---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure

# Configuring Cloud Account Management {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configuring Cloud Account Management

Configuring Cloud Account Management in ServiceNow involves a series of essential setup tasks tailored separately for AWS and Azure environments.
These configurations must be completed before creating and provisioning service accounts to ensure streamlined management, security, cost control, and governance of cloud accounts.
Show full answer Show less  

## Key Features for AWS Configuration

* **Root Email Setup:** Establish a single AD email alias across AWS accounts to enhance security and collaboration.
* **IAM Account Creation:** Create a centralized IAM user in AWS for managing multiple accounts efficiently via CloudFormation.
* **Account Suspension via Service Control Policy (SCP):** Implement SCP to block new resource creation, controlling overspending while retaining existing resources.
* **Provisioning Options:** Configure Terraform with GitHub for automated account creation or use the cloud native interface as an alternative.
* **Populating Dependent Tables:** Import cloud organization structures and subscription accounts using discovery schedules and connectors.
* **Provisioning Modes Setup:** Manage provisioning flexibility through Terraform API keys or cloud native interface credentials within ServiceNow.
* **Scan Configuration for Data Visualization:** Enable scanning of account violations for visualization based on defined policies.
* **Group Membership Management:** Assign members to appropriate groups to control permissions for account request, approval, provisioning, and certification processes.
* **Cloud Workspace Configuration:** Prepare configurations before creating, suspending, or scanning accounts.
* **Certification Policy Review:** Certify all cloud service accounts regularly (default every 90 days) and customize certification policies as needed.
* **Request Policy Review:** Maintain consistent cloud account request workflows by regularly updating request policies.

## Key Features for Azure Configuration

* **Account Suspension Setup:** Configure permissions and credentials to enable suspension or reactivation of Azure accounts.
* **Azure Service Principal Credential Setup:** Use Azure credentials to create suspension profiles and manage account lifecycle actions.
* **Cloud Native Interface Configuration:** Prepare cloud native interface accounts for provisioning (not needed if using Terraform).
* **Populating Dependent Tables:** Import Azure organization structures and subscription accounts using discovery schedules.
* **Scan Configuration for Data Visualization:** Enable scanning of account violations to support data visualization based on policies.
* **Group Membership Management:** Assign appropriate group memberships to control permissions for account lifecycle processes.
* **Cloud Workspace Configuration:** Set up necessary configurations prior to account management activities.
* **Certification Policy Review:** Regularly certify cloud service accounts post-discovery and customize policies to fit organizational needs.

## Practical Impact for ServiceNow Customers

By following these configuration steps, customers can centrally manage cloud accounts with strong security controls, cost management, and governance. Proper setup ensures efficient provisioning through Terraform or cloud native interfaces, accurate discovery of cloud resources, and effective account lifecycle management including suspension, certification, and compliance. Assigning correct group permissions safeguards against unauthorized actions, while automated scanning and visualization help maintain policy adherence.  
Configuring the Cloud Account Management application involves a set of required tasks, integrations, and setups to be completed before initiating service account creation and provisioning.
The steps involved are different for AWS and Azure. These configurations are listed in the following tables.
{#configuring-cam__AWS_table__entry__7}

