Documentation

Complete guide to Email to ServiceNow - the Outlook add-in for creating ServiceNow records directly from your email.

Overview

Email to ServiceNow is a Microsoft Outlook add-in that streamlines your workflow by letting you create a ServiceNow record directly from the email you are reading. Turn inbound emails into incidents (or any table you configure) without leaving your inbox, and keep the full email context attached for reference.

📝 What This Add-in Does

From the Outlook reading pane, one click creates a ServiceNow record from the open email. The subject pre-fills the Short description, the body pre-fills the Description, and the record is filed under the ServiceNow account you sign in with. Before creating, you can set urgency, impact, category, assignment group, and assignee. The original email is attached to the record as an .eml file, along with the email's own file attachments. Record data goes directly from your browser to your ServiceNow instance — it does not pass through Innova-Apps servers.

Features

⚡ One-Click Record Creation

Create a ServiceNow record from the open email without leaving Outlook.

✍️ Smart Prefill

Email subject fills Short description; the email body fills Description. Edit anything before you create.

✨ AI Title & Summary (Optional)

Optionally draft a concise title from the subject and a short summary with action items from the body. Off with one toggle; you review and edit before creating.

👤 Your Identity

The record's caller is your signed-in ServiceNow user — the same identity ServiceNow records as opened by.

🎛️ Set Fields First

Choose urgency, impact, category, assignment group, and assignee before the record is created.

📧 Email Preservation

The original email is attached to the record as an .eml file with full headers and formatting.

📎 Attachment Upload

The email's own file attachments are uploaded to the record alongside the .eml.

🎯 Flexible Target Table

Defaults to incident, but an admin can point it at any table you can write to — a Customer Service case or a custom u_ table.

🔐 Sign In With ServiceNow

OAuth 2.0 with PKCE against your own instance, so your company's SSO and MFA apply. No Innova-Apps account.

🕘 Recent Records

A local list of up to 25 recently created records (number + short description) for quick reference.

✨ AI Title & Summary (optional)

You can optionally let AI improve the two text fields before you create a record. When it is on, the add-in turns the email subject into a concise, meaningful title for the Short description, and the email body into a short plain-text summary followed by an action items bullet list for the Description.

Optional — a single toggle. AI is optional; a single toggle turns it off, and with it off the add-in simply uses the raw email subject and body.
You stay in control. The AI-generated title and description appear as editable fields — you always review and can edit them before the record is created.
Report content. If the AI output is inappropriate or inaccurate, you can report it from within the add-in.

🤖 How the AI works & data note

When AI is on, the email subject and body are sent to Google's Gemini models (gemini-2.5-flash-lite) via Firebase AI Logic (Vertex AI in Firebase) for summarization and — per the Firebase AI Logic / Vertex AI terms — are not used to train Google's models. The call is made from the task pane (there is no separate Innova-Apps backend for AI) and is protected by Firebase App Check. With AI off, nothing is sent to Google for summarization. The created record, the .eml, and file attachments still go directly from your browser to your own ServiceNow instance.

Requirements

Component	Requirement
Microsoft 365 mailbox	Work or school account (Business, Enterprise, or Education)
Outlook	Outlook on the web, new Outlook for Windows, or classic Outlook for Windows and Mac
ServiceNow instance	A ServiceNow instance with the one-time admin setup completed (an OAuth Application Registry entry and two CORS rules — see Setup below)
ServiceNow account	An account with write access on the target table (e.g. `itil` for `incident`) and permission to create attachments (`sys_attachment`)
Browser (web)	Latest versions of Edge, Chrome, Firefox, or Safari

💚 No Extra Account

There is no separate Innova-Apps sign-up. Your organization is identified by the Microsoft 365 account you already use in Outlook, and records are filed under your existing ServiceNow account. The subscription is US$999 per year for the whole organization, after a 14-day free trial.

