Best practice for Business Portal password reset

sn-ushi · 2 hours ago

Hi Community,

We are using the ServiceNow Business Portal (CSM) for external customers and have a question about the recommended password-reset process.

Current configuration:

Password Reset Process: Default Self Service
Credential Store: Local ServiceNow Instance
Identification: Email Identification
Verification: Email Code Verification
Minimum Verifications: 1
Email/SMS Password Reset URL: Enabled
Redirect URL: Business Portal

Current issue:

Our customers receive an email with a verification code. After entering the code, they receive a second email containing a password-reset link.

Previously, this process worked. However, some customers are now redirected to the Microsoft Entra ID login page instead of the expected password-reset page.

We checked the configuration and found no changes since August.

What we tested:

In our DEV instance, we disabled the Email/SMS Password Reset URL checkbox.

The process now works as follows:

Customer requests a password reset.
Customer receives a verification code by email.
Customer enters the code.
Customer is taken directly to the page to set a new password.
Customer successfully resets the password and logs in to the Business Portal.

The test was successful. However, the Security Score decreased from 72 to 62 after disabling the checkbox.

Our questions:

Is disabling "Email/SMS Password Reset URL" a recommended approach for external customers using the Business Portal?
Is Email Code Verification alone sufficient, or should we configure an additional verification method?
Are other companies using the direct password-reset process without sending a second email?
Are there any security risks or known issues with this configuration?
Would you recommend keeping the checkbox enabled and investigating the incorrect redirect instead?

We would appreciate hearing how others have implemented password resets for external customers and what ServiceNow best practices you recommend.

Thanks in advance!