| No. | Task | Task Owner | Impacted Feature | Input | Output | Purpose |
|-|-|-|-|-|-|-|
| 1 | [Set up and verify root email in AWS](https://www.servicenow.com/docs/dkDPGCB9weTt9SgMu7~C3Q "Create a unique email address to manage several accounts. Having multiple accounts and emails can be a significant challenge for an AWS admin. A single AD email for multiple AWS accounts simplifies management.") | Email Admin | Create an account | None | Email Alias | A single AD email across multiple AWS accounts streamlines management, enhances security, and boosts collaboration. |
| 2 | [Set up an IAM account for a ServiceNow user in AWS](https://www.servicenow.com/docs/iCjwTygYXtLVGYGfcukCDQ "AWSCreate an AWS CloudFormation Identity Access Manager (IAM) user in the management account using the CloudFormation template (CFT). This allows you to manage multiple AWS accounts with a centralized IAM user.") | AWS Admin | All features | None | AWS Access Key AWS Secret Key | A centralized IAM user in the management account efficiently manages multiple AWS accounts via a CloudFormation template. |
| 3 | [Set up suspension of an AWS account using service control policy](https://www.servicenow.com/docs/2ckUNBKfsfVlL4HjFDAcFQ "Set up a restriction on cloud account creation. For example, when the account owner isn’t in the organization or if there are budget constraints. Using Cloud Account Management, admin adds the account number to the AWS organization's service control policy, promoting existing accounts to continue to function normally while blocking new account creation.") | AWS Admin | Account suspension | None | SCP Policy ID | Adding an account number to the AWS organization's Service Control Policy blocks the creation of new resources and helps prevent overspending, while existing resources remain unaffected. |
| 4 | [Setting up Terraform and GitHub](https://www.servicenow.com/docs/tXsq_bJbOPTCniTgfwK82g "Simplify cloud account provisioning using Terraform. The workflow provides the basic steps involved in setting up Terraform and GitHub.") Note: This step isn't required if cloud native interface is used for provisioning the account. | Terraform Admin DevOps Admin | Create an account for AWS | AWS Access Key AWS Secret Key | Terraform API Key Token Terraform OAuth Token ID Terraform Org VCS Identifier Terraform URL | GitHub templates deployed to Terraform Cloud or Enterprise streamline account creation and promote consistent configurations. |
| 5 | [Create a cloud native interface account configuration](https://www.servicenow.com/docs/BOZrIqkVEjRhPRVU0XBszw "Configure cloud accounts using the native interface of supported cloud providers like AWS AWS or Azure to enable seamless provisioning and integration.") Note: This step isn't required if Terraform is used for provisioning the account. | ServiceNow AI Platform Admin | Create an account for Cloud Native Interface | None | None | No additional procedure is needed for cloud native interface. You can proceed to [Install Cloud Workspace](https://www.servicenow.com/docs/RaHJbceiZ3EMhl~hlfi1wg "You can install the Cloud Workspace application (sn_itom_cam) if you have the admin role. The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed."). |
| 6 | [Populate Cloud Account Management dependent tables](https://www.servicenow.com/docs/FRPZpwucX07dOyHPgQRUtQ "Provide the required information for cloud account creation and provisioning.") 1. [Create a service account](https://www.servicenow.com/docs/80bSpvxIGAX~ZRrRsn9Ssg "Create a service account in CAM. A service account holds the credential and account information that you created in your provider account. Discovery uses the information to access your provider account and then obtain information on each logical datacenter that is associated with the account.") 2. [Define and run discovery schedule](https://www.servicenow.com/docs/mYowAAV7E0aZiQV7DE3xWA "The discovery schedule is the control point for running discoveries. The schedule controls when discovery runs, defines the MID Server to use, the type of discovery that should run, and the IP addresses to query.") {#configuring-cam__ol_xlt_ghp_tfc} | ServiceNow AI Platform Admin | All features | Discovery Credentials | Cloud Organization AWS Org Unit Cloud Service Account | Cloud Discovery or Service Graph Connector for AWS to import cloud organization structures and create subscription accounts. |
| 7 | [Provisioning modes for Cloud Account Management in Cloud Workspace](https://www.servicenow.com/docs/hysbzcCF3DcrCQqNHnyoPg "Cloud Account Management in Cloud Workspace offers flexible provision modes such as Terraform and cloud native interfaces while centralizing management, enhancing security, optimizing costs, and improving governance.") * [Set up Terraform API key in ServiceNow](https://www.servicenow.com/docs/4WIbLbclc8owddMntOUHhQ "Add the Terraform API key to the ServiceNow instance to ensure consistent and error-free infrastructure provisioning.") * [Set up AWS API configuration information in ServiceNow](https://www.servicenow.com/docs/8mK~vIx8akOjQmi3fYuSCg "The credentials provided by your AWS administrator are used in this procedure to create a suspension profile, enabling you to temporarily suspend or terminate AWS accounts as needed.") {#configuring-cam__ul_nmn_41j_pcc} | ServiceNow AI Platform Admin | Create an account | Email Alias Terraform Cloud API Key Token Terraform Cloud OAuth Token ID Terraform Cloud Org VCS Identifier | None | Streamline provisioning with flexible modes like Terraform and cloud native interface, centralizes management, enhances security, optimizes costs, and improves governance. |
| 8 | [Set up scan configuration for data visualization](https://www.servicenow.com/docs/pBnuSwPc~vF9HQ4JJAjNKw "Visualize all account violations by scanning them using the selected policy set. Display the severity of all violations on the admin dashboard to take appropriate actions.") | ServiceNow AI Platform Admin | Visualization | None | None | Data visualization requires scanning all account violations based on the policy set. |
| 9 | [Add members to the group](https://www.servicenow.com/docs/C_hJJNffzpoT4N~pMfQRWA "Ensure accurate assignment of members to their respective groups to streamline account requests, approvals, provisioning, and certification. Grant necessary permissions through proper group assignment to prevent unauthorized access and maintain security.") | ServiceNow AI Platform Admin | All features | None | None | Confirm that members are assigned to the correct group for them to perform the account request, approval, provisioning, and certification process. Assign members to the correct groups for proper permissions, helping prevent unauthorized access and promoting security. |
| 10 | [Creating configurations](https://www.servicenow.com/docs/VzopcoUQSqxLXCI8b6Jx4g "Setting up the Cloud Account Management app is a prerequisite task before proceeding to create, suspend, or scan a service account. By configuring Cloud Account Management, you can ensure that the application is ready to effectively execute account management tasks and deliver the desired results.") | Cloud Workspace Admin | All features | None | None | Configure before creating, suspending, or scanning accounts. |
| 11 | [Review default Cloud Account Management certification policy](https://www.servicenow.com/docs/zjeUvlWRU12kjMA5RztEhA "Review the default certification policy provided in Cloud Account Management to validate data against the policy set. This default policy certifies all available cloud service accounts every 90 days. Administrators can customize the default policy or create one as needed.") | Cloud Workspace Admin | All features | None | None | Certify all cloud service accounts either created or boarded after discovery can be certified. The admin can also customize the default policy or create a policy. The default policy helps to certify all the available cloud service accounts once every 90 days. |
| 12 | [Review request policies](https://www.servicenow.com/docs/1uwsPF8N7OTFPQbR5v4iBQ "Review and update request policies to confirm they align with your cloud account request process. These policies enforce data checks and conditions, promoting consistency in creating cloud subscription accounts.") | Cloud Workspace Admin | All features | None | None | Request Policies are rules that govern the behavior of request workflows by applying data checks and conditions. Regularly reviewing and updating these policies confirms that your cloud account request process remains consistent with the procedure for creating cloud subscription accounts. |
[Table 1. Configuration steps for AWS]