Setup & Installation

ℹ️ Two Parts

Setup has two parts: a one-time ServiceNow instance setup performed by a ServiceNow administrator (Part 1), and installing the Outlook add-in for the people who will use it (Part 2). Part 1 only needs to be done once per instance.

Part 1: ServiceNow Admin Setup (one-time)

A ServiceNow administrator performs these steps once. The recommended authentication is OAuth 2.0; the CORS rules are required for either authentication mode.

Create an OAuth endpoint

In ServiceNow, go to System OAuth → Application Registry → New → "Create an OAuth API endpoint for external clients".

Set Redirect URL to https://email-to-servicenow.web.app/auth/servicenow-callback.html
If available (Madrid and later), check Public client / PKCE required — then no client secret is needed and users only need the Client ID.
Otherwise ServiceNow generates a Client Secret; give users both the Client ID and the Client Secret.
Defaults are fine: access token 30 minutes, refresh token 100 days. If you'd rather users never had to reconnect, raise Refresh Token Lifespan (seconds, default 8640000) on the same record — see Troubleshooting for the security trade-off.

Add two CORS rules

Go to System Web Services → REST → CORS Rules → New. A CORS rule is scoped to a single API, so create two rules — one for the Table API (now/table) and one for the Attachment API (now/attachment). For each rule:

Domain: https://email-to-servicenow.web.app
HTTP methods: GET, POST
Access-Control-Allow-Headers: Authorization, Content-Type, X-Requested-With
Max age: 3600

Confirm roles

The user (or, for Basic auth, the dedicated integration user) needs:

Write on the target table (e.g. itil for incident) plus create on sys_attachment
Read on sys_user, sys_user_group, and sys_choice

If sys_choice is blocked, the add-in falls back to built-in choices and still works.

🔑 Authentication Options

OAuth 2.0 with PKCE (recommended) authenticates against your own ServiceNow instance, so your company's SSO and MFA apply. As a fallback, Basic auth can be used with a dedicated "Web service access only" integration user (the add-in's Username & password option); that user needs a password set locally on the instance and cannot be used for the interactive OAuth sign-in. Either way, the CORS rules above are required. If your instance uses SSO, see Using SSO with Microsoft Entra ID just below — nothing changes in Part 1, and nothing is configured in your identity provider for ServiceNow sign-in.

Using SSO with Microsoft Entra ID (or another identity provider)

If your ServiceNow instance signs users in through Multi-Provider SSO — Microsoft Entra ID, Okta, or any SAML 2.0 / OIDC provider — Part 1 is unchanged and nothing is configured in your identity provider for ServiceNow sign-in. The OAuth Application Registry record has no identity-provider field, and the add-in never contacts Microsoft Entra to sign anyone in to ServiceNow. Two independent trust relationships are chained, and the add-in takes part in only the first:

A — Add-in ↔ ServiceNow: the Application Registry record and the two CORS rules from Part 1. This is everything the add-in needs.
B — ServiceNow ↔ your identity provider: the Identity Provider record on your instance and the matching ServiceNow enterprise application in Entra ID. This is whatever you already run for browser sign-in, and it is not changed for the add-in.

What happens when a user clicks Connect:

The add-in opens your instance's OAuth authorization page in a sign-in window — an Office dialog in classic Outlook for Windows and Outlook for Mac, a popup window in Outlook on the web and new Outlook for Windows.
The instance finds no session in that window and runs its normal login. With Multi-Provider SSO it redirects the window to your identity provider — immediately if that provider is the Auto Redirect IdP, otherwise after the user clicks Use external login. This is the hand-off to Entra ID.
Entra ID signs the user in (MFA and Conditional Access run here) and returns to the instance.
ServiceNow matches the user to a sys_user, creates the session, shows its own Allow / Deny page, and sends an authorization code back to the add-in.
The add-in exchanges the code for tokens issued by your instance, through the stateless token broker, and stores them. API calls then go directly to the instance, and token refreshes go through the same broker to the instance. The identity provider is not involved again until the refresh token expires and the user clicks Connect again.

