Authentication

The account recovery context uses a policy to define how and when the account recovery can be established.

Use system properties to configure Account Recovery (ACR) on your instance.

The Approval with e-Signature plugin (com.glide.e_signature_approvals) allows users to approve requests by re-entering their login credentials.

Activate the policy-based login experience so that you can create and manage the identifier-first login policies that drive the policy-based login experience.

Enable custom URLs to be set up on your ServiceNow instance. You can activate the Custom URL plugin (com.snc.customurl) if you have the admin role.

Control whether an identifier-first login policy is included in policy evaluation by activating or deactivating it.

Activate the Zero Trust - Location Based Access (com.snc.zero_trust_location_access) to enable admins to configure adaptive authentication policies based on the location of the user.

You can activate the Personal Authentication plugin (com.snc.sn_ihub_personal_auth) for Integration Hub if you have the admin role. If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.

For Processor, install the Processor Access policy (com.glide.processor.policy) plugin.

You can activate the REST API Access Policy plugin (com.glide.rest.policy) if you have the admin role. If the application does NOT include demo data or it does NOT install related applications and plugins, delete or revise the following sentence:The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed.

You can activate the REST API Auth Scope plugin (com.glide.rest.auth.scope) to link the OAuth entity with authentication scopes.

Use session validation context to restrict access to ServiceNow when hijackers copy a user's session cookies from one device to another to impersonate the session or restrict the user's session access if they’re using an insecure network.

For SOAP API access policy, install the SOAP API Access Policy (com.glide.soap.policy) plugin.

Time limited authentication activates through the Integration - Multiple Provider Single Sign-On Installer plugin.

Activate adaptive authentication with trusted mobile app by using the authentication policy and filter conditions.

You can activate the plugin API Key and HMAC Authentication (com.glide.tokenbased_auth) in your ServiceNow instance.

For MFA with SMS, install the Multi-factor authentication with SMS (com.snc.authentication.sms_mfa) plugin.

Use these example steps to configure adaptive authentication on an instance.

Filter criteria (also called policy inputs) are used as inputs for policy conditions to verify and meet the requirements of an authentication request.

You can use the adaptive authentication events table to learn about the events.

You can activate the Adaptive Authentication plugin (com.snc.adaptive_authentication) for Adaptive Authentication if you have the admin role.

Use the Adaptive authentication policy framework to enforce contextual authentication controls to the right users at the right time. Adaptive authentication uses authentication policies to evaluate authentication requests and then either deny or allow access to your instance based on the specified policy conditions.

You can add custom fields in the user self-registration form.

Add the OAuth Application User field on the OAuth Entity form to use the Client Credentials grant type for OAuth inbound integrations.

Configure an OAuth OpenID Connect (OIDC) provider to accept identity tokens generated by a third-party OIDC provider using inbound API calls using Single Sign-On option (Multi-Provider SSO).

Add an outbound certificate policy to control how the instance validates a specific domain's SSL/TLS certificates on outbound connections, adjusting individual validation checks for that domain.

Add an authentication policy to one of the authentication policy contexts. The authentication context uses the policy inputs and conditions to determine whether users are granted access to the instance, or whether MFA is enforced for your users.

Add ServiceNow from the gallery to your list of managed SaaS apps on Azure AD.

Learn about the policy prioritization logic if there are multiple API access policy configured for your ServiceNow instance.

API access policy defines the permissions and duration of access to an API.

System or Export Processors can use processor access policy to secure all the export endpoints.

Authentication policies evaluate authentication requests based on the specified policy conditions and either allow or deny access depending on the matching criteria.

Authentication configurations for API.

OAuth based authentication validates the identity of the client that attempts to establish a trust on the system by using an authentication protocol.

Support API tokens for REST API endpoints so that the ServiceNow user name and password isn't visible in the webhook URL.

Assign the Azure AD test user that is created to use Azure single sign-on by granting access to ServiceNow.

Use authentication policy contexts to determine how and when your instance enforces authentication policies.

Settings on the Settings tab of the Authentication Console control whether the policy-based login experience is active and how the identifier-first login page behaves.

