{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":13105,"path":"employee-service-management/setup-sp-ovrvw.md","title":"Setting up the SharePoint Online Search Connector","bundle":null,"doc_type":null,"release":"australia","body":"\n# Setting up the SharePoint Online Search Connector\n\nSet up the SharePoint Online Search Connector by configuring and connecting the Microsoft SharePoint tenant with your instance. Validate the connection to avoid any setup failures before indexing the sites for search.\n\n## Configure the Microsoft SharePoint tenant\n\nConfigure your Microsoft SharePoint tenant to get started with the SharePoint Online Search Connector.\n\n### Before you begin\n\nAs a Microsoft SharePoint administrator, create a custom application by specifying the root URL \\(`https:// <sitename>.sharepoint.com`\\), app domain, redirect URL, and other settings.\n\n**Important:** Starting with the Yokohama release, SharePoint Online Search Connector is being prepared for future deprecation. It’s hidden and no longer activated on new instances but continue to be supported.\n\nFor deprecation details, see the [Deprecation Process \\[KB0867184\\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0867184) article in the Now Support knowledge base.\n\nEnsure you complete the following prerequisites.\n\n-   Follow the procedure to [Configure OAuth application in Microsoft Azure](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/configure-oauth-application-in-microsoft-azure.md).\n-   Follow the procedure to [Set up Microsoft Entra ID spoke](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/set-up-azure.md). Microsoft Entra ID spoke \\(formerly known as Microsoft Azure Active Directory spoke\\) is a dependent plugin that needs to be set up before indexing the users.\n-   Understand how to [Configure Microsoft SharePoint Graph connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/configure-microsoft-sharepoint-graph-connection.md).\n-   Log in with your admin credentials to grant permissions.\n\nRole required: admin\n\n### About this task\n\nComplete the following procedure from your Microsoft SharePoint account. For more information on creating and configuring custom applications, see the [SharePoint development](https://docs.microsoft.com/en-us/sharepoint/dev/)\n\n**Note:** When the permissions assigned in the Azure apps have privilege issues, the following error message appears: `Error message: Method failed: (/_api/web/XXXXXXX) with code: 401 - Invalid username/password combo`. Address this issue with the instructions available in [KB1117977](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1117977).\n\nWhen you want the search results to display only the published versions of the documents, ensure you select **Application permissions** instead of the **Delegated permissions** while configuring the permissions explained in [Microsoft SharePoint Online Spoke](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/sharepoint-online-spoke.md).\n\n**Note:** Admins can limit indexing to the published versions only, ensuring that drafts or unfinished work aren’t displayed in the search results.​\n\n### Procedure\n\n1.  Navigate to **Azure** &gt; **Active Directory** &gt; **App registrations** &gt; **All applications**, and select an existing app.\n\n    Use an existing application or create an application.\n\n2.  **Configured permissions**\n3.  Navigate to **App registrations** &gt; **API permissions**, and click **Add a permission**.\n\n4.  Select one of the following options:\n\n    1.  Navigate to **Microsoft Graph** &gt; **Delegated permissions** for Graph.\n\n    2.  Navigate to **Microsoft Graph** &gt; **Application permissions** for Graph.\n\n    Add the **Sites.ReadWrite.All** permission from the Sites list. The Sites.ReadWrite.All permission helps with subscription creation.\n\n    Add the **User.Read** permission from the Users list.\n\n    These user permissions are used to crawl the Microsoft SharePoint data later.\n\n5.  Navigate to **Sharepoint** &gt; **Application permissions** &gt; **Sites**, and select **Sites.FullControl.All**, **Sites.Read.All**, or **Sites.Selected** for REST.\n\n    Enable the **Sites.Selected** permission by performing the following steps.\n\n    1.  