Configure Microsoft SharePoint Online connection record

task australia Updated Mar 12, 2026 9 min read set-up-microsoft-sharepoint-online-and-connection-record.md
Raw file servicenow.com

Integrate your ServiceNow instance with the Microsoft SharePoint Online by setting up the Microsoft SharePoint Online and a connection record.

Before you begin

  • Request Integration Hub subscription
  • Activate Microsoft SharePoint Online Spoke
  • Create an OAuth application on Microsoft Azure portal.
  • Access to Microsoft Azure portal
  • Role required: admin

Generate certificate for Windows

Generate a digital certificate file in the .cer format to upload it to Microsoft Azure.

Before you begin

Role required: admin

Procedure

  1. Navigate to https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread#setting-up-an-azure-ad-app-for-app-only-access.

  2. Execute the PowerShell script.

    The script generates two files with .PFX and .CER extensions.

    Note: Store or remember the password that is used to encrypt private key to generate the .PFX file and .CER files.

  3. Use the .PFX file to create a Java Key Store (JKS) file.

    Note: Store or remember the password that is used to generate the .JKS file from the .PFX file.

Generate self-signed certificate for Mac

Generate a digital certificate file in the .cer format to upload it to Microsoft Azure.

Before you begin

Role required: admin

Procedure

  1. Open the terminal on your Mac machine.

  2. Replace the placeholder <filename> with a file name of your choice and execute this script keytool -genkey -keyalg RSA -alias selfsigned -keystore <filename>.jks -storepass <enter password for keystore> -validity 720 -keysize 2048.

    Note: The password to the keystore must contain at least six characters.

    The keystore asks you to enter certain information.

  3. Enter your custom information, as given in the image for illustration.[Omitted image "MS-sharepoint-spoke-sponline-certificate-mac.png"] Alt text: Keystore custom information.

  4. Press Return.

    You are advised to migrate to PKCS12 format.

  5. Replace the placeholder <filename> with a file name of your choice and execute this script keytool -importkeystore -srckeystore <filename>.jks -destkeystore <filename>.jks -deststoretype pkcs12.

  6. Enter the source keystore password.

    The migration to PKCS12 is successful.

  7. Replace the placeholder <filename> with a file name of your choice and execute this script keytool -exportcert -keyalg RSA -alias selfsigned -keystore <filename>.jks -storepass <password to the keystore> -rfc -file <filename>.cer.

    The script generates the .cer file.

  8. To locate the .cer file, navigate to the location on your local disk.

    [Omitted image "MS-sharepoint-spoke-sponline-cer-file-generated.png"] Alt text: Location of the .cer file.

Configure an application in Microsoft Azure

Create a custom app using your Azure portal to authenticate requests.

Before you begin

  • Access to Microsoft Azure portal
  • Role required: admin

Procedure

  1. Upload the certificate to Microsoft Azure portal.

    1. Log in to https://portal.azure.com/.

    2. Select App registrations.

      [Omitted image "MS-sharepoint-spoke-app-reg-button.png"] Alt text: App registration button.

    3. Select All applications or Owned applications.

      [Omitted image "ms-sharepoint-spoke-graph-select-app.png"] Alt text: OAuth application selection options.

    4. In the search field, enter the name of the OAuth application you had created.

      To learn how to configure an OAuth application, see Configure OAuth application in Microsoft Azure.

    5. On the left panel, under Manage heading, select Certificates & secrets.

      [Omitted image "MS-sharepoint-sponline-upload-certificate.png"] Alt text: Certificates & secrets.

    6. Under Certificates & secrets, select Certificates.

      [Omitted image "MS-sharepoint-sponline-certificate-section.png"] Alt text: Certificate section.

    7. Select Upload certificate.

    8. In the Upload certificate window, select the folder icon ([Omitted image "MS-sharepoint-spoke-sponline-upload-certificate-icon.png"] Alt text: Folder icon.) to navigate to the .cer file you had generated.

    9. In the Description field, enter a description of the certificate.

    10. Select Add.

      The certificate is uploaded.

    11. Under the Thumbprint column, copy the thumbprint value and store it at a secure place.

      [Omitted image "MS-sharepoint-spoke-sponline-copy-thumbprint.png"] Alt text: Thumbprint value.

      Note: Ensure that you copy the entire value of Thumbprint.

      Alternatively, you can copy the Thumbprint by clicking Manifest.