The Authentication Console enables administrators to configure and manage authentication behavior across a ServiceNow instance, including identifier-first login policies and related settings.

Authentication factors help identify and verify callers, allowing only authorized users to access AI voice agents on the ServiceNow AI Platform.

Authentication policies evaluate authentication requests based on the specified policy conditions and either allow or deny access depending on the output of policy conditions evaluation. For example, access is allowed only if all the policy conditions specified in Allow Access Policy evaluate to true.

The OAuth authorization code grant is a secure and widely used flow for web, mobile, or desktop apps that access user data with user consent. It supports both private clients (using a client secret), and public clients (using PKCE).

ServiceNow handles both authentication and API access by acting as the authorization and resource server. When single sign-on (SSO) is enabled, it redirects users to the configured identity provider (IdP) for authentication and issues tokens after successful login.

Integrate ServiceNow with Azure Active Directory (Azure AD).

The Basic Auth Exceptions table lists accounts that have been identified as using basic authentication on the instance, along with their assigned decision and usage details.

Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.

Legacy API authentication method using username and password, with restricted usage and varying behavior in zBoot and upgraded instances.

Add passwords to the Excluded Password table to prohibit specific passwords from being used by users on your instance.

Configure the following properties for E-Signature with Security Assertion Markup Language (SAML) 2.0 update 1.

Deep linking allows instances to support direct email links to a particular record in the system.

The ServiceNow Multi-Provider SSO plugin supports a SAML 2. single sign-on (SSO) integration with Microsoft ADFS.

ServiceNow's authentication validates the identity of a user who accesses an instance, and then authorizes the user to features that match the user's role or job function.

When the Remember me check box is selected at login, a cookie is stored on the user's computer. This cookie automatically authenticates the user upon subsequent visits.

The digest token authentication passes user credentials and a digest token within an unencrypted HTTP header.

You can use email links when using the digestive token external authentication, however, you must establish how to handle links in email notifications.

When a customer has implemented the digested token Single Sign-on and wishes to add the security of a nonce, they follow a certain process flow.

An IdP generally offers an XML document containing their authentication and logout metadata.

Add a cryptographic nonce to the authentication header for custom digest-based Single Sign- On (SSO) to confirm that each authentication token is valid for one use only. This implementation requires ServiceNow developer expertise.

You can implement a nonce to be used with single sign-on digest authentication.

One way to secure a web-based application is to restrict access based on the IP address.

SAML 2.0 specifies a Web Browser SSO Profile that involves exchanging information among an identity provider (IdP), a service provider (SP), and a principal (user) on a web browser.

Configure login security options to control access to your instance.

The system keeps track of the first starting page that a user is trying to access even if the user wants to log in to the Employee Self-Service Portal.

During logout, the instance issues the SAML 2.0 LogoutRequest service call to the IdP.

To migrate from a SAML 1.1 integration to a SAML 2.0 integration, contact customer support.

External SSO allows organizations to use several SSO identity providers (IdPs) to manage authentication as well as retain local database (basic) authentication.

Mutual authentication establishes trust by exchanging secure sockets layer (SSL) certificates.

OAuth 2.0 lets users access instance resources through external clients by obtaining a token rather than by entering login credentials with each resource request.

Authorization code grant flow allows a user to access a resource by authenticating directly with an OAuth server that trusts the resource, in contrast with authenticating with username/password credentials.

The OAuth client API provides methods to request and revoke OAuth tokens.

ServiceNow instances support the implicit grant of an access token.

This Java algorithm illustrates creating a digest token from an HTTP header.

Before contacting support, try the troubleshooting solutions available in the knowledge base on Hi.

The Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between security domains.

Familiarize yourself with these SAML concepts.

If users exist in your IdP but are not in your instance, SAML user provisioning can automatically create the users in your instance's User [sys_user] table.

This C class illustrates creating a digest token from three input parameters.

The following sections illustrate the new required elements and attributes that the IdP should provide in the SAML Response.

The default self-service Password Reset process enables a user to reset the password without assistance from service desk agents.

These system properties define how the instance interacts with the IdP as a Service Provider.

A typical SSO logic flow involves looking for an active session, checking user credentials, and creating the necessary token.