In the Microsoft Azure application, enable the **Sites.Selected** and the **User.Read.All** permissions.\n\n        Use any API client to provide read access for the following site collections.\n\n        -   Application X that is connected to a ServiceNow instance and has the **Sites.Selected** permission.\n        -   Application Y that is an admin application and has the **Sites.Full.Control** permission for Graph connection.\n    2.  Get a bearer token by calling the API method https://login.microsoftonline.com/\\{Tenant Id\\}/oauth2/v2.0/token.\n\n        Payload:\n\n        ```json\n        client_id={App Y client id}\n        &scope=https%3A%2F%2Fgraph.microsoft.com%2F.default\n        &client_secret={App Y client secret}\n        &grant_type=client_credentials\n        ```\n\n    3.  Pass the token received in step b as the authorization token while calling the API method https://graph.microsoft.com/v1.0/sites/\\{site id\\}/permissions.\n\n        Payload:\n\n        ```\n        {\n        \"roles\": [\n        \"read\"\n        ],\n        \"grantedToIdentities\": [\n        {\n        \"application\": {\n        \"id\": \"App X client id\",\n        \"displayName\": \"App X\"\n        }\n        }\n        ]\n        }\n        ```\n\n6.  Ensure you configure the required API permissions as shown in the following image:\n\n    \\[Omitted image \"spoc-permissions-azure.png\"\\] Alt text: SharePoint configured permission list\n\n    For more information, see [Configure Microsoft SharePoint Graph connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/configure-microsoft-sharepoint-graph-connection.md).\n\n7.  Click **Grant admin consent**, select **Yes**, and click **Save and Continue**.\n\n8.  Navigate to **Authentication** &gt; **Web** &gt; **Redirect URLs** and add the URL in this format `https://<your Servicenow instance URL>/oauth_redirect.do`, for example, [https://eesharepoint.example.com/oauth\\_redirect.do](https://eesharepoint.example.com/oauth_redirect.do) and click **Save**.\n\n9.  Navigate to [Microsoft SharePoint Online Spoke](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/sharepoint-online-spoke.md) and register the certificate and secret for your application.\n\n10. Click **Add user** on the [Microsoft admin portal](http://admin.microsoft.com/AdminPortal/Home#/users), specify the user details, and click **Finish**.\n\n    **Note:** The search crawls the sites that you can access. Ensure that you select the user with appropriate permissions for only the required content. For more information, see [user permissions](https://docs.microsoft.com/en-us/sharepoint/customize-sharepoint-site-permissions). Selecting a high-level user can import more documents than you want to import.\n\n    For more information, see [Granting access via Azure AD App-Only](https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread).\n\n\n### What to do next\n\nComplete the integration from your ServiceNow AI Search account. For more information, see [Integrate the Microsoft SharePoint search sources with the AI Search profiles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/setup-sp-ovrvw.md).\n\n## Integrate the Microsoft SharePoint search sources with the AI Search profiles\n\nLink search sources to a search profile to specify the content users can search through the linked search profile.\n\n### Before you begin\n\nRole required: admin\n\n### Procedure\n\n1.  Navigate to **Search Applications** &gt; **Search Application Configurations** \\(sys\\_search\\_context\\_config\\).\n\n2.  Update the following values, for **Virtual Agent Default Search Application**\n\n    -   Search Engine: **AI Search**.\n    -   Search Profile: **ESC Portal Default Search Profile**. This dynamic field value is visible after you change the **Search Engine** value.\n    For more information, see [Create a search application configuration for AI Search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/create-search-app-config-ais.md).\n\n\n### What to do next\n\nConnect the ServiceNow® instance with the Microsoft SharePoint tenant. Complete the steps from your ServiceNow® account. For more information, see [Connect your ServiceNow instance to a Microsoft SharePoint tenant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/setup-sp-ovrvw.md).