Integrating with Microsoft 365

Integrating with Microsoft 365 Integrating with Microsoft 365

Integrating your ServiceNow instance with the Microsoft 365 service enables you to track your software subscriptions and software usage to determine license compliance and act on optimization opportunities.

For more information about the Microsoft 365 services, see Microsoft 365 plans .

Important: Minimize security risks and protect information by granting access only to the necessary user or API permissions. Table 1. Minimal user permissions Process Required user role in the Microsoft 365 application Authentication scopes Download subscriptions Application developer User.Read.All Organization.Read.All

Pull user activity Power platform administrator Application developer

Reports.Read.All

Parent Topic: Microsoft 365 integration Register a Microsoft Azure AD application

Register an application through the Microsoft Azure portal.

Microsoft Azure AD Role required: Refer to the Minimal user permissions table.

From a web browser, open the App registrations page of the Microsoft Azure portal. Log in using your global administrator credentials. On the App registrations page, select New registration . In the Name section of the Register an application form, enter a name for the application. In the Supported account types section, select Accounts in any organizational directory (Any Azure AD directory - Multitentant) . Select Register . The application is registered and you are automatically redirected to the Overview page for the new application. On the Overview page, copy the values in the Application (client) ID and Directory (tenant) ID fields. Save them in a secure location for later use. Generate a client secret for your application. From the left navigation menu, navigate to Manage > Certificates & secrets . The Certificates & secrets page opens. In the Client secrets section, generate a client secret for the application by selecting New client secret . The Add a client secret dialog box opens. On the dialog box, fill in the fields. Table 2. Add a client secret dialog box Field Description Description Description of the client secret. Expires Period of time after which you want the client secret to expire. The options are: In 1 year In 2 years Never

Select Add . The dialog box closes and you return to the Certificates & secrets page. In the Client secrets section, copy the value in the VALUE field for the newly generated client secret. Save this in a secure location for later use.

Specify the level of access that the application has to your protected resources. From the left navigation menu, navigate to Manage > API permissions . The API permissions page opens. Select Add a permission . The Request API permissions dialog box opens. On the dialog box, select the Microsoft APIs tab. From the list of available Microsoft APIs, select Microsoft Graph . When prompted to select the types of permissions that the application requires, select Application permissions . Under Select permissions, select the check boxes for the following permissions: Reports.Read.All User.Read.All Organization.Read.All

Select Add permissions . The dialog box closes and you return to the API permissions page.

Grant admin consent for your application.

After you successfully register and set up your application, remain in the Microsoft Azure portal if you need to enable your application to access Power BI service content and APIs.

Enable service principal authentication for Power-BI read-only APIs

Grant your application access to Power BI service content and APIs by enabling service principal authentication for Power BI read-only APIs. Power BI service content and APIs help optimize your Microsoft 365 subscriptions, such as by downgrading subscriptions from Office 365 E5 to Office 365 E3.

Microsoft Azure AD Role required: global administrator

Power BI Role required: global administrator or Power BI administrator

Note: This configuration enables ServiceNow Software Asset Management to get the usage information (Last usage time) for all Power BI Pro deployments across the Web and Desktop. Software Asset Management pulls the last activity date for Power BI deployments that are part of Microsoft 365 subscriptions.

Service principal is an authentication method that allows your application to access secure Microsoft Azure AD resources, such as Power BI service content and APIs.

Create a security group for service principal authentication. Security groups enable you to manage which users, devices, groups, and service principals can access shared resources. If you want to use an existing security group for service principal authentication, skip to step 2 . On the page header of the Microsoft Azure portal, use the search bar to search for and select the Azure Active Directory service. The Overview page for the Azure Active Directory service opens. From the left navigation menu of the Azure Active Directory service, navigate to Manage > Groups . The Groups > All groups page opens. On the All groups page, select New group . On the form, fill in the fields. Table 3. New Group form Field Description Group type Group type. Set this field to Security . Group name Name of the group. Group email address Email address that is shared between all group members. Group description Description of the group. Membership type Method in which members can be added to or removed from the group. The options are: Assigned : Members must be added or removed manually. Dynamic user : Members are added or removed automatically based on the dynamic group rules that you define. See Create or update a dynamic group in Azure Active Directory for more information on dynamic group rules. Dynamic device : Devices are added or removed automatically based on the dynamic group rules that you define. See Create or update a dynamic group in Azure Active Directory for more information on dynamic group rules.