During a login challenge resulting from a URL link into the instance that requires an SSO session, the referring URL might need to be supplied to the SSO provider so that after authentication, the URL can be passed back to the instance and linked to the correct resource.

Ensure that the integration's User table field contains appropriate matching values.

Enforce security using basic authentication, mutual authentication, or WS-Security.

Certificate-based authentication lets you mutually authenticate inbound API requests using certificates from a trusted certificate authority (CA).

Generate a new code to change an Authenticator app on your device.

Information about the changes that are expected due to the MFA enforcement.

Configuring Client ID Metadata Document (CIMD) inbound support lets an instance accept an external OAuth client that's identified by a metadata document URL, without storing a client secret for that client.

CIMD lets the ServiceNow AI Platform accept an external OAuth client that identifies itself with an HTTPS metadata-document URL instead of a pre-issued client ID and secret.

Use the OAuth client credentials grant type for back-end services or automated integrations that access ServiceNow APIs without user interaction. The client application authenticates directly using its client ID and secret, and receives an access token that represents the application itself, and not the user.

Authenticate a client application using a client credentials workflow. The client credentials grant workflow is used by back-end services or system integrations to access ServiceNow APIs without user involvement.

Use the OAuth client credentials grant type for inbound integrations from a third-party OAuth client to the ServiceNow platform.

Configure the Client Type field for OAuth and SSO record related configurations.

Configure an account recovery user to perform account recovery activities on your instance.

Configure Private Key JWT for OIDC based SSO integrations.

Configure Private Key JWT for outbound OAuth integrations.

Configure a third-party ID token to enable secure authentication by verifying user identities through an external IdP. The third-party ID token improves security by reducing stored credentials, confirms seamless authentication, and supports interoperability with industry standards like OpenID Connect (OIDC).

After activating adaptive authentication, configure adaptive authentication properties according to your security requirements.

Configure an authentication policy to define inputs and conditions to use to grant access to an instance or enforce multi-factor authentication.

Configure the OAuth authorization code grant to enable secure and interactive user authentication to enable applications to access resources on behalf of users. The OAuth authorization code grant verifies that the API access is granted based on the user identity and permissions.

Configure the OAuth Client Credentials Grant for secure machine-to-machine authentication without user interaction. It authenticates applications using client credentials and grants-controlled API access with scoped permissions.

Configuring an OAuth JSON Web Token (JWT) bearer grant secures token-based authentication without user interaction. It enhances security with signed JWTs and reduces authentication overhead by eliminating repeated login attempts.

Configuring an OAuth resource owner password credential (ROPC) grant enables applications to authenticate users by directly using their credentials to obtain an access token. This method is ideal for trusted applications and legacy systems that require authentication without browser-based flows, enabling secure token validation and controlled API access.

Configure an API key to support authentication for REST API endpoints.

Apply authentication profile for the export processors.

Configure Azure AD SSO in the Azure portal.

Register a Client ID Metadata Document (CIMD) client so that the instance accepts inbound OAuth requests from a client identified by a metadata document URL. You can fetch the client's configuration from its metadata URL or enter the details manually.

The Embedded Session Role Configuration (Client Access Role configuration) record is created by default, which removes admin and security admin roles (high privilege roles) for the users using the UI components on the third-party portals.

Add a custom URL to your instance configuration to use instead of your ServiceNow URL.

Configure the Email one-time password (OTP) to enable OTP-based authentication for users in your instance.

Configure a Facebook-based SSO to your ServiceNow instance.

Configure policy input and condition to display FIDO2 as an MFA factor policy for authentication.

Global blocking policy denies the authentication requests of users and APIs based on the specified policy conditions. This policy can be used as an alternative to the IP Address Access Control.

Configure HMAC to support authentication for REST API endpoints.

Configure the HA SMS OTP service to enable human agents to generate and validate one-time pass codes during live interactions.

Configure knowledge-based authentication (KBA) to identify and authenticate callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents.

Configure policy input and condition to display Email OTP as an MFA factor policy for authentication.

Configure SMS and Email with the Provider to ensure every user can login securely.

Enforce MFA with SSO for your users within or outside your organization.