📌 Worth knowing for SSO instances

Separate session in desktop Outlook. In classic Outlook for Windows and Outlook for Mac the sign-in window has its own browser session, so an existing sign-in in Edge or Chrome does not carry over. Without Auto Redirect IdP, users may see ServiceNow's local login page even if their browser normally takes them straight to Microsoft sign-in; they click Use external login. Outlook on the web opens a real browser popup and reuses the browser's sessions. New Outlook for Windows also uses a popup, but it is opened by the Outlook app rather than your web browser, so treat it like classic Outlook for this point and the next ones, and include it in your testing.
The consent page still appears. SSO does not remove ServiceNow's Allow / Deny step.
Conditional Access. MFA policies work. Microsoft does not document whether Office add-in sign-in windows can prove device state, so policies that require a compliant, hybrid-joined, or managed device may fail in classic Outlook for Windows, Outlook for Mac, and possibly new Outlook for Windows. The add-in cannot see the resulting Microsoft error; once the window is closed it only reports "The sign-in window was closed." Outlook on the web inherits the browser's device identity and usually passes. Test with a pilot user before a wide rollout.
Custom domains. OAuth is only offered for the standard https://<instance>.service-now.com URL. ServiceNow keeps that URL working alongside a custom one, so users enter the standard URL. That works if single sign-on already works when the standard URL is opened in a browser; if your SSO is set up only for the custom domain, use the Basic auth fallback.
User matching. If the identity provider's claim matches no sys_user on the Identity Provider record's User Field, sign-in fails before any code is issued — an SSO configuration matter on the instance, not an add-in setting.
Revocation. Disabling a user in Entra ID does not by itself invalidate a ServiceNow token already issued. Revoke under System OAuth → Manage Tokens or deactivate the user on the instance.
A Microsoft sign-in before Connect is not ServiceNow SSO. When the pane first opens, the add-in signs the user in to Microsoft, usually silently. That is its own subscription and organization-defaults check, using the add-in's own Microsoft Entra application ("Email to ServiceNow", published by Innova Apps). In tenants that don't let users consent to applications, an Entra admin may be asked to approve that application's basic sign-in and profile permissions; that approval is unrelated to your ServiceNow enterprise application and to your SSO. None of this signs anyone in to the instance: the Microsoft sign-in that does is the one inside the sign-in window, after Connect.

Part 2: Install the Outlook Add-in

Self-install (individual users)

Get the add-in from the Microsoft Marketplace, or in Outlook — new Outlook for Windows, classic Outlook for Windows, Outlook for Mac, or Outlook on the web — open Get Add-ins / More apps and search for Email to ServiceNow. Step-by-step screenshots are in the Quick Start Guide.

Centralized deployment (admins)

To roll the add-in out to a group or the whole organization, a Microsoft 365 administrator can deploy it from the Microsoft 365 Admin Center → Settings → Integrated apps → Upload custom apps, using the same manifest.

📌 Deployment Note

Centralized deployments can take up to a few hours to appear in users' Outlook. Users may need to restart Outlook or clear their browser cache before the add-in shows up.

Usage Guide

First-Time Setup: Connect to ServiceNow

Open any email in Outlook
Click the "Apps" button in the Outlook toolbar, then select "Email to ServiceNow"
Enter your ServiceNow instance URL and the Client ID your admin provided (plus the Client Secret, if your instance requires one)
Click "Connect" — a sign-in window opens on your own ServiceNow instance (a small Outlook window in classic Outlook for Windows and Outlook for Mac, a popup in Outlook on the web and new Outlook)
Sign in with your ServiceNow account. If your instance uses SSO, ServiceNow sends the window to your identity provider and MFA applies; if ServiceNow's own login page stays on screen, click Use external login. Then approve access on ServiceNow's Allow page

If someone in your organization has already saved these values as your organization's default, step 3 is done for you — the add-in opens already configured and you only click Connect. See the FAQ below.

