Deploy the ServiceNow Tickets Copilot connector

The ServiceNow Tickets Microsoft 365 Copilot connector allows organizations to index ticket records from ServiceNow and makes them searchable across Microsoft 365 experiences, including Microsoft 365 Copilot and Microsoft Search. This article describes the steps to deploy and customize the ServiceNow Tickets connector.

For advanced ServiceNow configuration information, see Set up the ServiceNow service for connector ingestion.

Prerequisites

Before you deploy the ServiceNow Tickets connector, make sure that the ServiceNow environment is configured in your organization. The following table summarizes the steps to configure the ServiceNow environment and deploy the connector.

Before you deploy the connector, make sure that you meet the following prerequisites:

• You're a Microsoft 365 admin.
• You have access to your organization’s ServiceNow instance URL.
• You created a ServiceNow service account with read access to required tables.
• The network firewall allows access to Microsoft connector IP ranges.
• You provisioned OAuth or OpenID Connect credentials, if applicable.

Deploy the connector

To add the ServiceNow Tickets connector for your organization:

1. In the Microsoft 365 admin center, in the left pane, choose Copilot > Connectors.
2. Go to the Connectors tab, and in the left pane, choose Gallery.
3. From the list of available connectors, choose ServiceNow Tickets.

Set display name

The display name is used to identify references in Copilot responses to help users recognize the associated file or item. The display name also signifies trusted content and is used as a content source filter.

You can accept the default ServiceNow display name, or customize the value to use a display name that users in your organization recognize.

For more information about connector display names and descriptions, see Enhance Copilot discovery of connector content.

Set instance URL

To connect to your ServiceNow data, you need your organization's ServiceNow instance URL, which is typically the following format:

https://<your-organization-name>.service-now.com

You can find your instance name in the ServiceNow admin dashboard or by checking the sign in URL used by your organization.

Choose authentication type

To authenticate and sync content from ServiceNow, choose one of the following supported methods:

• Basic authentication: Use a ServiceNow account with read access to required tables and to the task and sys_user tables to authenticate your instance.
• ServiceNow OAuth (recommended): Configure an OAuth endpoint in ServiceNow and provide client ID and secret. For details, see OAuth 2.0.
• Microsoft Entra ID OpenID Connect: Register an application in Microsoft Entra ID and configure an OAuth OIDC provider in ServiceNow. For details, see Microsoft Entra ID OpenID Connect.

OAuth 2.0

Provision an OAUTH endpoint in your ServiceNow instance for the ServiceNow Tickets connector to access. For more information, see Create an endpoint for clients to access the instance.

Use the information in the following table to complete the endpoint creation form.

Enter the client ID and client secret to connect to your instance. After you connect, use a ServiceNow account credential to authenticate permission to crawl. The account should at least have read access to the task and sys_user tables. For information about read access to the required table records, see Assign read permissions.

Microsoft Entra ID OpenID Connect

To use Microsoft Entra ID OpenID Connect:

1. Register a new app as a single tenant in Microsoft Entra ID. A redirect URI isn't required. For more information, see Register an application.
2. Copy the Application (client) ID and Directory (tenant) ID for the app.
3. Create a client secret for the app and save it securely.
   • Go to Manage > Certificates and secrets.
   • Choose + new client secret.
   • Provide a name and choose Save.
4. Use the following PowerShell cmdlets to retrieve the service principal object ID.

    Install-Module -Name Az -AllowClobber -Scope CurrentUser

    Connect-AzAccount

    Get-AzADServicePrincipal -ApplicationId "Application-ID"

Replace "Application-ID" with the Application (client) ID of the application you registered in step 2. Note the value of the ID object from the PowerShell output; this value is the Service Principal Object ID.
Alternatively, you can retrieve the information from the Microsoft Entra admin center:
a. On the app registration, go to Overview.
b. Choose managed application in local directory.
c. Choose the URL and copy the ObjectID. This is the Service Principal Object ID.

5. In your ServiceNow instance, register a new OAuth OIDC entity. For details, see Create an OAuth OIDC provider. Use the values listed in the following table in the registration form; leave other fields as default.

6. In the OAuth OIDC Provider Configuration field, select the search icon, and then select New.

7. Fill out OIDC provider configuration form as follows:

8. Choose Submit to save the configuration.

9. Create a ServiceNow account. For details, see Create a user in ServiceNow. Use the following values; leave other fields as default:

10. Assign the itil role read access to the task and sys_user tables to the ServiceNow account. For details, see Assign a role to a user. Use the Application ID as the Client ID and Client secret in the admin center configuration wizard to authenticate with Microsoft Entra ID OpenID Connect.

After you enter the authentication details, select Authorize.

Customize settings

Before you publish the connection, set up the Content and Users settings for the connector. You can also choose to configure the Sync details (optional) for the connector.

The following table lists the default values that are set.

Customize user settings

Access permissions

On the Users tab, the ServiceNow Tickets connector supports search permissions visible to Only people with access to this data source. Don't select Everyone - this option isn't supported.

• Under Access permissions, select Only people with access to this data source.

