ServiceNow

ServiceNow can send its instance's outbound email through a Microsoft 365 mailbox, and Footer365 signs mail that passes through your Microsoft 365. Choose how your CRM or app sends its mail explains the two ways to send, and this guide follows the first.

At a glance

• Can be signed: email from a ServiceNow outbound email account set up for Microsoft Exchange Online with SMTP OAuth2. ServiceNow says email account administrators "can use SMTP by authenticating with a client ID and client secret or with certificates."
• Cannot be signed: email from an instance with no such account. The pages read do not say what ServiceNow sends from in that case.
• How it connects: SMTP, signed in with OAuth2 and the client credential flow, using an app you register in your own Microsoft tenant. It is once for the instance, not for each person.
• Status: from ServiceNow's documentation as read on 23 October 2026, not tested by Footer365. The overview is the Brazil release page, updated 10 September 2026. The procedure is the Australia release page, updated 12 March 2026.

Before you start

• Footer365 mail flow is set up. With the Outlook add-in only, no mail ServiceNow sends is signed. Using the Outlook add-in only
• The mailbox ServiceNow sends as has a Footer365 signature rule that covers it.
• You can register an app in Microsoft Entra, grant consent for an application permission, and run Exchange Online PowerShell.

Step 1: Approve the app in Microsoft 365

This is the longest step, because you register the app yourself. ServiceNow's procedure for a client ID and secret is, in outline:

1. Register a custom application in the Microsoft app registration portal, with a name, a supported account type and the redirect address https://<instance>/oauth_redirect.do, and copy its client ID.
2. In Microsoft Entra ID, under API permissions, add the SMTP.SendAsApp application permission, then grant administrator consent for your organisation.
3. Under Certificates & secrets, create a client secret and copy its value.
4. In Exchange Online PowerShell, connect with your tenant ID and register the app with New-ServicePrincipal, using the application ID and the Object ID from the app's entry under Enterprise applications. Microsoft says not to use the IDs from App registrations.
5. Give the app access to the mailbox with Add-MailboxPermission: Add-MailboxPermission -Identity "<email_id>" -User <object_id> -AccessRights FullAccess.
6. Copy the OAuth 2.0 token endpoint (v2) for ServiceNow.

ServiceNow's page does not say which mailboxes the application can send as beyond that mailbox permission. ServiceNow also has a certificate-based version of the procedure. For approval and consent, see Approve an app's access in Microsoft 365. The Microsoft sign-in itself is described in Microsoft: authenticate an IMAP, POP or SMTP connection using OAuth. Turn on SMTP sign-in for one mailbox covers the Authenticated SMTP setting Microsoft says the mailbox needs.

Step 2: Choose the mailbox

• One mailbox for the instance, or several. The mailbox in Add-MailboxPermission is the one the application is given. Mail from ServiceNow is signed with the signature your rules give that mailbox.
• A shared mailbox: Microsoft says that for a shared mailbox the SMTP sign-in string uses the shared mailbox's address. ServiceNow's pages read do not mention shared mailboxes, so check one message.

Step 3: Connect it in ServiceNow

ServiceNow's overview links these topics, which this guide has not read:

• Register an OAuth provider with the Microsoft account configuration.
• Create an email account from Microsoft Exchange Online with SMTP OAuth2.0.

Follow ServiceNow's own pages for both: Send email with the client credential flow.

Step 4: Check one message

1. Make ServiceNow send an email, such as a notification, to an address outside your organisation that you can read.
2. Open the headers of the copy you receive.
3. Return-Path should be the mailbox's address, and X-Footer365-Relay-Id should be there.
4. Look in the mailbox's Sent Items. ServiceNow's pages do not say whether the message is saved there.

What other results mean: Mail from our CRM is not signed.

Where the signature goes

ServiceNow's pages read do not describe a signature setting for the outbound email account. If you see two signatures, remove any added in ServiceNow's notification templates. To place Footer365's signature in a template, use a marker, and check one message, because the pages read do not say what ServiceNow does with text in double braces. Place the signature with a marker

What is not signed

The pages read do not describe email that ServiceNow sends other than through the account. A message without X-Footer365-Relay-Id did not pass through your Microsoft 365.

What stops working

The client credential flow is OAuth, not Basic authentication, so Microsoft's announced change for Basic authentication does not apply to it. The pages read do not mention Exchange Web Services.

Limits

ServiceNow's pages read state no sending limit. Microsoft's limits for a mailbox apply: 10,000 recipients a day and 30 messages a minute. Microsoft: Exchange Online limits

Last resort: a connector to Exchange Online

ServiceNow's pages read describe no connector from ServiceNow into Exchange Online. If your instance runs on a server your organisation runs, with a fixed address only your organisation uses, a connector is possible under Microsoft's conditions, but ServiceNow's pages do not describe it. A ServiceNow instance hosted by ServiceNow is a service hosted by someone else, and Microsoft says SMTP relay cannot be used for one. Last resort: a connector to Exchange Online

If it does not work

1. ServiceNow cannot sign in. Check the client secret is the one you copied, the application permission has administrator consent, and the app is registered in Exchange with the right IDs.
2. ServiceNow can sign in but not send as a mailbox. Check the mailbox permission for that mailbox.
3. The message has no X-Footer365-Relay-Id. It did not pass through Microsoft 365.
4. It passed through Footer365 but is unsigned. The signature was not added
5. Still not clear. Mail from our CRM is not signed

Sources

Read on 23 October 2026:

• ServiceNow: Send email with the client credential flow, Brazil release, updated 10 September 2026.
• ServiceNow: Configure client credential flow for SMTP OAuth2 using a client id and secret, Australia release, updated 12 March 2026.