servicenow catalog item to add users to entra security groups

[levino]

Hi there

please advise what is the preferred way to add users to entra security groups via  cat item.

does servicenow need to import users and groups GUIDS from entra int servicenow?

or is there a easier way

is there similar free entra type cloud platform which i can connect my servicenow dev instance to/

Thank You

Levino

[KPNow · Accepted solution]

Hi @levino :

I would say the preferred and industry-standard way to add users to Entra ID security groups via a Catalog Item is using the Microsoft Entra ID Spoke (formerly the Azure AD Spoke) in IntegrationHub paired with Flow Designer. Instead of hardcoding scripts, your Catalog Item triggers a flow upon approval that calls the out-of-the-box "Add User to Group" spoke action.

For GUIDs, no, you do not strictly need to import and store GUIDs inside ServiceNow beforehand. While Microsoft Graph APIs under the hood use GUIDs for mapping, the Entra ID Spoke offers flexible actions and subflows such as Add User to Group using Email Address that allow you to pass the user's userPrincipalName or email directly alongside the target group's display name or email address. That said, if your environment already syncs Entra ID into ServiceNow via SCIM or directory sync, storing the Entra object_id on the ServiceNow user record (sys_user) makes execution faster and more reliable since it bypasses string lookups.

For testing with your ServiceNow developer instance, the best free option is a Microsoft Azure Free Account paired with an Entra ID Free Tenant. Microsoft also offers the Microsoft 365 Developer Program, which provides a fully functional sandbox tenant stocked with sample users and groups (though qualification rules apply). Alternatively, spinning up a standard free Azure account gives you an Entra tenant where you can register an OAuth App, grant it the required Graph API permissions (Group.ReadWrite.All), connect it to your PDI's IntegrationHub, and test catalog-driven group additions end-to-end.