Service Accounts

[andrewcliff]

What's the best practice when setting up ServiceNow integration service accounts (Avanade, Blue Voyant etc...)?

For example, sMSA, gMSA, Managed Identity, or Service Principal?

Thanks.

[Dr Atul - LNG]

Hi @andrewcliff 

Create a separate account for each integration to make them easier to manage and maintain. These accounts should be used consistently for the relevant integration fields.

https://www.servicenow.com/community/in-other-news/user-account-or-service-account-what-to-use-for-w...

[andrewcliff]

Thanks for the quick reply. When these service accounts are setup within ServiceNow, are they synced to Microsoft Entra?

[Dr Atul - LNG]

No, these are SN users. So, if you want to sync things better, it would be best to create an Intra and get it here.

[Tanushree Maiti]

Hi @andrewcliff 

As an Architect I follow these best practices guidelines. You can check.

• Naming Convention:  To identify integration user properly, Use a standard prefix like <project name>_ followed by the application or project name.

e.g., <project short name>_int_<application short name>) to easily track in log/records etc

• Web Service Restriction: Check the "Web Service Access Only" box , so the account cannot log into the standard ServiceNow UI
• Internal Integration User: Enable the Internal Integration User flag where applicable to completely block direct browser logins and SSO access for the machine account
• Dedicated Accounts: Single-Purpose Accounts – Never use personal/company related user accounts for integrations. Create a separate account for each specific integration tool or external system
• Account Type: Maintain integration accounts as local users directly inside ServiceNow rather than syncing them via any other source. If password gets changed,integration will fail.
• Principle of least privilege: Assign only the precise roles and access scopes required for the specific integration