Intune's ServiceNow connector lets help desk staff see a user's ServiceNow incidents in the Troubleshooting pane of the Intune admin center, right next to that user's devices, apps and policies. Setup spans both products: an OAuth application and a CORS rule in ServiceNow, then the connector and permissions in Intune, and one missing piece is enough to stop it. In this post I'll go through the full setup, what good looks like, and the errors you're likely to meet.
Errors this guide fixes
No 'Access-Control-Allow-Origin' header is present on the requested resourceBrowser developer tools (Console)Error: Unable to make a connection to Intune via Graph API call. Please check your credential configuration.ServiceNow (Service Graph Connector import)AADSTS7000215: Invalid client secret provided.Service Graph Connector outbound HTTP log+1 more guide
Prerequisites#
- Status and licensing. Microsoft lists the integration as generally available. It's built for help desk staff licensed for Remote Help, and an active Remote Help licence or trial is required. Every admin who views incidents also needs a ServiceNow licence.
- Intune permissions. Changing the connector needs the Intune Administrator role in Microsoft Entra ID. Viewing incidents needs that role or an Intune role with Organization | Read. Without the Entra role, use the Update Connector and View Incidents permissions from the ServiceNow category in a custom Intune role.
- ServiceNow permissions. Whoever runs Test connection must be able to read incidents; Microsoft points to the
itilrole. Help desk staff need ServiceNow rights to open the full incident. - Troubleshooting preview. In the Troubleshooting pane, select Preview upcoming changes to Troubleshooting and provide feedback, review the information and select Try it now.
Step-by-step#
1. Create the OAuth application in ServiceNow#
In your instance, go to All › System OAuth › Application Registry, select New and choose OAuth API endpoint for external clients. Then fill in:
| Field | Value |
|---|---|
| Client ID | Generated by ServiceNow; copy it for Intune |
| Client Secret | Leave empty to auto-generate |
| Redirect URL | Both Intune URLs below, comma-separated |
| Logo URL | Optional public logo shown when agents sign in |
| Application / Accessible from | Global / All application scopes (the defaults) |
| Active | Selected |
| Access Token Lifespan | In seconds; Microsoft recommends 15 minutes (900) and a warning appears above that |
| Refresh Token Lifespan | In seconds, per your policy; it limits how long an agent can go before signing in again |
https://intune.microsoft.com/TokenAuthorize/ExtensionName/Microsoft_Intune_DeviceSettings,https://intune.microsoft.com/TokenAuthorize/ExtensionName/Microsoft_Intune_Workflows2. Create the CORS rule#
Go to All › System Web Services › REST › CORS Rules and create a rule: Application Global, REST API Table API, Domain https://*.portal.azure.net (Microsoft's documented example) and HTTP methods GET and POST. CORS rules can take up to 30 minutes to propagate, so wait before you test.
3. Configure the connector in Intune#
- Open Tenant administration › Connectors and tokens › ServiceNow connector. The page shows the Connection Status and the Last Connection time.
- Turn on the toggle that lets Intune exchange data with the ServiceNow instance.
- Enter the ServiceNow Instance Host (for example
https://contoso.service-now.com), the ServiceNow Incident API URL (for the standard incident table,/api/now/table/incident) and the ServiceNow Client appID from step 1. - Select Test connection, sign in to ServiceNow when prompted and choose Allow. Connection Status changes to Verified.
- Select Save.
4. Give the help desk access#
Add View Incidents to the custom Intune role your help desk already uses (see Intune RBAC and scope tags), and make sure the same people have a ServiceNow licence and incident read rights.
What help desk staff see#
In Troubleshooting + support › Troubleshoot, the agent picks a user by display name or email. On the Summary tab, Authenticate ServiceNow signs the agent in with their own ServiceNow account (they choose Allow). The incident count for that user then appears, and the ServiceNow Incidents tab lists the incidents. Agents can choose columns, add filters (for example Status = New) and follow the incident link to open the record in ServiceNow.
The data Intune exchanges is limited to caller ID, name, number, user principal name, urgency, impact, severity, assignment group, opened date, state, priority, short description and sys_id. It's a view: ticket work still happens in ServiceNow. For the remote session itself, see Remote Help setup and troubleshooting.
Verify#
- The connector shows Verified, a recent Last Connection time, and the data exchange toggle is on.
- For a test user who is the caller on at least one incident, the count appears after Authenticate ServiceNow, the tab lists the incident, and the link opens it in ServiceNow.
- An agent with only View Incidents (not Intune Administrator) can do the same.
Setup errors and fixes#
| Symptom | Likely cause | Fix |
|---|---|---|
| No Authenticate ServiceNow button or ServiceNow Incidents tab | Troubleshooting preview off, connector toggle off or not saved, missing permission, or no Remote Help licence | Work through the prerequisites list |
| ServiceNow refuses the sign-in redirect during Test connection | Redirect URL missing or mistyped in the OAuth application | Paste both Intune URLs exactly, comma-separated |
Sign-in works but incidents never load; the browser console (F12) typically shows No 'Access-Control-Allow-Origin' header is present on the requested resource | CORS rule missing, wrong domain or methods, or not propagated yet | Fix the rule and allow up to 30 minutes |
| Test connection fails for one admin only | That account can't read incidents in ServiceNow | Grant itil or an equivalent role |
| Zero incidents for a user who has tickets | Tickets logged with a different caller, a ServiceNow user record that doesn't carry the same UPN, or incidents in another table | Check the caller and user record, then the Incident API URL |
| The list loads but the incident link won't open | The agent lacks ServiceNow permissions | Grant incident access in ServiceNow |
Not the same thing: the Service Graph Connector for Microsoft Intune#
If the error comes from a ServiceNow import job rather than the Intune admin center, you're looking at a different integration. ServiceNow's Service Graph Connector for Microsoft Intune pulls Intune device and app data into the CMDB through Microsoft Graph, using its own Entra app registration. ServiceNow's knowledge base documents two failures:
Error: Unable to make a connection to Intune via Graph API call. Please check your credential configuration.This import error has more than one cause, so open System Logs › Outbound HTTP Requests. If the token request tologin.microsoftonline.comreturns 200 but the call tograph.microsoft.comreturns 401, the app lacks permissions: ServiceNow lists the application permissionsDeviceManagementManagedDevices.Read.All,DeviceManagementApps.Read.AllandUser.Read.All, with admin consent. If the token request itself fails, see the next item.AADSTS7000215: Invalid client secret provided.in the outbound HTTP log: the secret expired, or the Secret ID was copied instead of the Value. Create a new secret, paste its Value into the Application Registry record, and delete cached tokens under System OAuth › Manage Tokens; see managing expiring app secrets.
Both belong to the Service Graph Connector; neither involves the Intune connector settings above.
