How to Set Up Microsoft Exchange Online IntegrationHub Spoke - Support and Troubleshooting

How to Set Up Microsoft Exchange Online IntegrationHub Spoke Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The Microsoft Exchange Online spoke allows you to create and manage calendar events and mail in Microsoft Exchange Online. User and group management is not supported in this spoke; for creating, managing, or deleting users and groups, use the Microsoft Azure AD spoke.

This KB article provides step-by-step guidance to set up and test the Microsoft Exchange Online spoke. For detailed information on dependencies, subscription setup, available flow actions, and required permissions, refer to the official documentation:

Official Documentation: Microsoft Exchange Online Spoke Documentation Store Link: Microsoft Exchange Online Spoke on ServiceNow Store Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } N/A

Instructions .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Step 1: Register an Application in Microsoft Azure Portal To enable ServiceNow to access Microsoft Exchange Online via OAuth 2.0, you need to register a custom application in Azure AD and configure the required permissions. Follow these steps:

Log in to Azure Portal

Open Microsoft Azure Portal and sign in using your organization credentials. Register a New Application

Navigate to Azure Active Directory > App registrations > New registration.

Enter the Application name Select the Supported account type based on your organization's requirements. Provide the Redirect URI in the following format: https:// .service-now.com/oauth_redirect.do Click Register. App registrations > Register an application * Name The user-facing display name for this application (this can be changed later). Microsoft Exchange Online spoke Supported account types Who can use this application or access this API? Accounts in this organizational directory only (IntegLab only - Single tenant) Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) Personal Microsoft accounts only Help me choose ... Redirect URI (optional) We'll return the authentication response to this URI after successfully authenticating the user. Providing this now is optional and it can be changed later, but a value is required for most authentication scenarios. Web V https:/ .service-now.com/oauth_redirect.do Register an app you're working on here. Integrate gallery apps and other apps from outside your organization by adding from Enterprise applications." width="866" height="683" />

Record Application Details

After registration, copy the Application (Client) ID and Directory (Tenant) ID. You will need these values when configuring the ServiceNow spoke. App registrations > Microsoft Exchange Online spoke ... P Search × « Delete Endpoints Preview features Overview ^ Essentials Quickstart Display name : Microsoft Exchange Online spoke Integration assistant Application (client) ID .. X Diagnose and solve problems Object ID .. V Manage Directory (tenant) ID Branding & properties Supported account types : My organization only Authentication Starting June 30th, 2020 we will no longer add any new features to Azure Active Directory Authentication Library (AL Certificates & secrets Microsoft Authentication Library (MSAL) and Microsoft Graph. Learn more I!I Token configuration 3- API permissions Get Started Documentation" width="845" height="438" />

Create a Client Secret

Navigate to Manage > Certificates & Secrets. Click New client secret. Provide a Description and select an Expiration period. Click Add. Copy the client secret value immediately and store it securely. It cannot be retrieved later. Microsoft Exchange Online spoke Microsoft Exchange Online spoke | Certificates & secrets ... O Search 87 Got feedback? # Overview Quickstart Credentials enable confidential applications to identify themselves to the authentication service when receiving tokens at a web addressable location (using an HTTPS scheme). For a higher level of assurance, we recommend using a certificate (instead of a client secret) as a credential. Integration assistant X Diagnose and solve problems Application registration certificates, secrets and federated credentials can be found in the tabs below. X Manage Branding & properties Authentication Certificates (0) Client secrets (1) Federated credentials (0) G Certificates & secrets A secret string that the application uses to prove its identity when requesting a token. Also can be referred to as application password. I!| Token configuration + New client secret 3- API permissions Description Expires Value ® Secret ID Expose an API Microsoft Exchange Online spoke - E App roles Owners Roles and administrators Manifest Support + Troubleshooting" width="876" height="455" />

Enable Required API Permissions

You can refer to the article KB2608496 : Permissions required for the Microsoft Exchange Online IntegrationHub spoke actions for detailed information on the API permissions needed for Microsoft Exchange Online.

