---
sourceDocument: Xanadu ServiceNow AI Platform Administration
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/platform-administration

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# Configure Microsoft SharePoint Online for external content indexing

# Configure Microsoft SharePoint Online for external content indexing {#ariaid-title1}

* Release version: Xanadu
* 
* Updated February 5, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Register an OAuth 2.0 application in the Microsoft Entra admin center to allow the Microsoft SharePoint Online external content connector to access your Microsoft SharePoint Online source system.

## Before you begin

You need the following credentials and permissions for your organization in the Microsoft Entra admin center:

* Login credentials
* Permission to register an application
* Permission to add API permissions to an application
* Permission to grant admin consent for an application's API permissions
* Permission to upload certificates for an application
{#cfg-azure-spo-ext-cont-connector__ul_tsn_12d_tdc}

You must have created a public/private key pair for the Microsoft SharePoint Online external content connector and extracted the public key certificate in DER-encoded binary X.509 format.
For details on creating the public/private key pair and extracting the public key certificate, see [Create a public/private key pair for the Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/amhc7SvcR47IR0Jlrm4Pkg "Generate a public/private key pair for the Microsoft SharePoint Online external content connector. Extract the public key as a DER-encoded binary X.509 format certificate for use in configuring API access for the connector in the Microsoft Entra admin center.").

Role required: none

## About this task

The Microsoft SharePoint Online external content connector retrieves content from your Microsoft SharePoint Online source system using Microsoft Graph and the Microsoft SharePoint REST APIs.

To enable the connector to access your Microsoft SharePoint Online source system via these APIs, you must configure an OAuth 2.0 application
in the Microsoft Entra admin center. Your ServiceNow AI Platform instance admin can use settings copied from this Microsoft Entra application to configure the Microsoft SharePoint Online external content connector for proper connection to your Microsoft SharePoint Online source system.

## Procedure

1. Register a new application in the Microsoft Entra admin center.
   1. Log in to the Microsoft Entra admin center at <https://entra.microsoft.com/>.  
      Note:  
      If your Microsoft SharePoint Online tenant is in the Microsoft 365 GCC or GCC High cloud or the Microsoft 365 DoD cloud, log in at <https://entra.microsoft.us/> instead.
   2. Select ApplicationsApp registrations.
   3. On the App registrations page, select New registration.  
   4. On the Register an application form, fill in the following fields:  
      {#cfg-azure-spo-ext-cont-connector__table_zzr_jwc_tdc__entry__2}

      | Field | Instructions |
      |-|-|
      | Name | Enter a unique name for your OAuth 2.0 application. For example, you might enter <kbd class="ph userinput">Microsoft SharePoint Online external content connector</kbd>. |
      | Supported account types | Select Accounts in this organizational directory only (\<instance-name\> only - Single tenant), where \<instance-name\> is the name of your Microsoft Entra instance. |
      | Redirect URI (optional) | Leave this field empty. |
      [ ]

