated.  
   For more information, see [Configure OAuth application in Microsoft Azure](https://www.servicenow.com/docs/Fh0aR1go6U4vW3fpeLZJTQ "Create an OAuth application in Microsoft Azure to verify and authorize connection requests from your ServiceNow instance.").
6. Click Validate Stores/Certificates.
7. Click Update.

## Configure the JWT signing key {#ariaid-title6}

Create a JSON Web Token (JWT) signing key to assign to your Java Key Store
certificate.

### Before you begin

Role required: admin

### Procedure

1. Navigate to System OAuthJWT Keys.
2. Open the record Microsoft SharePoint Online JWT Keys.
3. Enter the password that is used to encrypt private key to generate the .PFX file and .CER file in Signing Key Password.
4. Click Update.

## Configure the JWT provider {#ariaid-title7}

Add a JSON Web Token (JWT) provider to your ServiceNow
instance.

### Before you begin

* Copy and record the value of Application (client) ID and Directory (tenant) ID of the application you had registered in the Azure portal.
* Role required: admin
{#ms-sharepoint-prov__ul_cvp_35x_dsb}

### Procedure

1. Navigate to System OAuthJWT Providers.
2. Open the record Microsoft SharePoint Online JWT Provider.
3. Enter values for iss, sub, and aud in the Standard Claims related list.  
   {#ms-sharepoint-prov__table_mnc_wtx_dsb__entry__2}

   | Field | Value |
   |-|-|
   | aud | Microsoft Online URL in this format: <kbd class="ph userinput">https://login.microsoftonline.com/&lt;tenant-id&gt;/oauth2/token</kbd>. Replace <kbd class="ph userinput">&lt;tenant-id&gt;</kbd> with Directory (tenant) ID value of your application had registered in the Azure portal. |
   | iss | Application (client) ID of the application you had registered in Azure portal. |
   | sub | Application (client) ID of the application you had registered in Azure portal. |
   [ ]

   {#ms-sharepoint-prov__table_mnc_wtx_dsb}
4. Click Update.

## Register Microsoft SharePoint Online as OAuth provider {#ariaid-title8}

Use the information generated during Microsoft SharePoint Online account configuration to register Microsoft SharePoint Online as an OAuth provider and allow the instance to request OAuth 2.0 tokens.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to System OAuthApplication Registry.
2. Click New.  
   The system displays the message What kind of OAuth application?
3. Select Connect to a third party OAuth Provider.  
   The system displays a blank Application Registries form.
4. Enter these values.  
   {#register-sharepoint-oauth__table_alw_kq3_gfb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Name to uniquely identify the record. For example, enter <kbd class="ph userinput">SharePoint OAuth profile</kbd>. |
   | Client ID | Client ID in this format: <kbd class="ph userinput">&lt;ClientID&gt;</kbd>. |
   | Client Secret | Client Secret you created during the Microsoft SharePoint Online account configuration. |
   | OAuth API Script | Select OAuthUtilSPJWTOnline. |
   | Default Grant type | Select Client Credentials. |
   | Token URL | Token URL in this format: <kbd class="ph userinput">https://login.microsoftonline.com/&lt;tenant-id&gt;/oauth2/token</kbd>. Replace <kbd class="ph userinput">&lt;tenant-id&gt;</kbd> with Directory (tenant) ID value of your application had registered in the Azure portal. |
   [ ]

   {#register-sharepoint-oauth__table_alw_kq3_gfb}
5. In the OAuth Entity Scopes related list, insert a record with these values.  
   {#register-sharepoint-oauth__table_wvt_5cx_2sb__entry__2}

   | Name | OAuth scope |
   |-|-|
   | scope | <kbd class="ph userinput">https://&lt;MS-SharePoint-tenant-name&gt;.sharepoint.com/.default </kbd> |
   [ ]

   {#register-sharepoint-oauth__table_wvt_5cx_2sb}
6. Right-click the form header, and click Save.  
   The system validates the OAuth credentials and creates the OAuth Entity Profiles related list.
{#register-sharepoint-oauth__steps_usf_jfp_ngb}

### Result

The instance can request OAuth 2.0 tokens for the spoke.

