Hi @Alon Grod ,
Yes, you can exempt a specific user from MFA without disabling MFA for the entire instance.
If your instance is Yokohama or later, the recommended OOB approach is to use the MFA Exempted User Group.
Do not disable the global MFA property just for one user.
Recommended steps:
1. Navigate to:
Adaptive Authentication
-> Auth Policy Contexts
-> MFA Context
2. Open:
MFA Context
Verify that the configured policy is:
Enforce MFA for non-SSO logins
3. Open the referenced Authentication Policy.
Under Policy Inputs, verify that the following filter criteria is present:
Is a member of MFA exempted group
This is included in the OOB Yokohama+ MFA enforcement configuration.
4. Open:
User Administration
-> Groups
Search for:
MFA Exempted User Group
5. Add the required user as a member of this group.
For example:
MFA Exempted User Group
-> Members
-> Add
-> <required user>
6. Have the user completely log out and start a new session.
The expected result is:
Username
-> Password
-> Login
without the ServiceNow MFA challenge.
Important:
Starting with Yokohama, ServiceNow enables an OOB MFA enforcement policy for non-SSO local/LDAP authentication.
Because policy-based MFA takes precedence over user-based and role-based MFA settings, simply setting:
Enable Multi-factor Authentication = false
on the sys_user record may NOT exempt the user if the MFA Context policy still requires MFA.
For older instances where MFA is configured only using user-based criteria, you can check:
User Administration
-> Users
-> <User>
Field:
Enable Multi-factor Authentication
and set it to false.
However, for Yokohama and later using the OOB enforcement policy, use the MFA Exempted User Group instead.
Also check whether the user is being required to use MFA by another custom Adaptive Authentication policy. If you have replaced the OOB MFA policy, add the equivalent exemption condition to your custom policy.
I would NOT recommend:
- Setting glide.authenticate.multifactor = false
- Disabling the MFA Context
- Giving the user snc_external only to bypass MFA
- Removing MFA from the entire instance
- Deleting the user's MFA records expecting that to disable MFA
Deleting/resetting the MFA registration only forces the user to register again; it does not exempt the user from an active MFA policy.
Security consideration:
Use MFA exemptions only for a justified exception and preferably avoid exempting privileged accounts such as admin users.
For service/integration accounts, avoid interactive username/password login where possible. Use OAuth or certificate-based authentication instead.
Official ServiceNow references:
MFA enforcement exception:
https://www.servicenow.com/docs/r/platform-security/authentication/faq-mfa-exception.html
MFA Context:
https://www.servicenow.com/docs/r/platform-security/authentication/mfa-auth-context.html
MFA enforcement:
https://www.servicenow.com/docs/r/platform-security/authentication/mfa-enforcement.html
Hope this helps!
If this response helped, please mark it as Helpful.
If it resolves your issue, please Accept it as Solution.
Kind Regards,
Abhishek Pal