Configure multi-factor authentication (MFA) to improve your users' security posture when using ServiceNow.

Configure Okta Verify to receive push notifications for identity verification.

Configure personal OAuth authentication with the REST step in Flow Designer.

To use the Google reCAPTCHA service, you must request an API key pair from Google and then configure the related system properties.

Link the OAuth entity with an auth scope to manage the token to access the REST APIs that are linked with the auth scope.

Configure ServiceNow with Azure AD details to use SSO.

Configure policy input and condition to display SMS OTP as an MFA factor policy for authentication.

Users are required to configure Soft PIN before it can be used for authentication with ServiceNow AI Platform.

Configure step-up authentication to require an additional challenge before callers reach AI voice agents that handle sensitive requests.

Configure how callers provide authentication responses by speaking or using the phone keypad.

Set up an outbound OAuth connection to Microsoft Azure that uses a KMF-signed JWT assertion instead of a stored client secret.

Set up an outbound OAuth connection to Google Cloud that uses the OAuth 2.0 token exchange grant with a KMF-signed subject token instead of a stored client secret.

To secure voice agent environments, configure authentication factors that first identify the caller, then authenticate them before granting access.

Configure how the client ID and secret are sent to your OAuth provider.

Create an authentication profile and add one or more authentication policies to the profile. You can also configure the ID Token and OAuth Token authentication profiles that are available by default.

Create a test user on Azure AD.

Create outbound rest message to authorize instance as authorization server.

Create an API access policy and map an authentication profile to restrict the authentication type for a REST API. For example, you can create an API access policy that allows only ID token authentication for a REST API.

Authentication policies enables you to enforce access restrictions on the APIs based on the specified filter criteria.

Create an authentication profile and add one or more authentication policies to the profile. You can also configure the ID Token and OAuth Token authentication profiles that are available by default.

Create the glide.oauth.inbound.client.credential.grant_type.enabled system property to use Client Credentials grant type for OAuth inbound integrations.

Generate a FIPS 140-2 compliant self-signed BCFKS keystore for use in SAML signing and encryption operations within the Multi-Provider SSO plugin.

Create a single global API access policy to protect all the SOAP APIs.

Group filter criteria allows or denies user access based on the user group to which the user belongs.

Create an identifier-first login policy that routes matching users to password-based authentication (a username and password managed within the platform).

Create an identifier-first login policy that routes matching users to a single sign-on (SSO) identity provider.

Create an identifier-first login policy to route users to an authentication method based on conditions such as IP address, role, or group.

IP filter criteria enables you to filter users based on the user's IP addresses. You can configure an authentication policy to allow or deny access to a specific address or range of addresses.

OAuth JWT bearer token enables the client web applications to authenticate with your instance seamlessly using the inbound JWT grant type instead of requiring the end user to manually log in or share the password.

Map knowledge-based questions to their answers so the answers can be used to confirm a caller's identity.

Specify the questions used for caller identification and authentication with a specific AI voice agent service.

Create knowledge-based answers for the preconfigured security questions to confirm the user's identity.

Create knowledge-based questions to use for caller identification and authentication in AI voice agent interactions.

Use location filter criteria to filter input for user authentication based on the user location.

Create or update an OpenID Connect (OIDC) configuration by using the Multi-Provider SSO plugin.

Role filter criteria enables you to filter users based on the roles. You can configure an authentication policy to allow or deny access to a list of user roles.

Create an API access policy and map an authentication profile to restrict the authentication type for a SOAP API. For example, you can create an API access policy that allows only ID token authentication for a SOAP API.

A list of common errors and associated fixes for a custom URL setup and configuration.Target Audience: ServiceNow Admin

Set your custom URL with the Identity Provider to enable the user to log in with their IdPs.

You can enable your ServiceNow instance to be accessible from a company-branded or custom URL.

You can use the default registration form fields or create custom registration form fields.

Permanently remove an identifier-first login policy from the Authentication Console.

View the details of devices that are registered with your ServiceNow instance.

You can disable a concurrent session limit on a specific user or on a particular role.

E-signature with Multi-Provider SSO enables you to use the e-signature properties instead of the SAML or OIDC properties for authentication.