Select Create .

The security group is created and then you are redirected to the Overview page for the new group. Add the application that you created in Register a Microsoft Azure AD application as a member of your security group. If you did not create a security group in step 1 and are using an existing security group instead, open your existing security group. If you created a security group in step 1 , skip to step b . On the page header of the Microsoft Azure portal, use the search bar to search for and select the Azure Active Directory service. The Overview page for the Azure Active Directory service opens.

From the left navigation menu of the Azure Active Directory service, navigate to Manage > Groups . The Groups > All groups page opens.

From the list of available groups, locate and select your existing security group. The Overview page for the security group opens.

From the left navigation menu of your security group, navigate to Manage > Members . The Members page opens. On the Members page, select Add members . The Add members dialog box opens. On the dialog box, search for and select the application that you created in Register a Microsoft Azure AD application . Important: The application must not have any Power BI admin permissions set from the Microsoft Azure portal. You can verify your application permissions using the following steps: Log in to the Microsoft Azure portal using either your global administrator, application administrator, or cloud application administrator credentials. On the page header of the Microsoft Azure portal, use the search bar to search for and select the Azure Active Directory service. The Overview page for the Azure Active Directory service opens.

From the left navigation menu of the Azure Active Directory service, navigate to Manage > Enterprise applications . The Enterprise applications page opens.

From the list of available enterprise applications, locate and select your application. Select Permissions . Verify that no Power BI admin-consent-required permissions are set on the application.

Select Select . The application is added as a member of your security group.

Enable your security group to access read-only Power BI admin APIs. In a new tab or web browser, open Power BI . Log in using either your global administrator or Power BI administrator credentials. The Power BI portal opens. On the page header of the Power BI portal, select the Settings icon ( ) and then select Admin portal . The Power BI Admin portal opens. From the left navigation menu of the Admin portal, select Tenant settings . Your Power BI tenant settings open. In the Admin API settings section, expand the Allow service principals to use read-only Power BI admin APIs setting. Select the toggle button to enable the setting. When prompted, select the option to apply the setting to Specific security groups . In the corresponding text box, enter the name of your security group. Select Apply .

After you enable this setting through the Power BI Admin portal, any application permissions that you set from the Microsoft Azure portal are no longer effective. All application permissions must subsequently be set and managed through the Power BI Admin portal.

Configure updates on Microsoft 365 Admin Center

Prevent anonymous user information in Microsoft 365 reports on activity to be imported to ServiceNow .

Role required: admin

Log in to Microsoft 365 admin center by using your admin credentials. Navigate to Settings > Services > Org settings > Reports . Deselect the Display concealed user, group, and site names in all reports check box. For more information about the Microsoft 365 reports showing anonymous user information, see Microsoft 365 reports show anonymous user names instead of actual user names .

Create a Microsoft 365 integration profile

Create an integration profile to track software subscriptions and optimize stale licenses for the Microsoft 365 service.

ServiceNow Role required: sam_integrator or admin

To integrate with Microsoft 365 , activate the following plugins: Software Asset Management Professional for Microsoft plugin (com.snc.samp.microsoft) Software Asset Management - SaaS License Management (sn_sam_saas_int) plugin from the ServiceNow Store For more information, see Request SaaS License Management .

If you’re using Software Asset Workspace , the option to create the direct integration profile in Core UI is inactive.

From a web browser, open your ServiceNow instance. Interface Action Core UI Navigate to All > Software Asset > SaaS License > Direct Integration Profiles Software Asset Workspace Navigate to Workspaces > Software Asset Workspace > License operations . Under User subscription , select Direct integration profiles .