• Provide at least one rule for all the tables selected for indexing. For each table in the side panel, select the down arrow to expand, and then select Add rule.

• For each table, allow read permissions for users by selecting the allowed user fields from the dropdown list. Indexed ticket items are visible only to users who have access to them via any of the user fields that you can select, such as Assigned to, Opened by, or Closed by.

• You can also provide access to the tables based on roles. Make sure that you provide the exact name of the table as it is in ServiceNow. The following are examples of role names:

  • itil
  • asset
  • admin or security_admin
  • snc_internal
  • Table-specific roles such as sn_request_write, sn_request_approver_read, sn_request_read.
  • Any other custom roles like incident_read, change_manager, hr_admin.

  Note

  itil is the most common role for IT agents, technicians, and fulfillers. It provides Fulfiller/Agent Access (Read, Write, Create) to core IT Service Management (ITSM) tables like Incident (incident), Problem (problem), Change (change_request).

• Users in either the added roles or the user fields get access to the table records.

• Choose Save for each table.

Mapping identities

Choose whether your ServiceNow instance has Microsoft Entra ID provisioned users or non-Microsoft Entra ID users:

1. Choose the default mapping option Microsoft Entra ID if the email ID of ServiceNow users is the same as the user principal name (UPN), or email of the users in Microsoft Entra ID.
2. Choose the Non-Microsoft Entra ID option if the email ID of ServiceNow users is different from the UPN of users in Microsoft Entra ID. You can provide a custom mapping formula. For more information, see Map your non-Azure AD Identities.

Customize content settings

You can:

• Modify the query string to filter tickets to index.
• Select more tables beyond the default incident table.
• Define schema attributes for each nondefault or custom property (searchable, queryable, retrievable, refinable).
• Customize the URL format for ticket links using expressions and rules based on entity type or the tables selected for indexing.

Query string

ServiceNow uses the following default filter: sys_created_on>javascript:gs.beginningOfLast6Months().

You can modify this filter to index only specific ticket items based on your organization's needs. Use the ServiceNow encoded query string builder to create custom filters. For more information, see Generate an encoded query string through a filter.

Manage indexed properties

The indexed properties affect how users can search, filter, and view catalog ticket items in Microsoft 365 Copilot.

You can add or remove available tables from your ServiceNow data source. Microsoft 365 selects the incident table by default. You can choose to select more tables from the dropdown.

The following table lists the properties that the ServiceNow Tickets connector indexes by default.

Set a default expression for AccessURL

To define a custom expression for the AccessURL property:

1. On the Content tab, go to Manage properties.
2. In the Properties table, select the AccessURL property.
3. In the side panel, under Default expression, enter your custom expression in the New default expression field. Use ${PropertyName} syntax for dynamic values. For example: https://instancedomain.service-now.com/esc?id=ticket&table=${EntityType}&sys_id=${SysId}&view=sp.
4. Select Save changes.
5. To preview the result, select Preview data and scroll to the customized property.

Add rules for conditional expressions

You can override the default expression for specific ticket items using rules based on property filters. To add a rule:

1. Under Set additional rules to configure expressions, select Add new rule.

2. In the rule panel:

   1. Choose a filter property (for example, Entity Type).
   2. Enter one or more values (comma-separated, case-sensitive).
   3. Define the custom expression for those values.

3. Select Save changes.

4. To preview, select Preview data and scroll to the customized property.

For more information, see Customize values for certain schema properties.

Customize sync intervals

You can change the default values for crawl frequency:

• Full crawl – Reindexes all content, removes deleted content, and updates all permissions. The default frequency is daily.
• Incremental crawl – Syncs only changed content, not permissions updates. The default frequency is every 15 minutes.

Note the following points:

• Identities (users and groups) or access permissions are only updated with full crawls. Incremental crawls don't update access permissions or group memberships.
• During the first full crawl, identity sync (reading users and permissions) runs first, followed by content sync, so the right permissions are mapped to the ingested items.
• During subsequent periodic full crawls, content and identity sync happens in parallel. The full crawl is complete when both content and identity sync are completed.
• The periodic full crawls are faster than the first full crawl because the first crawl includes first-time discovery and ingestion of users, permissions, and content items. Periodic full crawls only ingest the newly discovered items, users, and user criteria.

For more information about full and incremental crawls, see Guidelines for sync settings.

Roll out

To roll out to a limited audience, choose the toggle next to Rollout to limited audience and specify the users and groups to roll the connector out to. For more information, see Staged rollout for Copilot connectors.

Choose Create to deploy the connection. The ServiceNow Tickets Copilot connector starts indexing content right away.

After you create your connection, you can review the status (including count of indexed users and items) by selecting the connector in the Connectors section of the Microsoft 365 admin center.

When the connection status is ready, you can validate the indexed ticket item using the index browser by providing the sys_id of any ticket item and checking its permissions for users. For more information, see Search and validate indexed content.

Related content

• ServiceNow Tickets connector overview
• Set up the ServiceNow service for connector ingestion
• Troubleshoot issues with the ServiceNow Tickets connector