🔐 Authentication

The add-in uses OAuth 2.0 with PKCE against your own ServiceNow instance (Basic auth with an integration user is available as a fallback). Connection settings and tokens are kept in the task pane's browser localStorage on the add-in origin — nothing is stored on Innova-Apps servers. You can disconnect at any time from the add-in settings. If the add-in asked you to sign in to Microsoft when it first opened, that was its subscription check for your Microsoft 365 organization — a separate step that does not sign you in to ServiceNow.

Creating a Record

Open the email you want to turn into a ServiceNow record
Open the add-in panel
Review the Short description (auto-filled from the email subject) and Description (auto-filled from the email body)
Review the prefilled title and description — the record is filed under your signed-in ServiceNow account
Set Urgency, Impact, Category, Assignment group, and Assignee as desired
Click "Create record"

✅ Success!

After creation, you'll see a confirmation with the record number and a direct link to open it in ServiceNow. The original email is attached as an .eml file, the email's attachments are uploaded to the record, and the new record is added to your local list of recent records.

Permissions

The add-in works with two sets of permissions: the ServiceNow roles your account needs, and the Outlook mailbox access the add-in requests.

ServiceNow roles

Access	Why It's Needed
Write on the target table (e.g. `itil` for `incident`)	To create the record from the email
Create on `sys_attachment`	To attach the `.eml` file and the email's file attachments
Read on `sys_user`	To resolve your own user record, filed as the record's caller
Read on `sys_user_group`	To list assignment groups for selection
Read on `sys_choice`	To load field choices such as urgency, impact, and category (falls back to built-in choices if blocked)

Outlook mailbox permissions

Permission	Why It's Needed
Read the current mail item	To read the subject, body, and attachments of the email you are currently viewing
Shared mailbox	To let you create records from emails in a shared mailbox you have access to

✅ Privacy Assurance

The add-in only accesses the email you're currently viewing — it does not scan your inbox or read other messages. Record data (subject, body, .eml, and attachments) goes directly from your browser to your ServiceNow instance and does not pass through Innova-Apps servers. There is no analytics or telemetry of email content.

Troubleshooting

🔴 CORS error when connecting or creating

The instance is missing the required CORS rules. Ask your ServiceNow admin to add the two CORS rules (Table API and Attachment API) for the exact domain https://email-to-servicenow.web.app, as described in Part 1 above.

🔴 401 Unauthorized after working for a while

The refresh token has expired (refresh tokens last 100 days by default). Open the add-in and click Reconnect to sign in again.

If that 100-day reconnect is a nuisance, a ServiceNow admin can raise it: the OAuth Application Registry record has a Refresh Token Lifespan field in seconds, defaulting to 8640000 (100 days). Setting it higher — 31536000 for a year, say — means users effectively never reconnect. The trade-off: a longer-lived refresh token is a longer-lived credential in the user's browser storage, so weigh it against your own security policy. Tokens can be revoked at any time from System OAuth → Manage Tokens, and the new lifespan applies to tokens issued after the change.

🔴 403 Forbidden when creating a record

Your account is missing a role on the target table (e.g. itil for incident), or create on sys_attachment.
Ask your ServiceNow admin to grant the required roles for the target table.

🔴 429 Too Many Requests

Your ServiceNow instance is rate-limiting requests. The add-in retries once automatically; if it still fails, wait a moment and try again.

🔴 Attachments fail but the record was created

An attachment likely exceeded the instance's attachment size limit (com.glide.attachment.max_size). Ask your admin to review that limit.
Note the empty-value gotcha: a size limit set to an empty value behaves as roughly 1 KB, which will reject almost every attachment.
The record itself is still created even if an attachment upload fails.

🔴 "OAuth requires a standard *.service-now.com instance. For a custom domain, use username & password."

