--- sourceDocument: Zurich IT Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-service-management Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # DEX Architecture # DEX Architecture {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of DEX Architecture Digital End-User Experience (DEX) architecture delivers a seamless, integrated digital experience using ServiceNow's multi-tenant, cloud-native shared services. This design enables DEX endpoint agents to securely communicate directly with ServiceNow shared services without requiring a MID Server. The shared services manage authentication, message buffering, and stateful stream processing for data sent to your ServiceNow instance and a time series datastore. They also support secure policy updates and on-demand checks on DEX agents, facilitating secure bi-directional communication. Show full answer Show less ## Key Components and Features * **Agent Client Collector (ACC):** Installed on end-user devices (e.g., laptops, VDIs), ACC collects device-level performance and operational metrics. It allows configuring metric collection frequency and can execute remedial actions such as cache clearing or application restarts. * **Browser Extension:** Tracks application performance and network metrics like page load time and jitter, routing data via ServiceNow shared services. * **DEX Desktop Assistant:** Integrates ServiceNow functionalities into user workflows, enabling access to application monitoring, service requests, push notifications, and network tests. ## Agent Registration and Communication After installation, the ACC registers with your ServiceNow instance, downloads necessary certificates, and establishes a secure, bidirectional gRPC connection with the shared services using mutual TLS (mTLS). This encrypted channel ensures secure data exchange, enabling agents to send performance metrics and receive policies or commands. The Hermes Messaging Service and Stream Connect components isolate organizational data within the shared services cluster. ## Security Measures * **Allow Lists:** Agents execute only predefined commands verified by an allow list to prevent unauthorized actions. * **Certificate Signing:** Plugins and scripts are signed to ensure integrity and prevent deployment of malicious code. * **Role-Based Access:** Actions and data access are controlled by specific ServiceNow roles, ensuring users operate only within their permissions. * **Audit Trails:** All remedial actions are logged for transparency and compliance. * **Data Isolation:** Data is segmented per organization using client certificates, and communication is secured with elliptic curve cryptography. ## Data Handling and Retention Collected raw metrics are stored in the ServiceNow instance for up to seven days, while aggregated metrics are retained longer to support trend analysis. Hermes Messaging Service holds data for 36 hours by default during transit. Access to DEX data is restricted to users with appropriate roles, aligning with standard ServiceNow data governance practices. ## Practical Benefits for ServiceNow Customers * Enables comprehensive monitoring of end-user device and application performance without complex infrastructure like MID Servers. * Ensures secure, scalable, and isolated data communication between endpoints and your ServiceNow instance. * Supports proactive remediation and policy enforcement directly on endpoints, enhancing operational efficiency. * Integrates smoothly into existing workflows with the DEX Desktop Assistant and browser extension. * Provides robust security and compliance through certificate management, role-based access, and auditing. Digital End-User Experience (DEX) architecture provides a seamless and integrated digital experience for end users. DEX uses a set of new multi-tenant, cloud-native services called ServiceNow shared services. In this architecture, DEX endpoint agents are able to communicate with the ServiceNow shared services without a MID Server. ServiceNow shared services provide authentication to DEX agents and enable message buffering and stateful stream processing of data sent to your ServiceNow instance and a time series datastore. ServiceNow shared services also enable a secure way to send policy updates and on-demand execution of checks on the DEX agents. Thus, ServiceNow shared services enable secure bi-directional communication between your ServiceNow instance and the DEX endpoint agents. Figure 1. DEX architectural diagram ## Binaries installed on endpoints {#dex-architecture__section_hjt_3sg_3fc} * Agent Client Collector (ACC): Deployed onto the end-user device endpoints such as a laptop or Virtual Desktop infrastructure (VDI) to collect various device level performance and operational metrics. ACC enables you to do the following: * Configure a policy frequency to control what metrics are collected and the frequency of collection. To learn more about the metrics collected by DEX, see [View collected metrics with Metrics analyzer](https://www.servicenow.com/docs/FUEa827R6Ls1QnCkl7p0sQ "Use the Metrics analyzer to view metrics collected for a given device or application during a specific time."). * Get the agent run remedial actions on the endpoint, such as clearing cache, restarting an application, and many more. {#dex-architecture__ul_vf4_lsg_3fc} * Browser extension: Helps track application performance and network metrics like page load time and network jitter. The communication between the browser extension and ACC, as well as the device and application metrics, are routed via the ServiceNow shared services. For more information, see [Enable DEX browser extension](https://www.servicenow.com/docs/1~T2Ihny3N8FkycQLYsUwg "Activate the DEX Chrome or Edge Extension on your system to collect different operational or performance-based metrics for the web applications."). * DEX Desktop Assistant: Enables employees to incorporate ServiceNow functionalities into their daily workflow, providing access to monitoring local applications, requests, and