Select New . Select Microsoft 365 Integration Profile . On the form, fill in the fields. Table 4. Integration Profile form Field Description Display name Name of the integration profile. For example, Microsoft 365 integration for your-company >. Client Id Client ID of the application that you registered in the Microsoft Azure portal. Enter the application (client) ID that you copied in Register a Microsoft Azure AD application . Client secret Client secret of the application that you registered in the Microsoft Azure portal. Enter the client secret that you copied in Register a Microsoft Azure AD application . Tenant name or Id Globally unique identifier (GUID) of the application that you registered in the Microsoft Azure portal. Enter the directory (tenant) ID that you copied in Register a Microsoft Azure AD application . Warning: When entering the directory (tenant) ID, do not add any additional extensions to the ID. Enter the ID exactly as it was copied in Register a Microsoft Azure AD application . REST message Message that enables you to send requests to a REST web service endpoint. Profile type Type of integration profile. This field is automatically set to Microsoft 365 .

Select Submit . Optional: Check the status of the user subscription job by navigating to Software Asset > Administration > Job Results . When you create an integration profile, a reclamation rule is automatically created for the software. It's important that you review the reclamation rule to ensure that it meets your specifications. You can view all automatically generated reclamation rules for Office 365 by navigating to Software Asset > Administration > Reclamation Rules . Reclamation rules are applied based on the Microsoft System Center Configuration Management (SCCM) usage data that is pulled through the Microsoft SCCM usage integration. For more information on these reclamation rules, see Create a reclamation rule to import Microsoft SCCM usage data .

Note: ServiceNow automatically creates one default reclamation rule for Office 365. You can also update the Last activity threshold field under the Subscription Usage Condition tab.

Determine and verify Microsoft 365 subscription information in your ServiceNow instance

Determine the exact software subscription information to be pulled from Microsoft 365 admin center and verify if complete subscription information is pulled accurately to ServiceNow .

Role required: sam_admin

Filter with the Microsoft 365 integration profile you created to determine the exact software subscription information to be pulled from Microsoft 365 admin center to ServiceNow . This subscription includes all subscriptions available on the Microsoft 365 admin center. Verify with the Microsoft 365 admin if complete subscription information is pulled accurately to ServiceNow . Note: Software Asset Management pulls the last activity date for Microsoft 365 products using a combination of SCCM integration and Microsoft 365 integration.

If your Microsoft 365 subscription data isn’t getting pulled into Software Asset Management , verify your integration setup: On the Integration Profile form, open the REST message record by selecting the Preview icon ( ) next to the REST message field and then selecting Open Record in the record preview. On the Rest Message form, select the Get OAuth Token related link. On the OAuth flow verification dialog box, view the status of the OAuth flow to determine whether your integration is set up correctly. If the OAuth token flow completed successfully message appears, your integration is set up correctly. If the OAuth flow failed message appears, your integration isn’t set up correctly. Use the information in this message to identify the errors in your integration setup.

If your Power BI usage isn’t getting pulled into Software Asset Management , verify the status of your Power BI API connection: On the Integration Profile form, right-click the form header. Select Show XML . An XML file opens in a new window.

Under > > , view the powerBIStatus property to determine the status of your Power BI API connection. If the powerBIStatus property is set to success , the Power BI API connection was successful. If the powerBIStatus property is set to failed , the Power BI API connection wasn’t successful. Verify that you’ve followed all the integration setup steps correctly. You can also check your logs for more information about any errors in your integration setup.

Evaluating software usage activity

Evaluating software usage activity through Software Asset Management enables you to optimize your Microsoft 365 plan usage and helps determine the optimized plans for your Microsoft 365 subscription. Software Asset Management generates a removal candidate for the current subscription that displays an optimized subscription on the License workbench recommending you to shift from a costly subscription plan to an optimized one.

After the Microsoft 365 integration connects, you can evaluate the information in the Software Usages (samp_sw_usage) table to determine the usage data for individual software products provided within the subscription. The SAM - Collect Microsoft 365 Usage job collects the usage data daily and the SAM - Create New Reclamation Candidates for Office 365 Integration generates removal candidates monthly.

The Software Usages table provides information on the date the software was last used and the usage type of the activities performed by users: Desktop, Web, Mobile, or cumulative across platforms. This information can help you decide on the optimized plan for products within your Microsoft 365 subscription.

Evaluate Microsoft 365 compliance and optimization results

Evaluate Microsoft 365 compliance and optimization results to find actual and potential cost savings and recommended licensing optimizations.

Role required: sam_admin or sam_user

The discovery of Microsoft 365 must be complete to evaluate the software compliance. For more information about using Discovery and Microsoft SCCM together, see Discovery and SCCM together .

