This is a 4 part series
- Setting Up Our Test Azure & ServiceNow Accounts
- Preparing our ServiceNow Personal Developer Instance
- Adding ServiceNow Enterprise Application & Initial Setup
- Configure Azure SSO & Provisioning (this article)
We’ve reached the end, and this is where the magic happens. So far we’ve prepared out ServiceNow instance, configured Azure for the users and groups that we want provisioned, and all that is left is to connect the two systems together!
To start out, make sure you’re in your Azure tenant and go to Single Sign-On in the left sidebar, and you’ll be met with three options as shown below, you’ll want to choose SAML.
Now click on Edit to the right of step one and populate the corresponding values as I have them outlined below and click Save.
Note: Make sure to replace <instancename> with your respective PDI instance name.
- Identifier (Entity ID): https://<instancename>.service-now.com
- Reply URL: https://<instancename>.service-now.com/navpage.do
- Sign on URL: https://<instancename>.service-now.com/navpage.do
- Logout URL: https://<instancename>.service-now.com/navpage.do
Next, scroll to step 4 and choose “View step-by-step instructions”. You’ll see that this process is now able to be configured automatically rather than manually as show in Microsoft documentation. This is where your user account for the Azure integration we created in step 2 will come into play. Enter your instance name (should auto populate for you, the username and password for your integration user, ensure “Make this the default identity provider for ServiceNow” is checked and click Configure Now. After a moment, you’ll see a success message.
Note: If you receive an error make sure you provided admin role to the integration user you are using.
The final step is to turn provisioning on. To do this, choose provisioning from the left sidebar within Azure and choose Get started.
Provisioning mode will be Automatic and once more you’ll be prompted for your admin integration user credentials. Input your credentials and click Test to ensure they are accepted and then click Save. Next refresh your screen and you’ll see Provisioning Status which is set to off. Toggle this on and click save.
For the sake of this tutorial I am not going to be covering mappings, but I will be making a follow up going into detail on this aspect of the integration.
Now that provisioning is turned on, return to the Provisioning screen and click Start provisioning.
Once you do so, depending on the amount of groups and users you provision, you may see this complete instantly (as in my case with 1 group and 4 users). I’ve seen it take about an hour for larger enterprises.
At this point, you can go to your instance and login with SSO using one of the users you provisioned. You may notice that it does not automatically go to SSO login - this is normal. To change this, go to the Microsoft Azure Federated Single Sign-on for MSFT Identity Provider under Multi-Provider SSO > Identify Provider and click the “Set as Auto Redirect IdP” related link.
At this point, you’re finished! Pat yourself on the back! Azure automatic provisioning occurs every 40 minutes for subsequent automatic cycles so any changes you make now - adding new users, groups, changing a user’s properties, will update within the ServiceNow environment on the next cycle.
If you have any questions, don't hesitate to comment, reach out directly, or connect with me on LinkedIn and I'll be happy to help!
