Setting up the SharePoint Online Search Connector

Set up the SharePoint Online Search Connector by configuring and connecting the Microsoft SharePoint tenant with your instance. Validate the connection to avoid any setup failures before indexing the sites for search.

Configure the Microsoft SharePoint tenant

Configure your Microsoft SharePoint tenant to get started with the SharePoint Online Search Connector.

Before you begin

As a Microsoft SharePoint administrator, create a custom application by specifying the root URL (https:// <sitename>.sharepoint.com), app domain, redirect URL, and other settings.

Important: Starting with the Yokohama release, SharePoint Online Search Connector is being prepared for future deprecation. It’s hidden and no longer activated on new instances but continue to be supported.

For deprecation details, see the Deprecation Process [KB0867184] article in the Now Support knowledge base.

Ensure you complete the following prerequisites.

• Follow the procedure to Configure OAuth application in Microsoft Azure.
• Follow the procedure to Set up Microsoft Entra ID spoke. Microsoft Entra ID spoke (formerly known as Microsoft Azure Active Directory spoke) is a dependent plugin that needs to be set up before indexing the users.
• Understand how to Configure Microsoft SharePoint Graph connection.
• Log in with your admin credentials to grant permissions.

Role required: admin

About this task

Complete the following procedure from your Microsoft SharePoint account. For more information on creating and configuring custom applications, see the SharePoint development

Note: When the permissions assigned in the Azure apps have privilege issues, the following error message appears: Error message: Method failed: (/_api/web/XXXXXXX) with code: 401 - Invalid username/password combo. Address this issue with the instructions available in KB1117977.

When you want the search results to display only the published versions of the documents, ensure you select Application permissions instead of the Delegated permissions while configuring the permissions explained in Microsoft SharePoint Online Spoke.

Note: Admins can limit indexing to the published versions only, ensuring that drafts or unfinished work aren’t displayed in the search results.​

Procedure

1. Navigate to Azure > Active Directory > App registrations > All applications, and select an existing app.

   Use an existing application or create an application.

2. Configured permissions

3. Navigate to App registrations > API permissions, and click Add a permission.

4. Select one of the following options:

   1. Navigate to Microsoft Graph > Delegated permissions for Graph.

   2. Navigate to Microsoft Graph > Application permissions for Graph.

   Add the Sites.ReadWrite.All permission from the Sites list. The Sites.ReadWrite.All permission helps with subscription creation.

   Add the User.Read permission from the Users list.

   These user permissions are used to crawl the Microsoft SharePoint data later.

5. Navigate to Sharepoint > Application permissions > Sites, and select Sites.FullControl.All, Sites.Read.All, or Sites.Selected for REST.

   Enable the Sites.Selected permission by performing the following steps.

   1. In the Microsoft Azure application, enable the Sites.Selected and the User.Read.All permissions.

      Use any API client to provide read access for the following site collections.

      • Application X that is connected to a ServiceNow instance and has the Sites.Selected permission.
      • Application Y that is an admin application and has the Sites.Full.Control permission for Graph connection.
        1. Get a bearer token by calling the API method https://login.microsoftonline.com/{Tenant Id}/oauth2/v2.0/token.

      Payload:

      client_id={App Y client id}
      &scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
      &client_secret={App Y client secret}
      &grant_type=client_credentials
      

   2. Pass the token received in step b as the authorization token while calling the API method https://graph.microsoft.com/v1.0/sites/{site id}/permissions.

      Payload:

      {
      "roles": [
      "read"
      ],
      "grantedToIdentities": [
      {
      "application": {
      "id": "App X client id",
      "displayName": "App X"
      }
      }
      ]
      }
      

6. Ensure you configure the required API permissions as shown in the following image:

For more information, see [Configure Microsoft SharePoint Graph connection](../integrate-applications/integration-hub/configure-microsoft-sharepoint-graph-connection.md).

1. Click Grant admin consent, select Yes, and click Save and Continue.

2. Navigate to Authentication > Web > Redirect URLs and add the URL in this format https://<your Servicenow instance URL>/oauth_redirect.do, for example, https://eesharepoint.example.com/oauth_redirect.do and click Save.