      [Omitted image "ms-exchng-ol-manifest.png"] Alt text: Copy value of Manifest.

    12. Encode the Thumbprint value to a Base64 value and record the value for later use.

    Note: You can use a Hexadecimal to Base64 (Hex to Base64) converter tool to encode the Thumbprint value to a Base64 value.

  2. Obtain permissions to access the REST APIs that the spoke needs to automate actions.

    1. On the left panel, under the Manage heading, select API permissions.

      [Omitted image "MS-sharepoint-spoke-graph-api-permissions-link.png"] Alt text: API permissions link.

    2. Under the Configured permissions heading, select + Add a permission.

    3. In the Request API permissions window, select SharePoint.

      [Omitted image "MS-sharepoint-spoke-sponline-sharepoint-api.png"] Alt text: SharePoint API button.

    4. Select Application permissions.

      [Omitted image "MS-sharepoint-spoke-sponline-application-permission.png"] Alt text: Application permissions button.

    5. Expand the Sites list.

    6. Select Sites.FullControl.All.

      Your ServiceNow instance now has full control of all sites in Microsoft SharePoint Online.

    7. Select Add permissions.

      The permissions are added.

      [Omitted image "MS-sharepoint-spoke-sponline-permissions-granted.png"] Alt text: SharePoint online permissions granted.

    8. To grant admin consent, select Grant admin consent for ServiceNow.

    9. In the Grant admin consent confirmation window, select Yes.

      The admin consent is granted.

      [Omitted image "MS-sharepoint-sponline-admin-consent.png"] Alt text: Admin consent granted status.

      Tip: If you want to use other permissions apart from Sites.FullControl.All, contact your SharePoint and Azure administrators to determine the exact permissions that are needed for your organisational policies.

Attach a Java Key Store certificate

Enable the JWT Bearer Grant token authentication by attaching a valid Java Key Store (JKS) certificate.

Before you begin

  • Valid Java Key Store certificate
  • Role required: admin

Procedure

  1. Navigate to System Definition > Certificates.

  2. Open the record Microsoft SharePoint Online Certificate.

    Note: Ensure that you use the default record Microsoft SharePoint Online Certificate only.

  3. Enter the password associated with the JKS file in Key store password.

  4. Select Java Key Store as the Type.

  5. Click the attachments icon ([Omitted image "attachments-icon.png"] Alt text: Attachments icon) and attach the JKS certificate you had generated.

    For more information, see Configure OAuth application in Microsoft Azure.

  6. Click Validate Stores/Certificates.

  7. Click Update.

Configure the JWT signing key

Create a JSON Web Token (JWT) signing key to assign to your Java Key Store certificate.

Before you begin

Role required: admin

Procedure

  1. Navigate to System OAuth > JWT Keys.

  2. Open the record Microsoft SharePoint Online JWT Keys.

  3. Enter the password that is used to encrypt private key to generate the .PFX file and .CER file in Signing Key Password.

  4. Click Update.

Configure the JWT provider

Add a JSON Web Token (JWT) provider to your ServiceNow instance.

Before you begin

  • Copy and record the value of Application (client) ID and Directory (tenant) ID of the application you had registered in the Azure portal.

    [Omitted image "ms-sharept-clientid.png"] Alt text: Copy the values of Client ID and Tenant ID.

  • Role required: admin

Procedure

  1. Navigate to System OAuth > JWT Providers.

  2. Open the record Microsoft SharePoint Online JWT Provider.

  3. Enter values for iss, sub, and aud in the Standard Claims related list.

    Field Value
    aud Microsoft Online URL in this format: https://login.microsoftonline.com/<tenant-id>/oauth2/token. Replace <tenant-id> with Directory (tenant) ID value of your application had registered in the Azure portal.
    iss Application (client) ID of the application you had registered in Azure portal.
    sub Application (client) ID of the application you had registered in Azure portal.

  4. Click Update.

Register Microsoft SharePoint Online as OAuth provider

Use the information generated during Microsoft SharePoint Online account configuration to register Microsoft SharePoint Online as an OAuth provider and allow the instance to request OAuth 2.0 tokens.

Before you begin

Role required: admin.

Procedure

  1. Navigate to System OAuth > Application Registry.

  2. Click New.

    The system displays the message What kind of OAuth application?

  3. Select Connect to a third party OAuth Provider.

    The system displays a blank Application Registries form.