Navigate to Manage > API permissions. Click Add a permission, then select the Microsoft Graph tile. Choose the necessary permissions. Click Add permissions. Click Grant admin consent to approve the permissions for your tenant. Microsoft Exchange Online spoke 5- Microsoft Exchange Online spoke | API permissions O Search « Refresh Or Got feedback? Overview Quickstart Configured permissions Integration assistant Applications are authorized to call APIs when they are granted permissions by users/admins as part of the consent process. The list of configured permissions should include all the permissions the application needs. Learn more about permissions and consent X Diagnose and solve problems Manage + Add a permission Grant admin consent for IntegLab Branding & properties API / Permissions name Type Description Admin consent requ ... Status Authentication V Microsoft Graph (16) .. . Certificates & secrets Calendars.ReadWrite Delegated Have full access to user calendars No Granted for ... I!| Token configuration Calendars.ReadWrite Application Read and write calendars in all mailboxes Yes v Granted for .. . 5- API permissions Calendars.ReadWrite.Shared Delegated Read and write user and shared calendars No Granted for ... .® Expose an API Group.ReadWrite.All Delegated Read and write all groups Yes Granted for ... App roles Mail.ReadWrite Delegated Read and write access to user mail No Granted for ... Owners Mail.ReadWrite.Shared Delegated Read and write user and shared mail No Granted for .. . Roles and administrators Mail.Send Delegated Send mail as a user No Granted for ... Manifest MailboxSettings.Read Delegated Read user mailbox settings No Granted for ... > Support + Troubleshooting MailboxSettings.ReadWrite Delegated Read and write user mailbox settings No Granted for ... MailboxSettings.ReadWrite Application Read and write all user mailbox settings Yes Granted for ... offline_access Delegated Maintain access to data you have given it access to No Granted for ... openid Delegated Sign users in No Granted for ... Place.Read.All Delegated Read all company places Yes Granted for .. . profile Delegated View users' basic profile No Granted for .. . User.Read Delegated Sign in and read user profile No Granted for ... User.ReadWrite.All Delegated Read and write all users' full profiles Yes Granted for ..." width="850" height="565" />

Once completed, the Azure AD application is registered and ready to be used with the Microsoft Exchange Online spoke in ServiceNow.

Step 2: Register Microsoft Exchange Online as an OAuth Provider

To allow the ServiceNow instance to request OAuth 2.0 tokens from Microsoft Exchange Online, you need to register it as an OAuth provider.

Register Microsoft Exchange Online (Authorization Code Flow)

Navigate to All > System OAuth > Application Registry. Open the record named Microsoft Exchange Online. Fill in the following fields using the values obtained from Azure AD: Client ID: Application (Client) ID from Azure AD. Client Secret: Client secret created in Azure AD. Authorization URL: https://login.microsoftonline.com/ /oauth2/v2.0/authorize Token URL: https://login.microsoftonline.com/ /oauth2/v2.0/token Token Revocation URL: OAuth server token revocation endpoint (optional). Redirect URL: https:// .service-now.com/oauth_redirect.do Click Save.

Register Microsoft Exchange Online (Client Credentials Flow)

Navigate to System OAuth > Application Registry. Open the record named Microsoft Exchange Online_clientCredentials. Fill in the following fields: Client ID: Application (Client) ID from Azure AD. Client Secret: Client secret created in Azure AD. Default Grant Type: Select Client Credentials. Token URL: https://login.microsoftonline.com/ /oauth2/v2.0/token Redirect URL: https:// .service-now.com/oauth_redirect.do Click Save.

Step 3: Create Credential Records for the Microsoft Exchange Online Spoke To authorize actions in the Microsoft Exchange Online spoke, you need to create credential records using the Azure AD application registered earlier. The spoke connection and credential alias use these credentials to perform actions securely.

Create OAuth 2.0 Credential (Authorization Code Flow)

Navigate to All > Connections & Credentials > Credentials. Click New. The system prompts: What type of credentials would you like to create? Select OAuth 2.0 Credentials. Fill in the following fields:

Field Description Name Unique name to identify the record, e.g., Exchange_Online_Credentials . Active Select to actively use the credential record. OAuth Entity Profile Select the OAuth profile created for Microsoft Exchange Online with Default Grant Type set to Authorization Code . Applies To Select the MID Servers that can use this credential, e.g., All MID Servers. Order Enter the order of use for credentials, e.g., 100.

Right-click the form header and select Save. To generate the OAuth token, click the Get OAuth Token related link.

Create OAuth 2.0 Credential (Client Credentials Flow)

Navigate to All > Connections & Credentials > Credentials. Click New. Select OAuth 2.0 Credentials. Fill in the following fields:

Field Description Name Unique name to identify the record, e.g., Exchange_Online_Client_Credential . Active Select to actively use the credential record. OAuth Entity Profile Select the OAuth profile created for Microsoft Exchange Online_clientCredentials with Default Grant Type set to Client Credentials . Applies To Select the MID Servers that can use this credential, e.g., All MID Servers. Order Enter the order of use for credentials, e.g., 100.

Right-click the form header and select Save. To generate the OAuth token, click the Get OAuth Token related link.

Verify Tokens

Navigate to All > System OAuth > Manage Tokens.

You will see:

Access and Refresh Tokens for the Authorization Code grant type. Access Token only for the Client Credentials grant type. Step 4: Create Connection Records for the Microsoft Exchange Online Spoke To perform actions in Microsoft Exchange Online, you need to create connection records. These connections, along with credential aliases, allow the Microsoft Exchange Online spoke to execute actions securely.