      {#cfg-azure-spo-ext-cont-connector__table_zzr_jwc_tdc}
   5. Select Register.  
      The new application's Overview page appears.
   {#cfg-azure-spo-ext-cont-connector__substeps_kg2_zvc_tdc}
2. Record the values of the Application (client) ID and Directory (tenant) ID properties in a secure location.  
   Important:  
   Your ServiceNow AI Platform admin needs the application's tenant and client IDs to configure a Microsoft SharePoint Online external content connector. {#cfg-azure-spo-ext-cont-connector__client-tenant-ids-step}
{#cfg-azure-spo-ext-cont-connector__client-tenant-ids-step}
3. Add the API permissions required by the Microsoft SharePoint Online external content connector.
   1. In the application menu, select ManageAPI permissions.  
   2. Select Add a permission, then select Microsoft Graph, then select Application permissions.  
   3. For each of the following permissions, enter the permission name into the Select permissions search field, then locate and select the option for the permission.  
      * GroupMember.Read.All
      * Sites.Read.All  
        Note:  
        The Microsoft SharePoint Online external content connector only uses the Sites.Read.All permission to perform automatic site discovery for crawl configuration and one-time crawls. If you plan to specify the sites to crawl manually, you don't need to select this permission. For more information on specifying sites for the connector to crawl, see [Configure crawl settings for the Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/4caVBea9iTU17KuK6qsd8g "Specify the sites you want your Microsoft SharePoint Online external content connector to crawl. Define inclusion or exclusion filters for file extensions to dictate the types of documents the crawl retrieves and feeds to AI Search for indexing."). To learn more about one-time crawls, see [Run a one-time full or partial document crawl for an external content connector](https://servicenow-prod.fluidtopics.net/WF27NJ6iuXMWR2w_4osxvw "Retrieve document content and metadata from all or part of your external content connector's data source on demand. A document crawl sends retrieved content and metadata to AI Search for indexing, making them available to users of your AI Search applications.").
      * User.Read.All
      {#cfg-azure-spo-ext-cont-connector__ul_m21_lyc_tdc}
   4. Select Add permissions.  
      The new Microsoft Graph permissions appear in the application's Configured permissions list.
   5. Select Add a permission, then select SharePoint, then select Application permissions.  
   6. In the Select permissions search field, enter <kbd class="ph userinput">Sites.FullControl.All</kbd>, then locate and select the option for the permission.  
      Note:  
      If your organization does not permit you to grant Sites.FullControl.All permission to a registered application, you can enter <kbd class="ph userinput">Sites.Selected</kbd> instead. When you grant this API permission, a source system administrator must grant FullControl permission for each site collection that you want the Microsoft SharePoint Online external content connector to be able to crawl. For details on granting FullControl permission for individual site collections, see [Configure site collection access for the Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/juK~4DP5LteY1WYdXtpg~A "Allow the Microsoft SharePoint Online connector to crawl your site collections by granting SharePoint API FullControl permissions to your registered Microsoft Entra OAuth 2.0 app for the connector."). {#cfg-azure-spo-ext-cont-connector__add-sharepoint-api-permissions-substep}
   {#cfg-azure-spo-ext-cont-connector__add-sharepoint-api-permissions-substep}
   7. Select Add permissions.  
      The new SharePoint permission appears in the application's Configured permissions list.

   {#cfg-azure-spo-ext-cont-connector__substeps_kfx_3xc_tdc}  
4. Grant admin consent for the added API permissions.
   1. Select Grant admin consent for \<instance-name\>, where \<instance-name\> is the name of your Microsoft Entra instance.
   2. In the Grant admin consent confirmation dialog box, select Yes.  

   {#cfg-azure-spo-ext-cont-connector__substeps_dzv_rzc_tdc}  
   The status for the added API permissions changes to Granted for \<instance-name\>, where \<instance-name\> is the name of your Microsoft Entra instance.
5. Upload your DER-encoded binary X.509 format public key certificate for the Microsoft SharePoint Online external content connector.
   1. In the Microsoft Entra application menu, select ManageCertificates \& secrets.
   2. Select Certificates, then select Upload certificate.  
   3. Select Select a file and locate your DER-encoded binary X.509 format public key certificate file, then enter a description for it.  
   4. Select Add.  
      The DER-encoded binary X.509 format public key certificate appears in the Certificates list.  
      Note:  
      You can drag the column separators in the Certificates list to view the entire thumbprint SHA1 hash value.
   5. Copy the certificate's Thumbprint SHA1 hash, shown in hexadecimal format.  
   6. Convert the certificate's SHA1 thumbprint hash from hexadecimal format to a byte array, then convert the byte array to base64 encoding and record the base64-encoded hash in a secure location.  
      As an example, if your certificate's SHA1 thumbprint hash is <kbd class="ph userinput">2778E8235B1A502728D2143AC8817DDBFBFC34AD</kbd> in hexadecimal format, its base64-encoded version is
      <kbd class="ph userinput">J3joI1saUCco0hQ6yIF92/v8NK0=</kbd>.  
      You can perform the required conversions in PowerShell (starting in version 7), replacing `2778E8235B1A502728D2143AC8817DDBFBFC34AD` with your own certificate's SHA1 thumbprint hash in hexadecimal format:

