ServiceNow-AD integration: MID Server On-prem vs Cloud

[Sonali Dhal1]

The requirement is to automatically add a user who already exists in ServiceNow to the appropriate Active Directory (AD) group based on the application selected in the catalog request.

The expected flow is:

Catalog Item Submission → Identify Requested For → Determine AD Group based on Application → Add User to AD Group

Once the catalog item is submitted, the Requested For user should be automatically added to the corresponding AD group associated with the application selected in the request.

As part of the solution design, we are evaluating which MID Server deployment model would be most appropriate for this integration:

• AWS-hosted MID Server
• On-premises MID Server

We would like to understand the key advantages, disadvantages, security considerations, network requirements, and operational implications of both approaches.

Additionally, we would like to clarify the following:

1. MID Server hosting: Are there any architectural or security considerations that would favor hosting the MID Server in AWS versus on-premises for an on-prem AD integration?
2. Network connectivity: What network connectivity is required between the MID Server and the AD domain controllers?
3. Domain membership: Does the MID Server host need to be part of the same AD domain as the domain controllers, or can it belong to a different domain/workgroup as long as the required network connectivity and authentication are configured?
4. Authentication: What is the recommended authentication/service-account model for the MID Server to perform the AD group membership operation?
5. Security: Are there any additional firewall, port, credential, or least-privilege considerations that should be addressed as part of the architecture?
6. High availability: Should we plan for multiple MID Servers or a MID Server cluster for production to avoid a single point of failure?

The objective is to determine the most secure, reliable, and supportable architecture for automating ServiceNow → MID Server → Active Directory group membership.