Configure Microsoft SCCM Patch Orchestration

task australia Updated Sep 10, 2026 5 min read vr-mspatch-config.md
Raw file servicenow.com

Configure the Microsoft SCCM Patch Orchestration integration with your account credentials to enable data ingestion and patch deployment.

Before you begin

Role required: sn_vul.vulnerability_admin and sn_vul_sccm.configure_integration

Before configuring the integration, complete these prerequisites for the JDBC Connection tab:

  1. Install the Java Database Connectivity (JDBC) driver for SQL Server on your MID Server. For instructions, see Synchronize a JAR file to MID Servers.
  2. Set up a JDBC credential with the username and password for your SCCM SQL Server. For instructions, see Create and test your credentials.
  3. Set up a JDBC connection that references the credential above, with the SCCM SQL Server host, database name, and (if applicable) a non-default port. For instructions, see Create a JDBC connection.

Procedure

  1. Navigate to All > Microsoft SCCM Patch Orchestration Integration > Configuration.

  2. In the Integration instance field, above the JDBC Connection and WMI Connection tabs, select the name of the Microsoft SCCM instance account you want to configure, for example, Microsoft SCCM Patch management Integration.

  3. On the JDBC Connection tab, fill in the fields to configure data ingestion (collections, devices, patches, and deployments).

    Field Description
    JDBC connection Reference to the JDBC Connection record you created as a prerequisite. JDBC is the primary connection used for all data ingestion (collections, devices, patches, and deployments).
    Security updates only Select this check box to retrieve only security-classified updates. Clear this check box to retrieve all update types.
    JDBC process timeout (minutes) Maximum time, in minutes, that an SCCM JDBC integration process can remain in a waiting state before it's automatically marked as timed out and failed. Enter 0 to disable this timeout. Default: 60.

  4. On the WMI Connection tab, fill in the fields to configure the Windows credential for the Microsoft SCCM server for patch deployment.

    Field Description
    WMI Connection The Connection record [sys_connection] that stores the host, credentials, and MID Server details for this integration. The default VR Microsoft SCCM connection record is pre-populated.
    Host Enter the host name of the Microsoft SCCM server, for example, sccm2603.secops-eng.com.
    User name Enter your Microsoft SCCM account username.
    Password Enter your Microsoft SCCM account password.
    MID Server Enter the name of the standalone MID Server from the list that you want to use. See Prepare for the Vulnerability Response patch orchestration integration with Microsoft SCCM for more information about MID Servers and set up tasks in your ServiceNow AI Platform®.
    SG connector connection The integration uses a Service Graph Connector (SGC) connection to identify imported assets and match them with existing Configuration Items (CIs). A valid SGC connection is required for CI matching; if this field is not configured, imported assets cannot be associated with existing CIs.

  5. Select Save and Test Credentials.

    The status of your connection between Microsoft SCCM and your ServiceNow AI Platform® instance is displayed in the Validation Status field. If the test is unsuccessful, follow the on-screen prompts.

  6. Configure domain separation for this integration.

    To add configurations to your instance:

    1. Navigate to All > Microsoft SCCM Patch Orchestration Integration > Integration Instances.

    2. Confirm the application scope, Vulnerability Response Patch Orchestration with Microsoft SCCM, is displayed in the Application scope field.

    3. Select New.

    4. Fill in the form.

      Field Description
      Name Name for the integration instance.
      Application Vulnerability Response Patch Orchestration with Microsoft SCCM
      Integration [Read only] Microsoft SCCM Patch management is the default.
      Active Selected by default. If cleared, the instance is inactive.

    5. Click Submit.

      Your new integration instance is displayed on the Integration Instances list.

    6. Repeat steps 1-3 to configure your integration instance and test your credentials.

  7. Set up approvals for patch requests.

    By default, the Patch approval required (sn_vul_patch_orch.patch_approval_required) property is active so that when patch deployments are scheduled, they are submitted for review and approval to users assigned to the Level 1 - Patch update approval group.

    If you want users with the sn_vul_patch_orch.configure_patch role to schedule patches without approval, you can deactivate the Patch approval required (sn_vul_patch_orch.patch_approval_required) property. You might prefer to leave approvals activated so that scheduled patches don't conflict with normal working hours.

    Note: If you deactivate the approval system property, any user with the sn_vul_patch_orch.configure_patch role can schedule and deploy patches without review and approval.

    As a user with the sn_vul.vulnerability_admin role, to deactivate the system property:

    1. Navigate to All and enter sys.properties.list in the filter navigator.

    2. Locate sn_vul_patch_orch.patch_approval_required and select it to open the record.

    3. In the Value field, type false.

    4. Click Update.

  8. If the approval property is active, assign approvers for patch requests.

    1. Navigate to All > Vulnerability Response > Administration > Approval Rules.

    2. If the Deploy patch update approval Approval Rule is not displayed, select All in the filter to display the full list.

    3. From the list, select Deploy patch update approval.

    4. On the record, with the Approval Configuration tab selected, select Default Configuration Patch Update approval.

    5. On the record, select Level 1 - Patch update approval.

    6. Add users in this group.

      The users assigned to this group approve patch requests submitted by users with the sn_vul_patch_orch.configure_patch role. Navigate to My Approvals to view and process the requests.

  9. Select Update.

  10. Set up multi-level approvals to require more than one approval before deploying scheduled patch requests.

    1. With the Default Configuration Patch Update approval record displayed, click New.

    2. Fill in the fields.

Field

Description

Name

Approval level name, for example, Level 2 - Patch update approval.

Active

Active by default. When active, the approval level is in use.

Required approval

Select how many approvals are required for the selected level:- One approver required

  • All users must approve

Order

Execution order of various configurations within a rule. For example, a configuration with an order entry of 100 runs before a configuration with an order entry of 200.

Role

Select a role for the group from the list.

Approval rule

Contains the table and type details for the approval rule.

Approval configuration

Contains the approval configurations.

Assign using

Select an option:- User and user group

  • Approval table field
  • Script

Groups

Approver level group consisting of multiple users. The user must have one of the following roles that you specify.

Users

Edit the users listed in the groups.
3. Select **Submit**.
Search documentation
Search document titles and file paths on the australia branch