Hi Ed, This will change by customer. My suggestion is to keep it simple and slowly refine it. Start with the unauthorised change event, and ensure the change manager understands the process to be followed when an unauthorised change is detected.  See...

Check: https://docs.servicenow.com/bundle/orlando-it-operations-management/page/product/discovery/concept/c_DataCollectedByDiscovery.html   This tells you what data is collected and where it is put in each CI class. Depending on what you are discover...

Check out https://docs.servicenow.com/bundle/quebec-it-service-management/page/product/change-management/concept/unauthorized-change-request.html  also note, you can set up ServiceNow to run discovery when a change is implemented. https://docs.servic...

Check table em_unique_nodes, where the "type" is "unknown" If a EM raises a event, and the CI in the event does not exist in ServiceNow it will create a CI in the system, given SN does not know the class for the CI, it auto assumes this CI will consu...

When you log into the MID are you using the same user that the mid server service is using to test this? I suspect you are using an admin account that has more access