The instance URL you entered is a custom domain. OAuth mode only works with the standard https://<instance>.service-now.com URL, which ServiceNow keeps working alongside a custom URL — ask your ServiceNow admin for it. If single sign-on does not work when that standard URL is opened in a browser, use the Basic auth fallback: the add-in's Username & password option with a "Web service access only" integration user.

🔴 SSO sign-in problems in the sign-in window

ServiceNow's own login page appears instead of Microsoft sign-in: in desktop Outlook the sign-in window is a fresh browser session. Click Use external login, or ask your ServiceNow admin to mark your identity provider as the Auto Redirect IdP.
Microsoft reports a device-state or compliance error (for example AADSTS53000, AADSTS53001 or AADSTS530003): a Conditional Access policy requires a compliant, hybrid-joined, or managed device, which the sign-in window in desktop Outlook may not be able to prove. Once the window is closed, the add-in only reports "The sign-in window was closed." Connect from Outlook on the web in a browser signed in to your work account, or tell your Microsoft 365 admin which error you saw.
Microsoft sign-in succeeds but ServiceNow says the user was not found: the Identity Provider record's User Field does not match the user's record. Your ServiceNow admin fixes this on the instance; the add-in has no setting for it.
A Microsoft sign-in prompt, or a request for administrator approval, appeared before you clicked Connect: that is the add-in's subscription check for your Microsoft 365 organization, not ServiceNow SSO. See Using SSO.

🔴 Add-in not appearing in Outlook

If it was centrally deployed, allow a few hours for it to appear
Restart Outlook completely
Clear your browser cache (for Outlook on the web)
Confirm you are signed in with a Microsoft 365 work or school account (not a personal account)

Best Practices

✨ For Best Results

Review Before Creating: Check the auto-filled Short description and Description, and edit if needed
Review before creating: The title and description are editable right up until you press Create
Set Urgency & Impact: Populate these up front so the record is triaged correctly
Assign Immediately: Pick the right assignment group and assignee to cut down on later routing
Keep the Context: The .eml attachment is your audit trail — leave it on the record

🎯 Recommended Workflows

Incidents from email: Turn a reported problem into an incident with the full email attached
Customer Service cases: Point the add-in at sn_customerservice_case to open cases from customer emails
Custom intake: Route emails into a custom u_ table your team already uses
Request handling: Capture stakeholder emails as tracked records without retyping details

Frequently Asked Questions

How much does Email to ServiceNow cost?

US$999 per year for your entire Microsoft 365 organization, with no per-user fees, after a 14-day free trial that needs no credit card. One person subscribes and every colleague in the organization is covered automatically.

Do I need an Innova-Apps account?

No. There is no separate sign-up. Your identity is your existing ServiceNow account, which you sign in to on your own instance.

What does my ServiceNow admin need to set up?

A one-time instance setup: an OAuth Application Registry entry and two CORS rules (one for the Table API, one for the Attachment API). Full steps are in the Setup section above and in the Quick Start Guide.

My instance uses SSO with Microsoft Entra ID. Is there anything to set up in Entra for ServiceNow sign-in?

No. The ServiceNow admin setup is identical, and nothing is added to Entra for ServiceNow sign-in. The add-in signs users in on your ServiceNow instance; the instance's own Multi-Provider SSO configuration — the same one used for browser sign-in — redirects to Entra and back. The add-in never talks to Entra for ServiceNow sign-in and only ever holds tokens issued by your instance. Separately, the add-in's own Microsoft application handles its subscription check, and in tenants that block user consent an Entra admin may need to approve it; that is unrelated to ServiceNow and to your SSO setup. See Using SSO with Microsoft Entra ID for the sequence and the caveats.

Can one person set up the connection for everyone in my organization?

Yes. In the add-in's connection settings there is a "Set as my organization's default" checkbox. Fill in the instance URL and Client ID once, tick it, and save — every other user in the same Microsoft 365 tenant then opens the add-in and finds it already configured. They only click Connect and sign in on your ServiceNow instance; there is nothing for them to type.