Modify the conditions, authentication method, or evaluation order of an existing identifier-first login policy.

Email OTP for AI voice agents sends a one-time numeric code to the caller's email address. The caller retrieves the code from their email and provides it to the agent to verify their identity.

Implement password policy controls at login. Force users to change their password if the password does not meet the password policy criteria.

Authentication factors verify caller identity before granting access to AI voice agents. Combining multiple factors helps confirm that only authorized users interact with AI voice agents.

The instance reads the HTTP header value and compares its computed hash value of the digest token.

You can limit the number of concurrent interactive sessions for a user or role on an instance across all nodes.

Multi-factor Authentication (MFA) is an authentication method that requires users to provide information other than their basic credentials.

Passwords in your ServiceNow instance must meet complexity requirements.

Use external user self-registration to onboard a large volume of external users to your instance. This feature enhances identity verification to improve customer experiences and supports commonly used registration flows.

Support time limited authentication for your ServiceNow instance.

Configure login security options to control access to your instance.

Enforce security using basic authentication, mutual authentication, or WS-Security.

To prevent inadvertently providing access to external users, you can assign the snc_external role to all external users.

Create a user registration configuration record to bootstrap the onboarding process of external users to custom ServiceNow applications. This form guides the external users through the self-registration process.

You can activate the External User Self-Registration plugin (com.snc.external_user_self_registration) if you have the admin role.

Use external user self-registration to onboard a large volume of external users to your instance. This feature enhances identity verification to improve customer experiences and supports commonly used registration flows.

FAQ related to understanding the MFA metrics.

FAQ related to MFA enforcement timelines and why it’s important.

FAQ related to MFA enforcement and why it’s important.

FAQ related to MFA enforcement exception and why it’s important.

FAQ related to MFA types and why it’s important.

Details about some of the FAQs due to the MFA enforcement.

FAQ related to MFA reset and why it’s important.

Filter criteria contains filter conditions or queries that are used as policy inputs for an authentication policy. Policy inputs are used to group one or more filter criteria and define the policy conditions of an authentication policy. For example, IP filter criteria define an IP address in the Classless Inter-Domain Routing (CIDR) format or a range of IP addresses.

A SAML or SSO installation needs the SP metadata generated for the IdP before the custom URL instance generates.

Generate the initial token for a user who doesn’t have access to the credentials page to configure personal authentication.

Use group filter criteria to filter users based on the user group to which the user belongs.

Human-assisted SMS OTP lets a human agent verify an end user's identity by sending a one-time passcode through SMS during a live interaction. The agent initiates OTP generation and validation through the platform's scriptable APIs, and the consuming application (for example, CSM or FSO workspace) handles the agent-facing workflow and user interface.

Use the Identity Provider attributes that are received from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) from the Identity Provider (IdP) as filter criteria for authentication.

Use the Identity Provider attributes that are received from the OpenID Connect (OIDC) from the Identity Provider (IdP) as filter criteria for authentication.

Use the Identity Provider attributes that are received from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) from the Identity Provider (IdP) as filter criteria for authentication.

Different entities can authenticate a user through SAML multi-SSO.

Identifier-first login is the framework the policy-based login experience currently uses. Identifier-first login policies, evaluated through the policy-based login experience, determine how the instance routes a user to an authentication method after the user enters an identifier.

REST API access policies enable you to restrict access to inbound REST APIs based on the authentication type and the specified filter criteria of the access policy.

Use IP filter criteria to filter the users based on the user's IP addresses. Both IPv4 and IPv6 are supported.

Configuring an OAuth JSON Web Token (JWT) bearer grant secures token-based authentication without user interaction. Use this flow when a client application needs secure, unattended access to ServiceNow resources, either as itself or on behalf of a user.

JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention. This support enables Integration Hub or other automated tasks using JWTs to configure API and Service integrations with different providers.

JSON Web Tokens (JWTs) enable the capability to configure server-to-server API interactions between ServiceNow and external API providers without requiring any user intervention.

Use private key JWT to authenticate OAuth 2.0 clients to the authorization server.