\n\n## Connect your ServiceNow instance to a Microsoft SharePoint tenant\n\nConnect your ServiceNow instance with a Microsoft SharePoint tenant. Create custom ServiceNow OAuth connections for Microsoft SharePoint to authenticate ServiceNow requests.\n\n### Before you begin\n\n-   Ensure that you have working knowledge of the [SharePoint developer program](https://developer.microsoft.com/en-us/microsoft-365/dev-program) tools and other resources to configure the application.\n-   Ensure that you’re aware of the ServiceNow® integrations.\n\nRole required: sn\\_sp\\_con.admin and admin.\n\n### Procedure\n\n1.  Navigate to **ServiceNow instance** &gt; **System OAuth** &gt; **Application Registry**.\n\n2.  Click **New**.\n\n    The system displays the message `What kind of OAuth application?`\n\n3.  Select **Connect to a third-party OAuth Provider**.\n\n4.  Create the following registries:\n\n    1.  On the Graph connection form, fill in the fields.\n\n        For a description of the field value, see [Graph connection form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/graph-connection-form.md).\n\n    2.  On the REST connection form, fill in the fields.\n\n        For a description of the field value, see [REST connection form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/rest-connection-form.md).\n\n    3.  Right-click the form header and click **Save**.\n\n5.  **OAuth Entity Profile**\n6.  Navigate to the OAuth Entity Profiles \\[oauth\\_entity\\_profile\\] table to find the following entries:\n\n    -   `<Graph application registry name>.default_profile`\n    -   `<REST application registry name>.default_profile`\n    Two system-generated OAuth entity profiles \\(REST and Graph\\) are created in the OAuth Entity Profiles \\[oauth\\_entity\\_profile\\] table. For more information, see [Specify an OAuth profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/web-services/t_SpecifyAnOAuthProfile.md)\n\n7.  **OAuth Entity Scopes**\n8.  Insert a row with the following values in the OAuth Entity Scopes \\[oauth\\_entity\\_scope\\] table:\n\n<table id=\"table_vvw_4rl_s1c\"><thead><tr><th>\n\nGraph\n\n</th><th>\n\nREST\n\n</th></tr></thead><tbody><tr><td>\n\nName: Any name of your choice\n\n</td><td>\n\nName: Any name of your choice\n\n</td></tr><tr><td>\n\nOAuth Provider: Graph Application Registry record\n\n</td><td>\n\nOAuth Provider: REST Application Registry record\n\n</td></tr><tr><td>\n\nApplication: Global\n\n</td><td>\n\nApplication: Global\n\n</td></tr><tr><td>\n\n\\(For Delegated permissions\\) OAuthscope: `offline_access https://graph.microsoft.com/Sites.ReadWrite.All`\\(For Application permissions\\) OAuthscope: `https://graph.microsoft.com/.default`\n\n</td><td>\n\nOAuth Scope:`https://<instance name>.sharepoint.com/`\n\n</td></tr></tbody>\n</table>    For more information, see [Specify an OAuth scope](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/web-services/t_SpecifyAnOAuthScope.md).\n\n9.  **OAuth Entity Profiles Scopes**\n10. Insert a row with the following values in the OAuth Entity Profiles Scopes \\[oauth\\_entity\\_profile\\_scope\\] table:\n\n    |Graph|REST|\n    |-----|----|\n    |OAuth Entity Profile: Graph entity profile generated in the OAuth Entity Profiles \\[oauth\\_entity\\_profile\\] table.|OAuth Entity Profile: REST entity profile generated in the OAuth Entity Profiles \\[oauth\\_entity\\_profile\\] table.|\n    |OAuth Entity Scope: Select the graph OAuth Entity Scope \\[oauth\\_entity\\_profile\\_scope\\] table.|OAuth Entity Scope: Select the REST OAuth Entity Scope \\[oauth\\_entity\\_profile\\_scope\\] table.|\n    |Application: Global|Application: Global|\n\n11. **Credentials**\n12. Navigate to **Connections &amp; Credentials** &gt; **Credentials**, and create the OAuth 2.0 credentials:\n\n    1.  On the Graph or REST credential forms, fill in the fields.\n\n<table id=\"table_qyn_qtg_ywb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of your choice.\n\n</td></tr><tr><td>\n\nOAuth entity profile\n\n</td><td>\n\n\\(For Graph\\) Graph entity profile identified.\\(For REST\\) REST entity profile identified.\n\n</td></tr></tbody>\n</table>    2.  Right-click the form header and click **Save**.\n\n        **Note:** For more information on Entities, Connection &amp; Credential Aliases, see [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/conf-graph-root.md).