servicenow MFA Authenticator browser extension

[kack l]

Hi everyone, servicenow, is there a function to detect or log the information of the person who logged in using the Authenticator browser extension?
Is there such a module or table?

[Randheer Singh · Accepted solution]

Hi @kack l 
The sys_user_login_history table has the MFA_enforced column, which can tell you if MFA was used during the login with local/LDAP credentials. Currently, the table does not have information about the MFA method used during the login. We are planning to add the MFA method used column in the Zurich release.
Thanks,

Randheer

[Nilesh Pol]

@kack l OOTB, there is no built-in table or function specifically dedicated to tracking users who logged in using the Authenticator browser extension. 

BUT

you can detect and log login activity, including MFA usage, via several ways:

1. syslog table - logs login events, including source IPs, user agents, and session starts.

2. sys_user_session table - Useful for seeing who's logged in right now.

3. sys_mfa_transaction Table - Stores each MFA verification attempt.

[kack l]

Thanks for your answers.

[rohansargar]

Hello @kack l,

In ServiceNow, user login tracking is available through the syslog and syslog_transaction tables, but ServiceNow does not provide native visibility into which authentication method (like a browser extension-based MFA) was used — such as Google Authenticator or Microsoft Authenticator browser extension — out of the box.

What You Can Track in ServiceNow
1. User Login Information
ServiceNow records user login attempts in the following tables:

syslog – General logging (including login events).

syslog_transaction – Details of web transactions.

sys_user_session – Shows current and historical user sessions.

sys_user – The user table (who logged in).

Thanks & regards,

Rohan

[kack l]

Thanks for your answer. I will confirm