---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management
Release :
- yokohama
ft:locale :
- en-US
ft:publication_title :
- Yokohama IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Configure Azure Monitor Bi-directional connector
# Configure Azure Monitor Bi-directional connector {#ariaid-title1}
* Release version: Yokohama
*
* Updated January 30, 2025
*
*  3 minutes to read
The Azure Monitor Pull connector sends information from ServiceNow
Event Management to the Azure Portal. The pull connector sends the alert state
changes from the ServiceNow environment to the Azure
Portal.
## Before you begin
Ensure that the Event Management Connectors (sn_em_connector) plugin is installed on the ServiceNow AI Platform instance.
When an alert is triggered in the Azure Portal a Secure Webhook is created to send
the alert notifications into ServiceNow. The [Azure Monitor Connector](https://servicenow-prod.fluidtopics.net/MM07zGpOHCtkToG9e~VJKQ "Integrate Microsoft Azure with Event Management by adding the Azure Monitor as an authenticated data source.") will
receive the alert notification as an event in the ServiceNow
instance.
The Azure Monitor Bi-directional connector is supported in the following ServiceNow AI Platform versions:
* Quebec Patch 9 or later.
* Rome Patch 3 or later.
* San Diego.
{#configure-azure-bi-directional-connector__ul_a5g_yst_1rb}
Role required: evt_mgmt_admin
## About this task
When you configure the Azure Monitor Bi-directional Connector, the bi-directional exchange of values to and from the external event source is enabled. When an alert is
Acknowledged/Closed/Reopened on the ServiceNow instance, the state changes in the Azure Portal alert using the bi-directional connector.
These scenarios describe the default bi-directional functionality for the Azure Monitor connector:
* When an alert is closed in the Azure Portal, it is automatically closed in ServiceNow. However, it is updated irrespective of the bi-directional feature because closing the event received from the Azure Portal will close the alert.
* When an alert is manually closed in ServiceNow, all the associated Azure alerts will be closed in the Azure Portal.
* If the alert state is changed to Reopen in ServiceNow, all the associated Azure alerts will be opened in the Azure Portal.
* When an alert is Acknowledged in ServiceNow, all the associated Azure alerts will be acknowledged in the Azure Portal.
{#configure-azure-bi-directional-connector__ul_amy_qwq_zqb}
Note:
For changing the alert state on the Azure Portal, Mid Server gets access token connecting to and to change the alert state on the Azure portal Mid Server calls changestate API on URL as described in [https://learn.microsoft.com/en-us/rest/api/monitor/alertsmanagement/alerts/change-state?view=rest-monitor-alertsmanagement-2023-07-12-preview\&tabs=HTTP](https://learn.microsoft.com/en-us/rest/api/monitor/alertsmanagement/alerts/change-state?view=rest-monitor-alertsmanagement-2023-07-12-preview&tabs=HTTP).
## Procedure
1. For a single tenant, perform the following steps:
* Navigate to AllEvent ManagementIntegrationsConnector Instances.
* Select Azure Monitor.
* Select the Active check box.
For this configuration, the Host IP field has no functional impact, so a dummy IP address (1.1.1.1) is provided.
* In the Credential field, add the Azure Service Principal credentials that has authorization to perform actions.
To change the alert state, the service principal must have the [Microsoft.AlertsManagement](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/monitor#microsoftalertsmanagement) permissions and the [Monitoring Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor#monitoring-contributor) role.
* Select or add the MID Server to be used for this connector.
If alerts on the MS Azure portal are not updating as expected, check the MID Server logs for errors.
{#configure-azure-bi-directional-connector__ul_bwd_xpd_52c}
2. For multiple tenants, perform the following steps:
* Navigate to AllEvent ManagementIntegrationsConnector Instances.
* Select New.
* In the Name field, enter the name of \ that you have mentioned in the URL for secure webhook at [Integrate Azure Monitor with OAuth authentication](https://servicenow-prod.fluidtopics.net/__5P7Ey3XOtJhAM8oxQU9g "Integrate Microsoft Azure with Event Management by authenticating Azure V1 or V2 tokens in the Azure Monitor.").
* In the Host IP, enter any dummy IP address such as 1.1.1.1.
* In the Credential field, add the Azure Service Principal credentials of that tenant that has authorization to perform actions.
* Select the Bi-directional check box.
* Select or add the MID Server to be used for this connector.
* Select Submit.
* Select the Active check box.
* Select Update.
{#configure-azure-bi-directional-connector__ul_jx3_cqd_52c}
{#configure-azure-bi-directional-connector__steps_irj_npd_52c}
## What to do next
Multiple alerts from the Azure Portal may be mapped to a single ServiceNow alert by de duplication. The mapping between the ServiceNow alert and Azure alerts will be maintained in the sn_em_connector_event_data table. The retention of records will depend on the alert's state:
* If the Azure Bi-directional Connector is not active, the records will be deleted in 2 days.
* When the Azure Bi-directional Connector is active:
* If the alert is in a closed state, then it will retain the data for 7 days. This duration can be customized by the sn_em_connector.eventdata_closedevent_interval system property.
* If the closed alert is re-opened in 7 days then it will reopen the corresponding closed alerts from the Azure Portal.
* If the closed alert is re-opened after 7 days then it will not reopen the corresponding closed alerts from the Azure Portal.
{#configure-azure-bi-directional-connector__ul_hc1_jfr_zqb}
* If the alert is in an open state, then it will retain the data for 30 days. This duration can be customized by the sn_em_connector.eventdata_openevent_interval.
* If you want to close or acknowledge an open ServiceNow alert in 30 days, you will be able to close or acknowledge all corresponding Azure alerts on the Azure Portal.
* If you want to close or acknowledge an open ServiceNow alert after 30 days, you will not be able to close or acknowledge all corresponding Azure alerts on the Azure Portal.
{#configure-azure-bi-directional-connector__ul_hz2_5fr_zqb}
{#configure-azure-bi-directional-connector__ul_gqn_ffr_zqb}
{#configure-azure-bi-directional-connector__ul_kj3_q2r_zqb}
*[\>]: and then