---
sourceDocument: Australia ServiceNow AI Platform Administration
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/platform-administration

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# SMTP OAuth2 to use certificates

# Configure client credential flow for SMTP OAuth2 using certificate-based authentication {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Configure an OAuth application profile to authenticate using certificates for outbound email.

## Before you begin

Create an [Microsoft Azure](https://portal.azure.com) account to configure an OAuth profile.

Complete the setup steps using your Microsoft Azure Developer account. See [Microsoft Azure product documentation](https://docs.microsoft.com/en-us/azure/) for instructions on creating and configuring custom applications.

Role required: Microsoft Azure portal administrator and admin

## Procedure

1. Log in to the Microsoft Azure registration profile with your organization credentials.  
   For more information, see the Microsoft Azure [registration portal documentation](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade).
2. Register a new custom application by filling in the application name, supported account type, and redirect URL, and then select Register.  
   Note:  
   Enter the redirect URL in the following format: <kbd class="ph userinput">https://&lt;instance&gt;/oauth_redirect.do</kbd>.  
   An overview of the application's basic information is displayed.
3. Copy the client ID to a text file.  
   You'll use this client ID and the secret value generated in the next steps to register the app as a third-party OAuth provider on your ServiceNow instance. You use the application ID as the client ID when you connect the application to ServiceNow.
4. Enable the SMTP.SendAsApp permission.
   1. In Microsoft Azure, navigate to ManageAPI permissions.
   2. Select Add a permission.
   3. Select the Microsoft Office 365 tile.
   4. Select Application Permissions.
   5. In the Select permissions field, enter <kbd class="ph userinput">SMTP.SendAsApp</kbd>.
   6. Select the SMTP.SendAsApp check box.
   7. Select Add permissions.
   {#config-credential-flow-certificate__substeps_ddd_zft_whb}
5. Select Grant admin consent for \<organization name\>, then select Yes to confirm.
6. Upload the certificate.
   1. In Microsoft Azure, navigate to ManageCertificates \& secrets.
   2. Select upload certificate.
   3. Provide a description, a start date, and an expiration date, then upload the certificate.
   {#config-credential-flow-certificate__substeps_dzd_nct_whb}
7. Copy the client ID and directory ID to a text file.
8. Register service principals in Microsoft Exchange using PowerShell.
   1. Run the following commands.  

          Install-Module -Name ExchangeOnlineManagement -allowprerelease
          Import-module ExchangeOnlineManagement
          Connect-ExchangeOnline -Organization <tenantId>

      For more information, see [Authenticate SMTP connection using OAuth](https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth)
   2. Register an Microsoft Entra ID application's service principal by running the following command.  

          New-ServicePrincipal -AppId <APPLICATION_ID> -ObjectId <OBJECT_ID>

      Important:  
      For the OBJECT_ID value, go to OverviewManaged applications in local directory and copy the Object ID.
   3. Add permission to user email ID using the following command.  

          Add-MailboxPermission -Identity "<email_id>" -User <object_id> -AccessRights FullAccess 

   {#config-credential-flow-certificate__substeps_k1j_bvd_nzb}
9. Navigate to OverviewEndpoints and copy the OAuth 2.0 token endpoint (v2) to a text file.  
   You use the OAuth 2.0 token endpoint (v2) when configuring a JWT provider. For more information, see [Configure a JWT provider](https://servicenow-prod.fluidtopics.net/WC~jpv9xTm92c42~JHc5tQ "Configure a JWT provider on the ServiceNow AI Platform to configure an OAuth application profile to authenticate using certificates.").
{#config-credential-flow-certificate__steps_ttw_fhl_lzb}

## What to do next

[Configure a JWT provider](https://servicenow-prod.fluidtopics.net/WC~jpv9xTm92c42~JHc5tQ "Configure a JWT provider on the ServiceNow AI Platform to configure an OAuth application profile to authenticate using certificates.")
* **[Configure a JWT provider](https://servicenow-prod.fluidtopics.net/WC~jpv9xTm92c42~JHc5tQ)**   
  Configure a JWT provider on the ServiceNow AI Platform to configure an OAuth application profile to authenticate using certificates.
* **[Generate a SHA-1 thumbprint](https://servicenow-prod.fluidtopics.net/sJVatzzZCmsOTdI0iKvyoQ)**   
  Generate an SHA-1 thumbprint using the JWT provider's sys_id, the Java Key Store (JKS) certificate's sys_id, and the JKS certificate's alias to the GraphCertificateOAuthTemplate script.
* **[Create an OAuth API script](https://servicenow-prod.fluidtopics.net/x80YlPeBXO1IbZbnZShS6w)**   
  Create and duplicate an OAuth API script for application registry.

*[\>]: and then