## Create credential records for the Microsoft SharePoint Online spoke {#ariaid-title9}

Create Credential records to the Microsoft SharePoint Online custom OAuth application you created during Microsoft SharePoint Online account configuration. The Microsoft SharePoint Online spoke connection and credential aliases use these credentials to authorize actions.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to Connections \& CredentialsCredentials.
2. Click New.  
   The system displays the message What type of Credentials would you like to create?.
3. Select OAuth 2.0 Credentials.  
   The pop-up window displays a blank OAuth 2.0 Credentials form.
4. Enter these values.  
   {#create-credential-sharepoint__table_sxv_zgp_gfb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Enter any name to uniquely identify the record. For example, enter <kbd class="ph userinput">SharePoint Credentials</kbd>. |
   | Active | Enable |
   | OAuth Entity Profile | Select the OAuth profile you created when you registered the custom Microsoft SharePoint Online application as an OAuth provider. For example, select SharePoint OAuth profile. |
   | Applies to | Select the MID Servers that can use this credential. For example, select All MID Servers. |
   | Order | Select the order to apply this credential. For example, enter <kbd class="ph userinput">100</kbd>. |
   [ ]

   {#create-credential-sharepoint__table_sxv_zgp_gfb}
5. Save the record.
{#create-credential-sharepoint__steps_fpl_zfp_ngb}

## Create connection records for the Microsoft SharePoint Online spoke {#ariaid-title10}

Create Connection records to your Microsoft SharePoint Online account. The Microsoft SharePoint Online spoke connection and credential alias uses these connections to perform actions on Microsoft SharePoint Online.

### Before you begin

Role required: admin.

### Procedure

1. Navigate to Connections \& CredentialsConnection \& Credential Aliases.
2. Open the connection and credential alias record for MicrosoftSharePointOnline.
3. From the Connections tab, click New.  
   The system displays a blank HTTP(s) Connection form.
4. On the form, fill in the fields.  
   {#create-connection-sharepoint__table_any_shp_gfb__entry__2}

   | Field | Value required |
   |-|-|
   | Name | Enter any name to uniquely identify the connection record. For example, enter <kbd class="ph userinput">SharePoint Connection</kbd>. |
   | Credential | Select the Credential record you created for Microsoft SharePoint Online. For example, select SharePoint Credentials. |
   | Connection alias | Select the Connection alias record you created for Microsoft SharePoint Online. |
   | Active | Enable |
   | Connection URL | Enter the root SharePoint URL. For example, <kbd class="ph userinput">https://&lt;SiteName&gt;.sharepoint.com</kbd>. |
   [ ]

   {#create-connection-sharepoint__table_any_shp_gfb}
5. In the Attributes tab, enter the Base64 encoded value of Thumbprint.  
   Note:  
   The Thumbprint value is a hexadecimal value. You can use a Hexadecimal to Base64 (Hex to Base64) converter tool to encode the Thumbprint value to a Base64 value.
6. Click Submit.  
   The Microsoft SharePoint Online account is integrated with your ServiceNow instance and the spoke is ready to be used.  
   Note:  
   If the single sign-on is setup, configure your flows to retrieve the user details from Microsoft SharePoint Online using the spoke action, Look Up User Information By Login Name, to verify if the user is authorised to perform the required actions.
{#create-connection-sharepoint__steps_tgh_bhp_ngb}

### What to do next

1. Navigate to Connections \& CredentialsCredentials.
2. Open the credential record you had created. For example, SharePoint Credentials.
3. From Related Links, click Get OAuth Token.  
   The system displays a confirmation message that the OAuth token flow is completed successfully. Review the details if the flow is not completed successfully.  
   Note:  
   Ensure that you allow pop-up windows in your browser.
   * Confirm that you allow pop-up windows in your browser.
   * Confirm that the thumbprint has been defined in the connection record.
   {#create-connection-sharepoint__ul_gh5_gys_22c}  
   The spoke setup is completed and you can use the flows as per your requirement.  
   Note:  
   If the generated token doesn't work after the spoke setup, open your OAuth application in the Azure portal and select the two checkboxes under Implicit grant and hybrid flows.
{#create-connection-sharepoint__ol_y5s_vp5_xbc}

*[\>]: and then