\n\n13. **Connection**\n14. Navigate to **Connections &amp; Credentials** &gt; **Connection**, and click **New** to create HTTP\\(s\\) connections for the following **Graph** or **REST**.\n\n    1.  On the form, fill in the fields.\n\n        |Field|Description|\n        |-----|-----------|\n        |Name: Any name of your choice for Graph|Name: Any name of your choice for REST|\n        |Credentials: Select the graph **Credentials**|Credentials: Select the REST **Credentials**|\n        |Connection alias: `sn_sp_spoke.MicrosoftSharePointGraph`|Connection alias: `sn_sp_spoke.MicrosoftSharepointOnline`|\n        |Connection URL:`https://graph.microsoft.com/v1.0/`|Connection URL: `https://<Host URL of your SharePoint instance>/`|\n        |Domain: Global|Domain: Global|\n\n    2.  Right-click the form header and click **Save**.\n\n    For more information, see [Connections and Credentials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/r-credentials.md) and [Create an HTTP\\(s\\) connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/create-https-connection.md).\n\n15. **Tenants**\n16. Navigate to **Microsoft Sharepoint Online** &gt; **Tenants.**\n\n    1.  Click **New** to create **Graph** or **REST** connections.\n\n    2.  On the form, fill in the fields.\n\n<table id=\"table_cpv_vvg_ywb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of your choice.\n\n</td></tr><tr><td>\n\nAlias\n\n</td><td>\n\nFor Graph: `sn_sp_spoke.MicrosoftSharePointGraph`For REST: `sn_sp_spoke.MicrosoftSharepointOnline`\n\n</td></tr><tr><td>\n\nSharePoint root URL\n\n</td><td>\n\nRoot URL as `<SiteName>.sharepoint.com`\n\n</td></tr><tr><td>\n\nTenant ID\n\n</td><td>\n\nTenant ID required for the Graph or REST connection.\n\n</td></tr><tr><td>\n\nDomain\n\n</td><td>\n\nGlobal\n\n</td></tr></tbody>\n</table>    3.  Right-click the topic header and click **Save**.\n\n    For more information, see [Define tenants](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/create-tenant.md), [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/conf-graph-root.md), and [Create aliases for multiple tenants](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/create-aliases-sharepoint.md)\n\n17. **Certificates**\n18. Navigate to **System definition** &gt; **Certificates** &gt; **Microsoft SharePoint Online Certificate**.\n\n    1.  Attach the file generated Java Key Store certificate on the Azure AD portal.\n\n        For more information, see [Attach a Java Key Store certificate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/set-up-microsoft-sharepoint-online-and-connection-record.md).\n\n    2.  Update the Key store password with the password of the `Java Key Store (.jks)` file.\n\n    3.  Update the type to the Java key store.\n\n    4.  Right-click the topic header and click **Save**.\n\n    For more information, see [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/conf-graph-root.md).\n\n19. **JWT keys**\n20. Navigate to **System OAuth** &gt; **JWT keys** &gt; **Microsoft SharePoint Online JWT Keys**.\n\n    1.  Update signing key with password of `Certificate (.cer)` file.\n\n    2.  Right-click the topic header and click **Save**.\n\n21. Navigate to **System OAuth** &gt; **JWT providers** &gt; **Microsoft SharePoint Online JWT Provider**.\n\n    1.  Update the **aud** claim with `https://login.microsoftonline.com/<Tenant-id>/oauth2/token`.\n\n    2.  Update the **iss** and **sub** claim with the respective client ids on the Azure ad app registrations.\n\n    3.  Click **Save**.\n\n22. **Connection**\n23. Navigate to **Connections &amp; Credentials** &gt; **Connection**.\n\n    1.  Open the REST connection record and on the **Attributes** tab, specify the Base 64 encoded certificate **Thumbprint**.\n\n        **Note:** The SharePoint app thumbprint value is hex encoded. Encode the same in the Base64 format in the connection record.\n\n    2.  Select the following **Credentials** option:\n\n        -   \\(For **Graph**\\): Navigate to the \\[Credentials\\] table \\(oauth\\_2\\_0\\_credentials\\), open **Graph**, and click **Get OAuth Token**.\n\n            Ensure that you log in to your Microsoft SharePoint instance with the credentials of the user that you created to get the OAuth token for the Graph connection. Store the credentials in the instance.