  4. Enter these values.

    Field Value required
    Name Name to uniquely identify the record. For example, enter SharePoint OAuth profile.
    Client ID Client ID in this format: <ClientID>.
    Client Secret Client Secret you created during the Microsoft SharePoint Online account configuration.
    OAuth API Script Select OAuthUtilSPJWTOnline.
    Default Grant type Select Client Credentials.
    Token URL Token URL in this format: https://login.microsoftonline.com/<tenant-id>/oauth2/token. Replace <tenant-id> with Directory (tenant) ID value of your application had registered in the Azure portal.

  5. In the OAuth Entity Scopes related list, insert a record with these values.

    Name OAuth scope
    scope https://<MS-SharePoint-tenant-name>.sharepoint.com/.default

    [Omitted image "ms-sharept-scopes.png"] Alt text: Insert the OAuth entity scope record.

  6. Right-click the form header, and click Save.

    The system validates the OAuth credentials and creates the OAuth Entity Profiles related list.

Result

The instance can request OAuth 2.0 tokens for the spoke.

Create credential records for the Microsoft SharePoint Online spoke

Create Credential records to the Microsoft SharePoint Online custom OAuth application you created during Microsoft SharePoint Online account configuration. The Microsoft SharePoint Online spoke connection and credential aliases use these credentials to authorize actions.

Before you begin

Role required: admin.

Procedure

  1. Navigate to Connections & Credentials > Credentials.

  2. Click New.

    The system displays the message What type of Credentials would you like to create?.

  3. Select OAuth 2.0 Credentials.

    The pop-up window displays a blank OAuth 2.0 Credentials form.

  4. Enter these values.

    Field Value required
    Name Enter any name to uniquely identify the record. For example, enter SharePoint Credentials.
    Active Enable
    OAuth Entity Profile Select the OAuth profile you created when you registered the custom Microsoft SharePoint Online application as an OAuth provider. For example, select SharePoint OAuth profile.
    Applies to Select the MID Servers that can use this credential. For example, select All MID Servers.
    Order Select the order to apply this credential. For example, enter 100.

  5. Save the record.

Create connection records for the Microsoft SharePoint Online spoke

Create Connection records to your Microsoft SharePoint Online account. The Microsoft SharePoint Online spoke connection and credential alias uses these connections to perform actions on Microsoft SharePoint Online.

Before you begin

Role required: admin.

Procedure

  1. Navigate to Connections & Credentials > Connection & Credential Aliases.

  2. Open the connection and credential alias record for MicrosoftSharePointOnline.

  3. From the Connections tab, click New.

    The system displays a blank HTTP(s) Connection form.

  4. On the form, fill in the fields.

    Field Value required
    Name Enter any name to uniquely identify the connection record. For example, enter SharePoint Connection.
    Credential Select the Credential record you created for Microsoft SharePoint Online. For example, select SharePoint Credentials.
    Connection alias Select the Connection alias record you created for Microsoft SharePoint Online.
    Active Enable
    Connection URL Enter the root SharePoint URL. For example, https://<SiteName>.sharepoint.com.

  5. In the Attributes tab, enter the Base64 encoded value of Thumbprint.

    Note: The Thumbprint value is a hexadecimal value. You can use a Hexadecimal to Base64 (Hex to Base64) converter tool to encode the Thumbprint value to a Base64 value.

  6. Click Submit.

    The Microsoft SharePoint Online account is integrated with your ServiceNow instance and the spoke is ready to be used.

    Note: If the single sign-on is setup, configure your flows to retrieve the user details from Microsoft SharePoint Online using the spoke action, Look Up User Information By Login Name, to verify if the user is authorised to perform the required actions.

What to do next

  1. Navigate to Connections & Credentials > Credentials.

  2. Open the credential record you had created. For example, SharePoint Credentials.

  3. From Related Links, click Get OAuth Token.

    The system displays a confirmation message that the OAuth token flow is completed successfully. Review the details if the flow is not completed successfully.

    Note:

    • Confirm that the thumbprint has been defined in the connection record
    • Confirm that you allow pop-up windows in your browser. The spoke setup is completed and you can use the flows as per your requirement.

    Note: If the generated token doesn't work after the spoke setup, open your OAuth application in the Azure portal and select the two checkboxes under Implicit grant and hybrid flows.[Omitted image "ms-exchng-ol-tokens.png"] Alt text: Select the tokens in the Azure portal.

Search documentation
Search document titles and file paths on the australia branch