push notifications and to performing network tests. {#dex-architecture__ul_jqy_tsn_3fc} ## Agent registration highlights {#dex-architecture__section_fbs_czl_fxb} * After the installation, ACC is registered on your organization's ServiceNow instance and the required certificates are downloaded from the instance. All the communication between ACC and your instance happens over secured HTTPS. * After the ACC registration, a connection with the ServiceNow shared services is established. The agent is authenticated with the shared services via the downloaded certificates. * ACC opens a bi-directional communication with the ServiceNow shared services using gRPC Remote Procedure Calls (gRPC) connection. gRPC connection is a secure and encrypted channel to send and receive data from the endpoints. The channel is secured via mutual Transport Layer Security (mTLS). * ACC sends various devices and application performance metrics to the shared services. * The instance also pushes data, such as DEX policies, to the agent via this bi-directional channel. * The ServiceNow shared services use the ServiceNow Hermes Messaging Service and Stream Connect to isolate your organization's data. For more information, see [Hermes](https://www.servicenow.com/docs/access?context=hermes-messaging-service&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) and [Stream Connect](https://www.servicenow.com/docs/access?context=stream-connect-quick-start&version=zurich&pubname=zurich-integrate-applications&ft:locale=en-US). * Raw metrics collected from endpoints are processed further using the shared services and eventually pushed to your ServiceNow instance. * In addition, some of the configuration device metrics and agent heartbeats are directly pushed to the ServiceNow instance. The operation is performed over a secured HTTPS channel via a REST endpoint. {#dex-architecture__ul_etg_tvg_3fc} ## Data security {#dex-architecture__section_kgg_wzg_3fc} There are various security measures to promote that the scripts are run securely. * Allow list: File shipped along with the agent verifying that no command other than the ones in the allow lists can be executed.For more information on the list, see [Generate an Agent Client Collector allow list](https://www.servicenow.com/docs/access?context=acc-generate-allow-list&version=zurich&pubname=zurich-it-operations-management&ft:locale=en-US). * Plugins certificate signing: The scripts are packaged in plugins which are deployed to the endpoint. To promote data integrity, the plugins can be signed by a certificate so that there are no malicious plugins deployed.For more information on certificate signing, see [Secure a custom plugin with a certificate](https://www.servicenow.com/docs/access?context=acc-self-sign-certificate&version=zurich&pubname=zurich-it-operations-management&ft:locale=en-US). * Role-based access: All actions are available to only specific roles and user criteria within ServiceNow. For example, advanced actions can be assigned to the DEX engineer role and basic actions to the Service Desk. For more information, see [Configure the Remedial Actions Framework](https://www.servicenow.com/docs/74kKPkKuRdposiT1Vtx1Cg "Configure the Remedial Actions Framework to add a new remedial action or modify an existing one."). * Audit: All action runs are audited in the Remedial Action Executions table (ssn_reacf_remedial_action_execution).For information about emergency plans (such as notification and restore the service), see [DEX subscription](https://www.servicenow.com/docs/_DRLeNAGltwTtca8Y7dwEQ "Digital End-User Experience (DEX) license counting provides the Subscription Unit (SU) consumption counting computers where any of the DEX features (Desktop Assistant, Application and Device Health, and DEX Content Playbook) are active."). {#dex-architecture__ul_jvm_15n_3fc} ## Data isolation {#dex-architecture__section_sym_zxg_3fc} Your data is stored in a separate topic when the Hermes Messaging Service and Stream Connect persist in the file system while data is sent and received. The agent client certificate issued by your ServiceNow instance holds the instance name for your organization. After the agent is authenticated, the instance name from the agent certificate is used to keep data isolated within a shared services cluster. mTLS is used for a secure communication between the agent and server components. The agent authenticates itself using a client certificate with the following parameters: * Public Key Algorithm: id-ecPublicKey (ECDSA) * Key Size: 256-bit * Elliptic Curve: NIST Curve P-256 {#dex-architecture__ul_p3p_pbh_3fc} The setup promotes strong encryption and efficient key exchange using elliptic curve cryptography. Agent assets and plugins (like DEX) that are downloaded from your ServiceNow instance through the shared services are signed by ServiceNow or the asset owners during their release. Signing promotes the authentication and integrity of the agent's asset or plugin to the agent. ## Data access {#dex-architecture__section_xrc_3zg_3fc} All collected data is transformed and presented on your ServiceNow instance. Any data collected in the context of DEX is visible to users only with appropriate DEX roles. For more information about the DEX roles, see [Installed with DEX](https://www.servicenow.com/docs/Vz54fEIX9Q_Wpv2DA3lEJg "Several types of components are installed with activation of the DEX application [sn_dex] plugin, including user roles and tables."). When following the standard ServiceNow practices on data governance, no special handling is required for DEX. ## Data retention {#dex-architecture__section_rk2_1zg_3fc} All the raw metrics collected from devices are stored in the ServiceNow instance for a maximum of seven days. Aggregated metrics are stored for a longer duration based on the type of aggregation. Aggregation metrics are used to show trend lines for various metrics. Hermes Messaging Service stores data for 36 hours by default. No other ServiceNow shared services store any metric data in transit.