The usage of Microsoft 365 plans must be available from both Microsoft certified APIs and Microsoft SCCM to evaluate the software optimization.

Navigate to Software Asset Workspace > License operations . In the left pane, select Licensing > Software entitlements . Select New . Create entitlements for Microsoft 365 by selecting the correct Publisher Part Number (PPN) to verify compliance. For more information about creating entitlements, see Create entitlements in workspace . Note: Ensure that the License metric value is User Subscription.

Navigate to License usage in the left pane. Select the Reconciliation tab. Select Run reconciliation . View compliance analysis results in Office 365 & Adobe Cloud dashboard in Software Asset Management classic and SaaS overview dashboard in workspace . For more information about running software reconciliation, see Run software reconciliation and Run Software Asset Management Foundation plugin software reconciliation in classic . View all optimized plans for Microsoft 365 subscription on the <a class="xref" href="../reference/optimization-dashboard-workspace.html" title="Use the Optimization and savings dashboard to view actual and potential cost savings for your software assets. In addition, view the recommended licensing optimizations for third-party software publishers, including Microsoft, Red Hat, and SAP. Use this information to downgrade or reclaim licenses so that you can optimize your licensing costs.">Optimization and savings dashboard in workspace .

Update REST and OAuth endpoints for Microsoft Office 365 Government plans

Change the endpoints of the REST message and OAuth application on your ServiceNow subscription profile so that you can use your subscriptions.

Role required: sam_admin

The Now Platform® supports Microsoft Office 365 Government plans, which provide all the features and capabilities of Microsoft 365 services in a segmented government cloud community that enables organizations to meet U.S. compliance and security standards.

For more information on Microsoft Office 365 Government plans, see Office 365 Government .

From your ServiceNow instance, navigate to All > Software Asset > SaaS License > Direct Integration Profiles . Select the Microsoft 365 integration profile that you want to update. On the Integration Profile record, select the Preview this record icon ( ) next to the REST message field. On the record preview, select Open Record . The REST Message record opens. Update the REST message endpoints on your Microsoft 365 integration profile. REST message endpoints enable you to retrieve usage data from your Microsoft 365 applications and services.

In the HTTP Methods related list, update the REST message endpoints based on your needs. Microsoft provides various endpoints for Microsoft Office 365 Government plans. For more information on the available endpoints, see Office 365 U.S. Government GCC High endpoints .

Important: You must change the .com to .us in the URL of each endpoint. For example, you must change https://graph.microsoft.com/v1.0/reports to https://graph.microsoft.us/v1.0/reports.

Select Save . Update the OAuth entity scope for the GET PowerBI Usage endpoint. The OAuth entity scope specifies the level of access that users have to your protected resources. Select the GET PowerBI Usage endpoint.

The HTTP Method record opens.

In the Authentication section of the HTTP Method record, select the Preview this record icon ( ) next to the OAuth profile field. On the record preview, select Open Record .

The OAuth Entity Profile record opens.

In the OAuth Entity Profile Scopes list, update the OAuth scope field of the PowerBIPermissions OAuth entity scope with the backend API URL that you are using for Microsoft Power BI. Note: Microsoft supports various backend API URLs for Power BI. For more information on the available URLs, see Power BI for US Government . Select Update .

The OAuth Entity Profile record closes and you automatically return to the REST Message record.

Update the OAuth application endpoint on your Microsoft 365 integration profile. The OAuth application endpoint enables your ServiceNow instance to access your Microsoft 365 subscription data. In the Authentication section of the REST Message record, select the Preview this record icon ( ) next to the OAuth profile field. On the record preview, select Open Record . The OAuth Entity Profile record opens. In the OAuth Entity Profile Scopes list, change the .com to .us in the URL that is listed in the OAuth scope field of the Permissions OAuth entity scope. Select the Preview this record icon ( ) next to the OAuth provider field. On the record preview, select Open Record . The Application Registries record opens. Select the Edit URL icon ( ) next to the Token URL field. In the URL, change the .com to .us. For example, change https://login.microsoftonline.com to https://login.microsoftonline.us. Select the Lock URL icon ( ). Select Update .