---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Explore ZTA
# Explore Zero Trust Access {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 3 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Explore Zero Trust Access
Zero Trust Access (ZTA) is a security model that enforces strict identity verification and risk assessment before granting access to applications and data.
It operates on a least privilege basis, ensuring no user or device is trusted by default.
This helps organizations minimize unauthorized access and data breaches by dynamically adjusting user privileges based on various risk factors.
Show full answer Show less
## Key Features
* **Policy Based Session Access:** Enables dynamic reduction of user privileges during a web session based on factors such as IP address, location, authentication method, user role, group membership, multi-factor authentication (MFA) status, and Identity Provider (IDP) attributes.
* **Adaptive Authentication Integration:** Allows configuration of policies that adapt user access depending on risk parameters at login.
* **Session Enforcement:** ZTA policies apply only at login; changes in risk parameters during an active session do not alter access until the user logs out and logs back in.
* **Role Management:** Roles like `sncinternal` and `sncexternal` cannot be removed by ZTA. The feature doesn't remove roles from user or group assignments but limits session privileges accordingly.
* **Mobile Support:** Session Access policies can be applied within Adaptive Authentication for mobile sessions by enabling specific system properties and configuring refresh token intervals to control session access effectively.
## Practical Considerations for ServiceNow Customers
* **Configuration Requirements:** Only users with the `securityadmin` role can configure Session Access policies. Role elevation is required to perform these configurations.
* **Limitations:** Session Access settings do not affect ongoing sessions or sessions without the reduced or limited roles assigned. Also, it does not support integrations.
* **Use Cases:** Typical scenarios include reducing privileges for users accessing from untrusted networks or devices, such as limiting a fulfiller role user to requester privileges when logging in outside trusted locations.
* **Risk-Based Access Control:** Multiple conditions and role or group assignments can be combined in policies to tailor access precisely to organizational security requirements.
## Benefits
Implementing Zero Trust Access on ServiceNow instances empowers organizations to enhance security posture by minimizing excessive privileges, especially in risky access scenarios. This reduces potential attack surfaces and helps meet compliance requirements by enforcing least privilege access dynamically based on contextual risk factors.
Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.
ZTA ensures that all access to applications and data is granted on a least privilege basis, only after the user's identity verification and risk assessment.
## Zero Trust - Policy Based Session Access {#explore-zero-trust-access__section_g3z_1cs_zxb}
ServiceNow Zero Trust - Policy Based Session Access (Session Access) enables organizations to dynamically reduce user privilege in a web session based on a variety of factors, including IP address, location,
authentication method, user's role, group, user having MFA and attributes shared by the Identity Provider (IDP). This can help protect organizations from unauthorized access and data breaches, even when high-privileged users access
applications from untrusted devices or locations.
It enables the security admins to reduce or limit user access in a session based on IP address, location, Identity Provider attributes, and user attributes using adaptive authentication policies.
Note:
* Session Access configurations can only be performed with security_admin role. You must elevate your role to security_admin.
* Session Access doesn't support integrations.
* Session Access has no impact if the reduced or limited role isn't assigned to a user. In this case, there are no changes to the logged in session. The user continues to access the instance with the assigned privileges.
* Session Access has no impact while the user is already logged in to the instance and simultaneously the admin configures the policy. The user has to log out from the session for the policy to be effective.
* Session Access has no impact when the user is in a trusted network and later switches to a VPN (change in location or network) within a session.
* Session Access is enforced at the time of login. Any change in risk parameters during the session won't result in reduced access. For example, a user switching from the corporate network to an untrusted network after establishing the session won't result in reduced access unless the user logs out and logs in again.
* Session Access (Zero trust access - ZTA) feature, roles like snc_internal and snc_external cannot be removed.
* Session Access (Zero trust access - ZTA) feature does not remove a role from the sys_user_has_role or the user group membership table. Based on the ZTA policy, it establishes the user session with reduced or limited roles.
* The scripts running in the system context will not honor the ZTA session roles.
{#explore-zero-trust-access__ul_kcm_4vj_qxb}
## Use case {#explore-zero-trust-access__section_nbs_3q2_twb}
Following are some of the use cases of Zero Trust Access:
* Reduce privileges based on the risk associated with the session. For example, a fulfiller role user logging from outside the trusted network can be configured to have only the requester role for the session.
* Reduce access based on IDP response for a user session, if the user is using an untrusted device. For more information, see [Configure Identity Provider attribute for Session Access](https://www.servicenow.com/docs/Xlz~vOw~Yhv219AG5MXYnw "Use Identity Provider (IDP) attribute created from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) for removing or restricting user session access to the instance.").
{#explore-zero-trust-access__ul_mmn_pq2_twb}
This role relegation ensures that the user doesn't have any other existing privileges in a session. When the user is logging in from a trusted network, all the existing privileges are assigned for a session.
Multiple IP conditions and multiple role or group assignments can be defined as part of the policy.
## Zero Trust Access - Mobile {#explore-zero-trust-access__section_v5q_dzv_3zb}
You can use the Zero Trust Access - Session Access policy within the Adaptive Authentication policy to reduce the roles or privileges of the particular session in mobile.
Zero Trust Access - Session Access mobile can be enabled by enabling the glide.authenticate.session_access.mobile.enabled from the system properties table.
To use Zero Trust Access - Session Access mobile with the IDP attributes you can configure the glide.authenticate.session_access.mobile.refresh_token_interval field. This enables the administrators to
effectively control the session access based on refresh token.
For more information, see [Configure Zero Trust Access for mobile](https://www.servicenow.com/docs/access?context=configure-zero-trust-access-mobile&version=brazil&pubname=brazil-mobile&ft:locale=en-US).