Restrict Service-Now Access on Non-Company Devices

[Bilal Ahmed]

Hello,

Is there a way in Service-Now to restrict access to company devices only e.g. domain joined devices etc. Currently our URL is accessible on the public network from any device.

[Ian Mildon]

This is not something I've ever tried but it sounds like you are wanting to query the connecting device to see if it exists in your CMDB.

One thing I can think of that might be worth investigating further is Installation Exits (these two links can give more details):

Redirecting user logons

Installation exits | ServiceNow Docs

[mrkesu]

I am going to make an assumption that you are running Active Directory.

If you don't already have Azure AD then I would suggest to get on that, because you can achieve everything you want through that (with ServiceNow and any other application that they support, which is a huge list.)

Basically, you'd set up Single Sign-On for ServiceNow through Azure AD, then you can set up conditional access.

With Conditional Access you can set up device compliance verification like patch-level, settings, ad-joined etc. but you can also set up Two-Factor, so for example if you have some users that need to be able to access on "any" device then they could get Two-Factor (or no conditional access at all), while the rest of your organization could have basic ad-joined verification.

[Bilal Ahmed]

Thanks Mrkesu,

We have both AD and Azure AD and seems like this is the only option we have for now. One caveat is, we use ADFS for SSO and not Azure AD. Do you know if there is a way to use ADFS for SSO with Azure conditional access?

[mrkesu]

Unfortunately I'm not sure about that. I'm not the AD or Azure admin, so it's a bit outside my expertise.

[Bilal Ahmed]

Hi All,

I am also thinking about doing something different and would appreciate if someone can confirm if this is possible.

Current our service-now URL is https://<companyname>.service-now.com. I read that we can use a custom URL on our own domain e.g. https://servivenow.companydomain.com. Is this true?

If this is true, I also read, each URL has a dedicated VIP (IP address) from service-now side. Is this true?

Again, if above are true, can I use my internal DNS to add a record for this custom URL against dedicated VIP. In this way, this will only be resolved internally and access from outside of our network will be restricted automatically. 

Can someone please confirm if this is possible?