\n\n        -   \\(For **REST**\\): Go to the \\[Credentials\\] table \\(oauth\\_2\\_0\\_credentials\\), open **REST**, and click **Get OAuth Token**.\n\n            Ensure that you log in to your Microsoft SharePoint instance with the Tenant administrator credentials to get the OAuth token for the REST connection. Store the credentials in the instance.\n\n            Validate the credential to avoid any configuration failure. For more information on validating the SharePoint connection, see [Validate the Microsoft SharePoint connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/setup-sp-ovrvw.md).\n\n    3.  Click **Save**.\n\n24. **Trusted Domains**\n25. Go to **Trusted Domains** table \\(sn\\_ais\\_spoke\\_trusted\\_domains\\) and click **New** to create a domain record.\n\n    1.  On the form, fill in the fields.\n\n        |Field|Description|\n        |-----|-----------|\n        |Name|Name of your choice.|\n        |Domain|&lt;Host URL of your Microsoft SharePoint tenant&gt;.|\n\n    2.  Click **Save**.\n\n        For more information, see [Set up the AI Search spoke](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/setup-ais-spoke.md).\n\n        **Note:** Ensure you create a trusted domain record for each tenant, when there are multiple tenants.\n\n26. **Sharepoint Ingest User**\n27. Navigate to **Connections &amp; Credentials** &gt; **Connection &amp; Credential Aliases** &gt; **Sharepoint Ingest User** \\(sn\\_sp\\_con.Sharepoint\\_Ingest\\_User\\).\n\n    1.  Click **New** on **Credentials** to create a **Basic Auth Credential** for ingesting external content by AIS.\n\n    2.  Specify the **User name** and **Password** of the user \\(sys\\_user\\) who has the **ais\\_external\\_content** role.\n\n        \\[Omitted image \"spoc-ingest-user.png\"\\] Alt text: ingest user\n\n        **Note:** In the example screenshot, the user `abel.tuter` is the sys\\_user who has the ais\\_external\\_content role assigned.\n\n    3.  Click **Submit**.\n\n        For more information, see [Create aliases for multiple tenants](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/create-aliases-sharepoint.md).\n\n    4.  Configure the [AI Search server connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/setup-ais-spoke.md) before you proceed with the next steps.\n\n    The Entity View Action Mapper \\(EVAM\\) configuration is available by default with Employee Center Pro version 32.0.\n\n    For more information on EVAM definition, see [Create an EVAM action definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/define-evam-action.md) and [Create a multi-data source list display in Entity View Action Mapper](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/tutorial-create-evam.md).\n\n\n### Result\n\nYour configuration is complete.\n\n### What to do next\n\n[Validate the Microsoft SharePoint connection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/setup-sp-ovrvw.md) to rule out any configuration failure before indexing a sample site.\n\n## Validate the Microsoft SharePoint connection\n\nRun a validation after you connect your ServiceNow instance with a Microsoft SharePoint tenant to check for any errors in the configuration.\n\n### Before you begin\n\nRole required: admin\n\n### About this task\n\nThe validation rules out any configuration failure and ensures a seamless setup process.\n\n### Procedure\n\n1.  Navigate to **System UI** &gt; **UI Pages** &gt; **Sharepoint utility**.\n\n2.  Select **Try it** to navigate to the SharePoint Connection validation page.\n\n3.  Enter the required details and select **Validate**.\n\n    The errors, if any, are displayed in the Response section.\n\n4.  Check the **Table name** links and fix the errors based on the **Current Value** and **Expected Value** displayed in the Response section.\n\n    If any information is missing, the Error field shows the data.\n\n    If there are no errors, the Response section displays a successful validation.\n\n\n### What to do next\n\nIndex sites for search. For more information, see [Index sites for search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/employee-service-management/sharepoint-how-to-configure-search.md).\n\n"}}