3. Navigate to Microsoft SharePoint Online Spoke and register the certificate and secret for your application.

4. Click Add user on the Microsoft admin portal, specify the user details, and click Finish.

   Note: The search crawls the sites that you can access. Ensure that you select the user with appropriate permissions for only the required content. For more information, see user permissions. Selecting a high-level user can import more documents than you want to import.

   For more information, see Granting access via Azure AD App-Only.

What to do next

Complete the integration from your ServiceNow AI Search account. For more information, see Integrate the Microsoft SharePoint search sources with the AI Search profiles.

Integrate the Microsoft SharePoint search sources with the AI Search profiles

Link search sources to a search profile to specify the content users can search through the linked search profile.

Before you begin

Role required: admin

Procedure

1. Navigate to Search Applications > Search Application Configurations (sys_search_context_config).

2. Update the following values, for Virtual Agent Default Search Application

   • Search Engine: AI Search.
   • Search Profile: ESC Portal Default Search Profile. This dynamic field value is visible after you change the Search Engine value. For more information, see Create a search application configuration for AI Search.

What to do next

Connect the ServiceNow® instance with the Microsoft SharePoint tenant. Complete the steps from your ServiceNow® account. For more information, see Connect your ServiceNow instance to a Microsoft SharePoint tenant.

Connect your ServiceNow instance to a Microsoft SharePoint tenant

Connect your ServiceNow instance with a Microsoft SharePoint tenant. Create custom ServiceNow OAuth connections for Microsoft SharePoint to authenticate ServiceNow requests.

Before you begin

• Ensure that you have working knowledge of the SharePoint developer program tools and other resources to configure the application.
• Ensure that you’re aware of the ServiceNow® integrations.

Role required: sn_sp_con.admin and admin.

Procedure

1. Navigate to ServiceNow instance > System OAuth > Application Registry.

2. Click New.

   The system displays the message What kind of OAuth application?

3. Select Connect to a third-party OAuth Provider.

4. Create the following registries:

   1. On the Graph connection form, fill in the fields.

      For a description of the field value, see Graph connection form.

   2. On the REST connection form, fill in the fields.

      For a description of the field value, see REST connection form.

   3. Right-click the form header and click Save.

5. OAuth Entity Profile

6. Navigate to the OAuth Entity Profiles [oauth_entity_profile] table to find the following entries:

   • <Graph application registry name>.default_profile
   • <REST application registry name>.default_profile Two system-generated OAuth entity profiles (REST and Graph) are created in the OAuth Entity Profiles [oauth_entity_profile] table. For more information, see Specify an OAuth profile

7. OAuth Entity Scopes

8. Insert a row with the following values in the OAuth Entity Scopes [oauth_entity_scope] table:

For more information, see [Specify an OAuth scope](../api-reference/web-services/t_SpecifyAnOAuthScope.md).

2.  Right-click the form header and click **Save**.

    **Note:** For more information on Entities, Connection & Credential Aliases, see [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](../integrate-applications/integration-hub/conf-graph-root.md).

3.  Right-click the topic header and click **Save**.

For more information, see [Define tenants](../integrate-applications/integration-hub/create-tenant.md), [Configure the SharePoint Graph Root Site Subscription connection and credential alias record](../integrate-applications/integration-hub/conf-graph-root.md), and [Create aliases for multiple tenants](../integrate-applications/integration-hub/create-aliases-sharepoint.md)

    **Note:** In the example screenshot, the user `abel.tuter` is the sys\_user who has the ais\_external\_content role assigned.

3.  Click **Submit**.

    For more information, see [Create aliases for multiple tenants](../integrate-applications/integration-hub/create-aliases-sharepoint.md).

4.  Configure the [AI Search server connection](../integrate-applications/integration-hub/setup-ais-spoke.md) before you proceed with the next steps.

The Entity View Action Mapper \(EVAM\) configuration is available by default with Employee Center Pro version 32.0.

For more information on EVAM definition, see [Create an EVAM action definition](../servicenow-platform/entity-view-action-mapper-evam/define-evam-action.md) and [Create a multi-data source list display in Entity View Action Mapper](../servicenow-platform/entity-view-action-mapper-evam/tutorial-create-evam.md).