Knowledge-based authentication (KBA) is an identification and authentication method that verifies callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents. KBA can be used to identify a caller, authenticate a caller, or both within the same interaction.

Use the location filter criteria created in Session Access to reduce roles based on the location of the user.

You can activate the Limit Concurrent Sessions plugin (com.glide.limit.concurrent.sessions) if you have the admin role.

You can limit the number of concurrent interactive sessions for a user or role on an instance across all nodes.

Use ServiceNow local authentication to secure user login on a local device.

Location filter criteria can be used as filter input for users based on the user location.

The recommended and most efficient method for users to log in using Multi-Provider SSO is to use a specifically configured URL.

Log in Metrics displays the log in trends on the ServiceNow.

Create, edit, activate, deactivate, and delete the identifier-first login policies that drive the policy-based login experience.

Manage your trusted device from the Trusted Device registration page.

Register an external authorization server, such as Microsoft Entra ID or Okta, as a trusted token issuer for the ServiceNow MCP Server, so that MCP clients can authenticate using tokens issued by your enterprise identity provider.

Reference for the fields on the OIDC Provider Configuration and OAuth Protected Resource records used to register an external authorization server for the ServiceNow MCP Server.

Create an OIDC Provider Configuration to register an external authorization server, such as Microsoft Entra ID or Okta, as a trusted token issuer for the ServiceNow MCP Server.

Use third party authenticator applications to generate temporary MFA pass codes.

Use the Authenticator Configuration page to manage authenticator options on your instance.

The Multi-factor Authentication (MFA) policy context uses a policy to define how and when MFA is enforced during the login process.

View the different MFA metrics to understand the MFA adoption and usage.

Configure the properties for MFA enforcement from Yokohama and upgrade to Yokohama.

FAQ related to MFA enforcement scope and why it’s important.

MFA is enforced for non-SSO logins to ServiceNow starting with the Yokohama release.

Use the MFA factor policies to specify the types of authentication factors that you would like to permit for your instance.

Use the MFA Guided Setup to step through the initial configuration of the MFA module and understand the requirements for MFA enforcements.

Learn how to activate, use, and configure Multi-factor authentication (MFA).

ServiceNow MFA supports verification methods such as authenticator app, Fast IDentity Online 2 (FIDO2) and time-based one-time password (TOTP).

View the different MFA metrics to understand the MFA adoption and usage.

Use adaptive policies to determine which users must use two-step multi-factor (MFA) verification.

Use system properties to enable and customize MFA to meet your security requirements.

Use role-based multi-factor criteria to enforce multi-factor authentication for all users assigned to specific roles.

Register a biometric authenticator to use as part of your multi-factor authentication (MFA) login.

Register a hardware key to use as part of your multi-factor authentication (MFA) login.

Enable multi-factor authentication for your account in your user profile settings.

You can use MFA with an SSO provider for your ServiceNow instance.

Learn how to use multi-factor authentication tools to securely access your instance.

Your users can use hardware keys or their device's biometric readers (FIDO2) to authenticate to an instance.

Multi-factor authentication (MFA) with email as a factor for your authentication.

You can configure FIDO2 as an MFA factor policy to enforce MFA for your users.

Multi-factor authentication (MFA) with SMS as a factor for your authentication.

Access your ServiceNow from untrusted networks by using the Now Mobile app.

Use MFA criteria to determine which users and roles must use two-step verification.

Use multi-factor authentication (MFA) providers to configure SMS and Email based authentication so that every user can log in securely.

The new inbound integration workflow in the ServiceNow Machine Identity Console provides enhanced experience for managing inbound integrations.

The policy-based login experience routes each user to the appropriate authentication method based on administrator-defined policies, using an identifier-first login flow.

Field descriptions for an identifier-first login policy in the Authentication Console.

System properties, affected login routes, policy conditions, authentication methods, and fallback behavior for the policy-based login experience.

The glide.oauth.state.paramater.required system property enables the State parameter to be required in an OAuth request for authorization code flow.

OAuth based authentication validates the identity of the client that attempts to establish a trust on the system by using an authentication protocol.

OAuth Inbound authentication allows trusted external applications to securely access ServiceNow APIs, helping to keep connections controlled and authorized.