🎫 ServiceNow

ServiceNow — IT service management (ITSM) platform. Provisioning target for users, groups, roles.

Identification

• vendor key: servicenow
• engine: servicenow
• default role: target
• type: Out-of-the-box vendor
• vendor docs: https://developer.servicenow.com/dev.do#!/reference/api/sandiego/rest/c_TableAPI

Supported auth methods

• basic
• oauth2_client_credentials

What the connector does

• Reads users, groups and group memberships as accounts, entitlements and grants. The roles object below is a catalogue template; the connector does not govern role assignments (sys_user_has_role), so role grants are not read or written.
• Writes group membership (grant and revoke), disables and enables a user (active set to false or true), and updates mapped user attributes. Values it puts in a ServiceNow lookup are checked first: one that is empty or carries a query operator (^) or a control character is refused with an error, never cleaned up and sent. It does not create or delete ServiceNow users: a new user is created by your own process and picked up on the next sync.
• Relays manual tasks as incidents. When a manual provisioning task is created for ServiceNow and the tenant has an active ServiceNow target connector, the platform opens a real incident and stores its number and link on the task. If the incident cannot be created (bad credentials, the integration user lacks the itil role, network error) no ticket number is invented: the task shows the error. A sweep checks open tasks every 15 minutes and closes the task when the incident is Resolved, Closed or Cancelled. The integration user therefore also needs to be able to create and read incidents.
• Does not neutralise access by disabling. Disabling a ServiceNow user does not remove its group memberships, so the platform does not treat a disabled account there as having no access. See Reconciliation.

The default users read lists only active users. When a lock or hold on a person disables their ServiceNow account, the account is no longer reported by that read; the platform does not treat it as deleted for as long as the lock lasts, and it restores the person's grants when the lock is lifted. A disabled account of a person who has left is not given that protection.

AI agents and integration credentials

Two optional reads bring ServiceNow into AI-agent governance. Neither changes anything in ServiceNow.

• AI agents. The agents object (off by default) reads sn_aia_agent. Every row there is an agent, so switching the object on is the declaration; its filter can narrow it. Each becomes a governed ai_agent identity with the platform servicenow_ai_agent, and an explicit active value sets its status.
• Credential inventory. The connector reads, once per table and for every user, the OAuth refresh tokens with their stored expiry (a person's token that already expired is skipped), the active API keys and the OAuth application registry entries. An agent's or integration user's credential goes to that non-human identity; a person's lands on the person, so a leaver who keeps one is flagged (see one person, many accounts). The token and client_secret fields are never in a field list. Revoking a person's token or API key at the source is off by default and switched on per system; an OAuth application is never switched off.

The kill switch locks a ServiceNow agent out of RapidValue but does not stop it in ServiceNow yet; it reports that the agent keeps running there. The table and field names have not yet been proven against a live instance; a table the integration user may not read makes the inventory incomplete rather than empty.

Importable objects (4)

Object types the wizard offers to import out of the box.

Users (sys_user)

• name: users
• iga_target: identity
• path: /api/now/table/sys_user?sysparm_query=active=true&sysparm_fields=sys_id,user_name,email,first_name,last_name,department.name,title,manager.user_name,location,company,active

All active users. Remove active=true to include inactive users.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
identity_id	{{ user_name }}	✓
email	{{ email }}
first_name	{{ first_name }}
last_name	{{ last_name }}
display_name	{{ first_name }} {{ last_name }}
function	{{ title }}
department	{{ department.name }}
manager_id	{{ manager.user_name }}
location	{{ location }}
company	{{ company }}
status	{{ 'active' if active == 'true' else 'suspended' }}
native_account_name	{{ user_name }}	✓
identity_business_id	{{ email|if_null(user_name)|lower }}
is_privileged	{{ false }}
servicenow_id	{{ sys_id }}

User Groups (sys_user_group)

• name: groups
• iga_target: entitlement
• path: /api/now/table/sys_user_group?sysparm_fields=sys_id,name,description,type,active,roles

ServiceNow groups — used for ticket assignment + access control.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
name	{{ name }}	✓
description	{{ description }}
native_identifier	{{ sys_id }}
risk_level	{{ 'high' if ('admin' in (name or '')|lower or 'security' in (name or '')|lower) else 'low' }}
type	{{ type }}
status	{{ 'active' if active == 'true' else 'inactive' }}
privileged	{{ 'admin' in (name or '')|lower or 'security' in (name or '')|lower }}

Roles (sys_user_role)

• name: roles
• iga_target: entitlement
• path: /api/now/table/sys_user_role?sysparm_fields=sys_id,name,description,elevated_privilege

ServiceNow roles — fine-grained access. admin is the most privileged.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
name	{{ name }}	✓
description	{{ description }}
native_identifier	{{ sys_id }}
risk_level	{{ 'critical' if (name == 'admin') else ('high' if elevated_privilege == 'true' else 'medium') }}
privileged	{{ elevated_privilege == 'true' or name == 'admin' }}

Group memberships (sys_user_grmember)

• name: group_members
• iga_target: entitlement_assignment
• path: /api/now/table/sys_user_grmember?sysparm_fields=sys_id,user.user_name,group.name

Which user belongs to which group? For reconciliation.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
identity_business_id	{{ user.user_name }}	✓
entitlement_business_id	{{ group.name }}	✓

Onboarding setup checklist

Create a dedicated integration user in ServiceNow with the 'rest_service' + 'admin' (or, more granularly: user_admin + role_admin) roles, and retrieve the instance URL. ~10 minutes.

Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.