Create an external identity provider

---
title: Create an external identity provider
description: After you have configured the multi-provider SSO properties, you can update or create new SAML 2.0 or digest token identity provider.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/authentication/t\_CreateUpdateIdentityProvider.html
release: australia
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Multi-Provider SSO configurations, Multi-Provider single sign-on \(SSO\), Authentication, Access Management]
---

# Create an external identity provider

After you have configured the multi-provider SSO properties, you can update or create new SAML 2.0 or digest token identity provider.

## Before you begin

Role required: sso\_config\_admin, business\_rule\_admin, script\_include\_admin

## Procedure

1.  Navigate to **All** > **Multi-Provider SSO** > **Identity Providers**.

2.  To edit an identity provider record, click the record.

    -   For digest token configurations, manually update the properties.
    -   For SAML2 Update 1 configurations, automatically update the identity provider metadata with the **Import Identity Provider Metadata** related link or update the properties manually.
    -   For OpenID Connect configurations, manually update the properties.
3.  To create a new identity provider, click **New**.

    -   For digest token configurations: Click **Digest SSO** and enter the digest properties for multi-provider single sign-on.
    -   For SAML2 configurations: Click **MultiSSOV2\_SAML2\_custom** and import the identity provider metadata from a URL, as XML, or manually enter the identity provider information.

        \[Omitted image "Import\_metadata.png"\] Alt text: Importing identity provider metadata

    -   For OpenID Connect: Click **OpenID Connect** and enter client ID, client secret, and well known configuration URL.
4.  To make the IdP the failover IdP that is used when a user doesn’t have an SSO source defined, select the **Default** check box.

    If you have SAML 2 Update 1 active and you upgrade to the Fuji release, the SAML 2 Update 1 IdP is selected as the default failover. No default failover IdP is selected for new instances or if you are upgrading from a release on which SAML 2 Update 1 is not active.

    **Note:** The metadata import process automatically creates a certificate record for the identity provider. Navigate to the **x509 Certificate** module to see the certificate.

    **Note:** Certificates for single-sign on should always be in PEM format to work with SAML certificates.

5.  If E-Signature is active, configure the Identity Provider form and add the **Assertion Consumer URL for eSignature authentication** field.

    In most cases, this URL is: `https://YOURINSTANCE.service-now.com/consumer.do`. However, if you employ a customized method of handling the SAML authentication for E-Signature, you can set up your own consumer URL. If you are only using SAML 2.0 Update 1 and not using Multi-Provider Single Sign-on, configure the assertion consumer URL with [E-signature SAML properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/c_AddingSupportForESignature.md).