Step‑by‑Step Guidance Needed: Configuring Cross‑Instance Application Trust

[NarasimhaRC]

Hello ServiceNow Community,

I’m looking for step‑by‑step guidance and best practices to correctly configure Cross‑Instance Application Trust (CIAT) across multiple ServiceNow environments.

Current Environment Setup

• 10 Development instances
• 1 QA instance
• 1 Production instance

We need to securely enable cross‑instance features and integrations, such as:

• AI Platform / future AI capabilities
• Shared or reusable scoped applications
• Controlled data exchange across instances
• Future cross‑instance functionality

Any real‑world advice or lessons learned would be appreciated.
Thanks in advance!

[Tanushree Maiti]

Cross-instance application trust configuration 

Configure Managed Instances 

Configure Manager Instances 

[Pavan Srivastav]

To configure cross-instance application trust in ServiceNow, follow these step-by-step instructions:

1. Understand Trust Concepts:

   • A trust profile defines how a set of instances communicate for a specific application, detailing which instances are trustors (granting access) and trustees (receiving access).
   • Capabilities are application features used for cross-instance communication, managed at the application and capability level ​1️⃣​​2️⃣​.

2. Prepare Multi-Instance Framework:

   • Ensure ADCv2 mTLS is enabled on all instances by checking <instance>.service-now.com/adcv2/supports_tls. If not enabled, submit a Now Support ticket.
   • Install the Multi-Instance Framework mTLS plugin (com.glide.mif.mtls) via Now Support ticket and wait 24 hours after installation ​3️⃣​.

3. Configure Manager and Managed Instances:

   • On each non-production instance, navigate to All > Multi-Instance Management > Manager Instances and create a record pointing to the primary production instance.
   • On the production instance, verify all non-production instances are listed under All > Multi-Instance Management > Managed Instances ​3️⃣​.

4. Create and Edit Trust Profiles:

   • In the production instance, go to All > Multi-Instance Management > Application Trust profiles.
   • Open or create the relevant trust profile for your application.
   • For each non-production instance, add a trust profile item specifying:
     • Capability (e.g., Proactive Code Check Data Transfer)
     • Application
     • Application Capability Version
     • Trusting Instance (non-production)
     • Trusted Instance (production)
     • Set Active to true ​3️⃣​.

5. Sync Trust Profiles:

   • In the production instance, select "Sync Trust Profiles" to propagate trust settings to all managed instances.
   • Verify trust records under All > Multi-Instance Management > Trusting Instances ​3️⃣​.

6. Manage Data Sharing:

   • By default, non-production instances allow data sharing with production only; production does not share by default but can be configured.
   • Adjust sharing permissions as needed in All > Multi-Instance Management > Trust Configuration. Use the "Grant access" column to control which instances can access data for each application ​4️⃣​​5️⃣​.

7. Review and Maintain:

   • The managing instance (usually production) centrally controls trust settings. If no trust profile manager is defined, manual configuration is required on each instance ​1️⃣​​2️⃣​.

For more details, refer to the ServiceNow documentation on cross-instance application trust configuration and multi-instance management

https://www.servicenow.com/docs/r/yokohama/platform-administration/grant-access-v2.html

[Kohei Tominaga1]

Hi @Pavan Srivastav ,

Thank you for this thread — the prerequisite about the mTLS plugin was the most useful lead I've found so far. I'm hitting what looks like the same issue and would appreciate any guidance.

Environment
- Two ServiceNow-provided demo instances (not PDIs), both on the Australia release
- ReleaseOps 2.3.2 installed on both

What happens
- Sending a managed-instance request from one instance succeeds, but the request never appears under Manager Instances on the other (same result in both directions).
- Creating the Manager Instance record manually on the managed side fails with:
"Manager Instance not updated because MIFv2 is not fully configured"
"Invalid insert"
- The application log (source: sn_mif, job: MIF Sync Down Job) shows:
"Trusted Instance not updated because MIFv2 is not fully configured"

What I've checked
- /adcv2/supports_tls returns true on both instances
- sn_mif.glide.mif.exclude_customer_regex = MIF-ENABLE-ALL
- Each instance appears in the other's managed-instance candidate list
- MIF-related system properties have write_roles = maint, so I can't change them as admin
- I couldn't find com.glide.mif.mtls in System Plugins (searched by name and ID), though I understand internally provisioned plugins may not be listed

Questions
1. Can com.glide.mif.mtls be installed on ServiceNow-provided demo instances, or is it limited to customer/sub-production instances?
2. If it can, is a Now Support ticket the only route, and is the 24-hour wait still required after installation?
3. Is there anything else that must be in place for "MIFv2 is fully configured" beyond this plugin?

Any pointers would be much appreciated. Thank you!

[Pavan Srivastav]

1. Can com.glide.mif.mtls plugin be installed on ServiceNow-provided demo instances?

Usually No, because demo instances don’t have the backend cert infrastructure.

→ This plugin is restricted to customer‑owned instances (production/sub-prod) + controlled internal labs.

2. If yes, is a Now Support ticket the only route and 24-hour wait still needed?

✔ Yes, enabling requires ServiceNow Ops backend action → via HI (Now Support). A full security cert generation process takes ~24 hours.

3. Other prerequisites for MIFv2 full configuration:

✔ mTLS plugin active

✔ Transport cert ready and validated

✔ Instance records present and sync jobs enabled

✔ sn_mif.glide.mif.exclude_customer_regex properly configured (you already have MIF-ENABLE-ALL).