---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Account recovery (ACR)
# Account recovery (ACR) {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Account recovery (ACR)
Account Recovery (ACR) in ServiceNow enables administrators to bypass Single Sign-On (SSO) login issues such as misconfigurations or expired certificates by using self-service recovery capabilities.
This feature is essential for maintaining administrative access when SSO is enabled, as it disables local username/password logins unless ACR is configured and enabled.
Show full answer Show less
## Key Features
* **Bypass SSO login:** Allows administrators to log in without SSO to resolve authentication or configuration issues.
* **Self-service recovery:** Supports administrators in addressing recovery scenarios independently, reducing downtime and reliance on external support.
* **Security:** Minimizes unauthorized access by requiring administrators to register with a local password and multi-factor authentication (MFA) before enrolling as ACR users.
* **Policy enforcement:** Restricts local logins once SSO and ACR are enabled, governed by the SSO - ACR Context authentication policy.
## Setup Requirements
### Fresh Instance
* Activate the Multi-SSO plugin (com.snc.integration.sso.multi.installer).
* Enable ACR using the system property **glide.sso.acr.enabled** (enabled by default).
* Enroll at least one administrator as an ACR user before enabling the Multi-SSO property (**glide.authenticate.multisso.enabled**).
* Administrators must set a local login password and register MFA before enrollment.
### Upgraded Instance
* Activate the Multi-SSO plugin.
* Manually enable ACR (**glide.sso.acr.enabled**).
* Enroll administrators as ACR users before enabling Multi-SSO.
* Set local passwords and register MFA for administrators prior to enrollment.
## Configuring Account Recovery Users
At least one administrator must be configured as an account recovery user to activate SSO on the instance. Without this, SSO cannot be enabled. For upgraded instances already using SSO, the system continues functioning without a configured recovery user, but enrollment is recommended for security and recovery purposes.
## Configuration and Management
ACR is part of the Integration - Multiple Provider Single Sign-On Installer plugin and is enabled by default. Administrators can customize ACR behavior and related settings through system properties. The authentication policy context **SSO - ACR Context** manages login restrictions and recovery workflows.
## Practical Benefits for ServiceNow Customers
* Ensures continuous administrative access even when SSO experiences issues.
* Improves security by enforcing MFA and password setup for recovery users.
* Streamlines recovery processes, reducing downtime and administrative overhead.
* Provides clear configuration steps for both fresh and upgraded instances to implement ACR effectively.
Administrators can configure account recovery (ACR) to perform recovery activities such
as addressing SSO misconfiguration or expired certificates.
Note:
Enabling ACR disables the local interactive log-ins (username or password based) when SSO is enabled to your instances.
ACR provides the following capabilities:
* Bypass your single sign-on (SSO) login to address issues with SSO configuration as an administrator.
* Log in with using SSO to perform tasks with an administrator account configured as an account recovery.
* ACR flows enable the administrators to use self-service capabilities to address account recovery when there's a need for recovery, for example, SSO miss-configuration, expired certificates.
* Reduce unauthorized access to the instance and provide a strong foundation to use ACR outside SSO use cases.
{#sso-acct-recovery__ul_h42_vwq_jrb}
## Fresh Instance {#sso-acct-recovery__section_hmk_tv5_prb}
For a fresh instance to use ACR, you must do the following:
* Activate Mutli-SSO plugin (com.snc.integration.sso.multi.installer)
* Enable ACR (glide.sso.acr.enabled) - This is enabled by default in case of a fresh instance.
* Before enabling SSO property (glide.authenticate.multisso.enabled), the administrator must enroll as an ACR user.
Note:
Setting this property to false will not disable multi-provider SSO if Account Recovery (ACR) is also enabled on the instance. To log in with a username and password ACR must also be disabled using the glide.sso.acr.enabled property. For details on this property see [Account recovery properties](https://www.servicenow.com/docs/HKmbcN8VvLObQSu77EIdCA "Use system properties to configure Account Recovery (ACR) on your instance.").
* Administrator must set a password for local login and register MFA before enrolling as an ACR user.
{#sso-acct-recovery__ul_hkw_wxq_jrb}
## Upgraded Instance {#sso-acct-recovery__section_gmz_5v5_prb}
For an upgraded instance to use ACR, you must do the following:
* Activate Mutli-SSO plugin (com.snc.integration.sso.multi.installer)
* Enable ACR (glide.sso.acr.enabled)
Note:
In case of upgraded instance, the administrator must enable ACR.
* Before enabling SSO property (glide.authenticate.multisso.enabled), the administrator must enroll as an ACR user.
* Administrator must set a password for local login and register MFA before enrolling as an ACR user.
{#sso-acct-recovery__ul_vkq_t22_krb}
## Configure account recovery users {#sso-acct-recovery__section_zwg_dcc_gqb}
To use account recovery, you must register at least one admin account as an account recovery user. Single sign-on can't be activated on your instance until there is at least one account configured. For details on this process, see [Configure an account recovery user from the Account Recovery Properties page](https://www.servicenow.com/docs/7e9JO7EaLobD_cQVYEWrCw#config-acct-recovery "Configure an account recovery from the Account Recovery properties page.").
Note:
If you're upgrading an instance already using single sign-on to Rome or a later release, single-sign on will continue to function without a recovery user configured.
## Account recovery configuration {#sso-acct-recovery__section_xz5_b2c_gqb}
The account recovery feature is included with the Integration - Multiple Provider Single Sign-On Installer (com.snc.integration.sso.multi.installer) plugins. The
feature is enabled by default. You can change this and other account recovery settings using
system properties. For details on these properties, see [Account recovery properties](https://www.servicenow.com/docs/HKmbcN8VvLObQSu77EIdCA "Use system properties to configure Account Recovery (ACR) on your instance.").
## Account recovery policy context {#sso-acct-recovery__section_cyh_sfc_gqb}
After you've registered an account recovery user and enabled single sign-on (SSO), your
instance restricts all local logins. This restriction is defined in the SSO - ACR Context auth policy context. For more information about the context, see [Account recovery context](https://www.servicenow.com/docs/XJXEfPbe6viY61MtrjcRwQ "The account recovery context uses a policy to define how and when the account recovery can be established.").
For details on how authentication policies and policy contexts, and how they work on your
instance, see [Adaptive authentication](https://www.servicenow.com/docs/CZ1~TzEChB9sygj2Nrp~gg "Use the Adaptive authentication policy framework to enforce contextual authentication controls to the right users at the right time. Adaptive authentication uses authentication policies to evaluate authentication requests and then either deny or allow access to your instance based on the specified policy conditions.").