---
sourceDocument: Xanadu Employee Service Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/employee-service-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Employee Service Management

ft:clusterId :

    - emplsm

bundleId :

    - emplsm

workflow :

    - Employee


---

# Setup strict mode OAuth connectivity with Microsoft Exchange Online

# Setup strict mode OAuth connectivity with Microsoft Exchange Online {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Create a strict mode app registry for Microsoft Exchange Online with ServiceNow instance for OAuth authorization.

## Before you begin

[Configure Microsoft Azure](https://servicenow-prod.fluidtopics.net/h2LzSxMvo_9_w0WKe8rWcw "Set up a strict mode authentication with Microsoft Azure to connect Microsoft Exchange Online with Workplace Calendar Synchronization.")

[Create a strict mode configuration in Microsoft Exchange Online](https://servicenow-prod.fluidtopics.net/L~HUUovlvbz4nY~_tzTmrg "Specify your strict mode email in the Microsoft portal.")  
Ensure that the application scope is set to Microsoft Exchange Online Spoke. Otherwise, do the following:

1. Select the Application scope icon (![Application scope to set the scope of your application.]()) on the Employee Center homepage.
2. In the drop- down, select the option consisting Application scope:.
3. In the filter navigator, search and select Microsoft Exchange Online Spoke.
4. Refresh the page.
{#setup-strict-mode-oauth-connectivity-with-msex__ol_q1s_nnx_byb}

Role required: admin

## Procedure

1. Navigate to AllSystem OAuthApplication Registry.
2. Select New.
3. Select Connect to a third party OAuth Provider
4. On the form, fill in the fields with the specified details.  
   {#setup-strict-mode-oauth-connectivity-with-msex__table_rfn_dqc_btb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Unique name to identify the record as a strict mode record, for example, MsExchange strict mode. |
   | Client ID | Client ID created during the app creation in Microsoft Azure. |
   | Client Secret | The password you generated when creating the app in Microsoft Azure. |
   | Default Grant Type | Grant type used to establish the token. Select Authorization Code. |
   | Authorization URL | OAuth authorization code endpoint. Enter <kbd class="ph userinput">https://login.microsoftonline.com/&lt;tenant_id&gt;/oauth2/v2.0/authorize</kbd>. |
   | Token URL | OAuth server token endpoint. Enter <kbd class="ph userinput">https://login.microsoftonline.com/&lt;tenant_id&gt;/oauth2/v2.0/token &gt;</kbd>. |
   | Redirect URL | OAuth callback endpoint. The URL is automatically filled as <kbd class="ph userinput">https://&lt;instance-name&gt;.service-now.com/oauth_redirect.do</kbd>. |
   [Table 1. Third-party OAuth Provider form]

   {#setup-strict-mode-oauth-connectivity-with-msex__table_rfn_dqc_btb}
5. Right-click in the form header and select Save.  
   A system-generated OAuth entity profile is created and displayed in the OAuth Entity Profiles related list. For example, MsExchange Strict mode default profile.
6. Create a OAuth Entity Scope.
   1. In the OAuth Entity Scopes related list, select Insert a new row...
   2. Enter the name as <kbd class="ph userinput">Calendars.ReadWrite</kbd> for the scope.
   3. Enter the OAuth scope as <kbd class="ph userinput">Calendars.ReadWrite</kbd>.
   4. Select the Save icon.
   5. Right-click the Application Registry form header and select Save.  
      The system creates the scope record. Similarly, create the following entity scopes:
      * Name: Calendars.ReadWrite.Shared

        OAuth scope: Calendars.ReadWrite.Shared
      * Name: offline_access

        OAuth Scope: offline_access
      {#setup-strict-mode-oauth-connectivity-with-msex__ul_qnx_x3t_1yb}
   {#setup-strict-mode-oauth-connectivity-with-msex__substeps_vqg_p3t_1yb}
7. Select Update.
8. On the Application registry form, select the OAuth Entity Profiles related list.  
   In the following steps, you add the OAuth Entity Scopes that you created in Step 6 to the default profile.
   1. Select the default entity profile, for example, MsExchange Strict mode default profile.
   2. On the OAuth Entity Profile form, do the following:  
      1. In the OAuth Entity Profiles Scopes section, double-click Insert a new row.
      2. Select the Lookup icon (![Lookup icon.]()).
      3. Select <kbd class="ph userinput">Calendars.ReadWrite</kbd> that is assigned to the OAuth provider that you created in Step 6.
      4. Repeat the previous steps and also add the following OAuth Entity Profiles Scopes created in Step 6:
         * <kbd class="ph userinput">Calendars.ReadWrite.Shared</kbd>
         * <kbd class="ph userinput">offline_access</kbd>
         {#setup-strict-mode-oauth-connectivity-with-msex__ul_ytf_5nq_byb}
      {#setup-strict-mode-oauth-connectivity-with-msex__ol_gzk_2rp_byb}
9. Select Update.
{#setup-strict-mode-oauth-connectivity-with-msex__steps_ezl_rft_1yb}

## Result

The strict mode OAuth registration is added for Microsoft Exchange Online with strict mode OAuth entity profiles and OAuth entity scopes.

## What to do next

Configure the connection and credential alias. You can configure the default alias ore create your own alias.

To configure the default alias, refer to [Configure strict mode Connection and Credential alias for Microsoft Exchange Online](https://servicenow-prod.fluidtopics.net/WrTfLyUbtBUL9Q8tCmnnNQ "Establish a strict mode connection and credential alias for Microsoft Exchange Online. Ensure that the values for the connection and credentials alias are set as specified.").
**Previous topic:** [Create a strict mode configuration in Microsoft Exchange Online](https://servicenow-prod.fluidtopics.net/L~HUUovlvbz4nY~_tzTmrg "Specify your strict mode email in the Microsoft portal.")  
**Next topic:** [Configure strict mode Connection and Credential alias for Microsoft Exchange Online](https://servicenow-prod.fluidtopics.net/WrTfLyUbtBUL9Q8tCmnnNQ "Establish a strict mode connection and credential alias for Microsoft Exchange Online. Ensure that the values for the connection and credentials alias are set as specified.")

*[\>]: and then