Create Connection Record (Authorization Code Flow)

Navigate to All > Connections & Credentials > Connection & Credential Aliases. Open the record Microsoft_Exchange_Online. In the Connections related list, click New. Fill in the following fields:

Field Description Name Unique name to identify the connection, e.g., Exchange_Online_Connection . Credential Select the credential record created for Microsoft Exchange Online, e.g., Exchange_Online_Credentials . Connection alias Alias record associated with this connection. URL builder Do not select the checkbox. Connection URL Enter https://graph.microsoft.com . Use MID Server Optional. If selected, define fields in the Advanced MID Server Configuration related list. Active Select to actively use the connection. Domain Domain in which the action or activity runs.

Click Update to save the connection. Create Connection Record (Client Credentials Flow) Navigate to Connections & Credentials > Connection & Credential Aliases. Open the record Microsoft_Exchange_Online_clientCred. In the Connections related list, click New. Fill in the following fields:

Field Description Name Unique name to identify the connection, e.g., Exchange_Online_Connection_clientCred . Credential Select the credential record created for Microsoft Exchange Online, e.g., Exchange_Online_Credentials_clientCred . Connection alias Alias record associated with this connection. URL builder Do not select the checkbox. Connection URL Enter https://graph.microsoft.com . Use MID Server Optional. If selected, define fields in the Advanced MID Server Configuration related list. Active Select to actively use the connection. Domain Domain in which the action or activity runs.

Click Update to save the connection. Note:

If you plan to use Microsoft Exchange Online spoke Mailbox actions, additional setup is required:

Ensure that a MID Server is installed and configured. Install PowerShell with the EXO V2 module on the MID Server. For detailed guidance on setting up the credentials and connection records for Mailbox actions, refer to the official documentation: Setup Microsoft Exchange Online Spoke

Steps to refer to in the above document:

Create a credential record specifically for Mailbox actions. Create a connection record for the Mailbox actions using the MID Server. These steps ensure that the Mailbox actions can run securely and properly through the MID Server using the required PowerShell module.

The Microsoft Exchange Online Spoke is now successfully set up and integrated with your ServiceNow instance. You may proceed to the bonus step to test the integration using spoke actions.

Bonus Step: Test the Integration with Spoke Actions

After setting up the Microsoft Exchange Online spoke, you can verify the integration by testing actions such as Create Calendar Event or Look Up Calendar Events by User ID .

Navigate to Flow Designer > Actions. Search for the action you want to test, for example, Create Calendar Event . This action creates an event in the user’s default calendar and allows you to specify the time zone for the start and end times.

Click on Test > Provide the required inputs > Run Test

You can also use the Look Up Calendar Events by User ID action to retrieve the list of event objects from the user’s mailbox.

V Action Outline Run your Action to make sure it has no errors before you activate it. When the test finishes running, Input Variables Inputs Label check the execution details to see each step's configuration, runtime values, and the log messages for any errors that occurred. User ID String 1 Pre Processing User ID V ::: Script User ID Calendar ID String Calendar ID V Time Zone Dynamic Choice ::: 2 (REST ] Look Up User Calendar E ... REST Calendar ID Time Zone V Throttle Priority Choice Time Zone Select a choice 3 Handle Errors Filter String Throttle Priority V cript Throttle Priority |High - Pre Processing [> Error Evaluation Filter V Filter path String [> Outputs time_zone String Run test in background O Step Status Object Cancel Run Test · Look Up User Calendar Events Variables Credential Value Password (2 Way ..." width="1078" height="377" />

<img src="/sys_attachment.do?sys_id=8699a1a547c5fa98c4e1a325126d43ea" alt="O Workflow Studio og Look up Calendar Events by by x 88 E Look up Calendar Events by DÒ Action . Microsoft Exchange Onli Flow execution . None y X EXECUTION DETAILS Look up Calendar Events by User ID C Test Run - Completed . Open Action Open context record State Start time Look up Calendar Events by User ID Session Information VARIABLE NAME VALUE Calling Source Flow Designer Test ACTION Look up Calendar Events by User ID Open Action Completed 05-11-2025 23:10:26 450ms Configuration Details VARIABLE NAME RUNTIME VALUE CONFIGURATION TYPE Calendar ID String Filter String Throttle Priority High Choice Time Zone Dynamic Choice User ID String Output Data VARIABLE NAME RUNTIME VALUE CONFIGURATION TYPE Action Status {"Action Status":{"code":0,"message":"Success"}} Object Don't Treat as Error true true True/False Error Message error_message String Events {"Events":[{"bodyHtml":"

Successfully performing these actions confirms the integration is working as expected. If you encounter any issues, please revisit the steps above or contact us for assistance whenever needed.