Only the instance URL, the OAuth Client ID (a public value) and the default table are shared, keyed to your Microsoft 365 tenant, plus a record of who last changed them. No client secret and no credentials are ever stored — the feature is for public/PKCE OAuth clients, and a tenant using a confidential client still enters its Client Secret locally on each machine. The add-in identifies your Microsoft 365 tenant from the Microsoft account already signed in to Outlook (an Entra ID token verified on our side), so your tenant's configuration is never visible to another organization. That identity check is all it does: it is not involved in signing in to ServiceNow, even when your instance uses Entra ID SSO — see Using SSO.

Any signed-in member of your Microsoft 365 tenant can set or change the default — we can confirm which Microsoft tenant someone belongs to, but not whether they are a ServiceNow administrator, so the add-in records who last updated it. If the checkbox isn't shown, the feature isn't available for your setup and everyone simply fills the settings in manually, exactly as before.

Which ServiceNow table does it create records in?

It defaults to incident, but an admin can point it at any table you can write to — for example a Customer Service case (sn_customerservice_case) or a custom u_ table.

How is the caller determined?

The caller is the ServiceNow account you signed in with — the add-in resolves it automatically and there is nothing to fill in. ServiceNow also records the same identity as the record's opener.

What happens to email attachments?

The original email is attached to the record as an .eml file, and the email's own file attachments are uploaded to the record as separate files.

Does my email data pass through Innova-Apps servers?

No. Record data goes directly from your browser to your ServiceNow instance via its REST Table and Attachment APIs. The only backend is a stateless OAuth token broker that relays the token exchange to your instance's /oauth_token.do endpoint (needed because that endpoint sends no CORS headers). It stores nothing and logs no tokens, secrets, or codes.

Which Outlook clients are supported?

Outlook on the web, new Outlook for Windows, and classic Outlook for Windows and Mac — all with a Microsoft 365 mailbox. Outlook mobile is not supported.

How does authentication work?

The recommended method is OAuth 2.0 with PKCE against your own ServiceNow instance, so your company's SSO and MFA apply. If your instance uses SSO, the redirect to your identity provider happens inside ServiceNow's own login — the add-in never contacts the identity provider and needs nothing configured there for ServiceNow sign-in; see Using SSO with Microsoft Entra ID. As a fallback, Basic auth can be used with a dedicated "Web service access only" integration user that has a password set locally on the instance.

Where are my settings and tokens stored?

Connection settings, tokens, and a local list of up to 25 recently created records (record number and email-derived short description) are stored in the task pane's browser localStorage on the add-in origin. Nothing is stored on Innova-Apps servers.

Does it use AI?

Optionally. If you turn on the AI toggle, the add-in uses AI to draft a concise title from the email subject and a short summary with an action-items list from the email body — and you review and can edit both before creating the record. When AI is on, the email subject and body are sent to Google's Gemini models via Firebase AI Logic (Vertex AI in Firebase) for that summarization and, per the Firebase AI Logic / Vertex AI terms, are not used to train Google's models. With AI off, the add-in just uses the raw subject and body and nothing is sent to Google for summarization. You can report inappropriate or inaccurate AI output from within the add-in.

Is my email content used for analytics or advertising?

No. The add-in collects no analytics or telemetry of your email content and never uses it for advertising or profiling. The only time email text leaves your browser for anything other than your ServiceNow instance is the optional AI feature described above, and only while it is switched on.

Support

📧 Contact Us

For technical support, bug reports, or feature requests:
Email: support@innovaapps.ai
Support page: innovaapps.ai/support

When reporting issues, please include:

Outlook client (web, new Outlook for Windows, or classic Windows/Mac)
Operating system
Steps to reproduce the issue
Any error messages (screenshots helpful)

📖 Read the Quick Start Guide