MFA Enforcement for all user performing Local or LDAP authentication

[mickaella_04]

Hi All,

While reviewing the Customer Action: MFA Enforcement for all users performing Local or LDAP authentication, I noticed that the snc_external role/users are currently exempted from MFA enforcement.

Could you help clarify the reason behind this exception? Is there a specific business or technical reason why snc_external users were excluded from the MFA requirement?

I would like to seek help and expertise on which is better to still keep that snc_external is exempted from MFA or we remove it? Can I get a reason why? thanks!

[abbasshaik4]

Hello @mickaella_04,

Please refer to the link's below:
MFA enforcement • Yokohama Platform security • Docs | ServiceNow

OR
https://www.bing.com/ck/a?!&&p=57a6f7139d26ce648a704fc75c5bfda46dd9e9bf40744926e4dd1147a8f0ab56Jmltd...

If it is helpful, please mark it as helpful and accept the correct solution by referring to this solution in the future it will be helpful to them.

Thanks & Regards,

Abbas Shaik

[mickaella_04]

Hi Abbas,

On the KBs you provided, it explained why we need MFA but we want to understand what was the reason why it exempted the SNC_EXTERNAL users. Is there have a reason behind? Thank you!

[Suryansh Verma]

@mickaella_04 

The snc_external exclusion is part of ServiceNow’s default MFA enforcement policy. It allows customers to decide how MFA should be applied to their external populations, because external users may authenticate through local credentials, LDAP, customer identity providers or portal-specific authentication models.

This exemption is configurable and does not mean that external users should always remain exempt. For external users authenticating directly through local or LDAP credentials, MFA should normally be enforced, particularly when they can access customer cases, attachments or sensitive business data. External users authenticating through SSO may remain exempt from ServiceNow MFA where the identity provider already enforces an equivalent MFA control.

The snc_external role itself should not be removed because it is part of the external-user access-control model. Instead, the MFA policy or role-based MFA criteria should be updated to include the appropriate external roles, such as sn_customerservice.customer and sn_customerservice.consumer. Any remaining exemptions should be documented, risk-approved and periodically reviewed.

If it is helpful, please mark it as helpful and accept the correct solution by referring to this solution in the future, it will be helpful to them.