          $hexHash = "2778E8235B1A502728D2143AC8817DDBFBFC34AD"
          $binaryHash = [System.Convert]::FromHexString($hexHash)
          $base64Hash = [System.Convert]::ToBase64String($binaryHash)
          Write-Output $base64Hash

      You can also use the `xxd` and `base64` utilities in Linux or UNIX to perform the required conversions, replacing `2778E8235B1A502728D2143AC8817DDBFBFC34AD` with your own certificate's SHA1 thumbprint hash in hexadecimal format:

          echo '2778E8235B1A502728D2143AC8817DDBFBFC34AD' | xxd -r -p | base64

      Important:  
      Your ServiceNow AI Platform admin needs the DER-encoded binary X.509 format public key certificate's SHA1 thumbprint hash in base64-encoded format to configure the Microsoft SharePoint Online external content connector. {#cfg-azure-spo-ext-cont-connector__certificate-thumbprint-step}
   {#cfg-azure-spo-ext-cont-connector__certificate-thumbprint-step}
   7. Retain copies of the generated public/private key files and the key password in a safe location.  
      Note:  
      You can't download the public key certificate or its password from the Microsoft Entra admin center.
   {#cfg-azure-spo-ext-cont-connector__substeps_tnm_p1d_tdc}

## What to do next

If you granted Sites.Selected permission instead of Sites.FullControl.All permission in step [3.f](https://servicenow-prod.fluidtopics.net/x~0n8FHG_7JPPqqwqwe3eg#cfg-azure-spo-ext-cont-connector__add-sharepoint-api-permissions-substep), configure SharePoint API permissions for the site collections you want the Microsoft SharePoint Online connector to be able to crawl. For details on this procedure, see [Configure site collection access for the Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/juK~4DP5LteY1WYdXtpg~A "Allow the Microsoft SharePoint Online connector to crawl your site collections by granting SharePoint API FullControl permissions to your registered Microsoft Entra OAuth 2.0 app for the connector.").  
Provide the following items to your ServiceNow AI Platform admin:

* The OAuth 2.0 application's tenant ID and client ID that you recorded in step [2](https://servicenow-prod.fluidtopics.net/x~0n8FHG_7JPPqqwqwe3eg#cfg-azure-spo-ext-cont-connector__client-tenant-ids-step).
* The DER-encoded binary X.509 format public key certificate's SHA1 thumbprint hash that you recorded in step [5.f](https://servicenow-prod.fluidtopics.net/x~0n8FHG_7JPPqqwqwe3eg#cfg-azure-spo-ext-cont-connector__certificate-thumbprint-step).
{#cfg-azure-spo-ext-cont-connector__ul_rl2_xjd_tdc}

Your ServiceNow AI Platform admin needs these items to configure a Microsoft SharePoint Online external content connector to retrieve searchable content and security principals from your Microsoft SharePoint Online instance.

For details on creating and configuring a Microsoft SharePoint Online external content connector, see [Create a Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/KTdMG~m5xA8IXbxg62jmLA "Create an external content connector to retrieve searchable content and security principals from your Microsoft SharePoint Online source system.").
* **[Create a public/private key pair for the Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/amhc7SvcR47IR0Jlrm4Pkg)**   
  Generate a public/private key pair for the Microsoft SharePoint Online external content connector. Extract the public key as a DER-encoded binary X.509 format certificate for use in configuring API access for the connector in the Microsoft Entra admin center.
* **[Configure site collection access for the Microsoft SharePoint Online external content connector](https://servicenow-prod.fluidtopics.net/juK~4DP5LteY1WYdXtpg~A)**   
  Allow the Microsoft SharePoint Online connector to crawl your site collections by granting SharePoint API FullControl permissions to your registered Microsoft Entra OAuth 2.0 app for the connector.

*[\>]: and then