{#configuring-cam__AWS_table} {#configuring-cam__Azure_table__entry__7}

| No. | Name | Task Owner | Impacted feature | Input | Output | Purpose |
|-|-|-|-|-|-|-|
| 1 | [Configure account suspension in Azure](https://www.servicenow.com/docs/Wy4muoot1F98K7ktYwmBww "Manage an Azure subscription using the permission and by assigning the role to a user. The role must have the permission to execute the APIs for suspending and reactivating an Azure account.") | Azure Admin | Account suspension | None | OAuth Client ID OAuth Client Secret Tenant ID | Configure the permission and assign the permission to a user who suspends or reactivates the account. |
| 2 | [Set up Azure Service Principal credential](https://www.servicenow.com/docs/0s6I1X9cP14po4I1DbxD7A "Provide the Azure credentials obtained from your Azure administrator. These credentials are used to create a suspension profile and enables you to suspend temporarily or terminate Azure accounts as needed.") | ServiceNow AI Platform Admin | All features | OAuth Client ID OAuth Client Secret Tenant ID | None | Provide the Azure credentials obtained from your Azure administrator. These credentials are used to create a suspension profile and enables you to suspend temporarily or terminate Azure accounts as needed. |
| 3 | [Create a cloud native interface account configuration](https://www.servicenow.com/docs/BOZrIqkVEjRhPRVU0XBszw "Configure cloud accounts using the native interface of supported cloud providers like AWS AWS or Azure to enable seamless provisioning and integration.") Note: This step isn't required if Terraform is used for provisioning the account. | ServiceNow AI Platform Admin | Create an account for Cloud Native Interface | None | None | No additional procedure is needed for cloud native interface. You can proceed to [Install Cloud Workspace](https://www.servicenow.com/docs/RaHJbceiZ3EMhl~hlfi1wg "You can install the Cloud Workspace application (sn_itom_cam) if you have the admin role. The application includes demo data and installs related ServiceNow Store applications and plugins if they are not already installed."). |
| 4 | [Populate Cloud Account Management dependent tables](https://www.servicenow.com/docs/FRPZpwucX07dOyHPgQRUtQ "Provide the required information for cloud account creation and provisioning.") 1. [Create a service account](https://www.servicenow.com/docs/80bSpvxIGAX~ZRrRsn9Ssg "Create a service account in CAM. A service account holds the credential and account information that you created in your provider account. Discovery uses the information to access your provider account and then obtain information on each logical datacenter that is associated with the account.") 2. [Define and run discovery schedule](https://www.servicenow.com/docs/mYowAAV7E0aZiQV7DE3xWA "The discovery schedule is the control point for running discoveries. The schedule controls when discovery runs, defines the MID Server to use, the type of discovery that should run, and the IP addresses to query.") {#configuring-cam__ol_swj_h3p_tfc} | ServiceNow AI Platform Admin | All features | Discovery Credentials | Cloud Organization Azure Management Group Cloud Service Account | Cloud Discovery import cloud organization structures and create subscription accounts. |
| 5 | [Set up scan configuration for data visualization](https://www.servicenow.com/docs/pBnuSwPc~vF9HQ4JJAjNKw "Visualize all account violations by scanning them using the selected policy set. Display the severity of all violations on the admin dashboard to take appropriate actions.") | ServiceNow AI Platform Admin | Visualization | None | None | Data visualization requires scanning all account violations based on the policy set. |
| 6 | [Add members to the group](https://www.servicenow.com/docs/C_hJJNffzpoT4N~pMfQRWA "Ensure accurate assignment of members to their respective groups to streamline account requests, approvals, provisioning, and certification. Grant necessary permissions through proper group assignment to prevent unauthorized access and maintain security.") | ServiceNow AI Platform Admin | All features | None | None | Confirm that members are assigned to the correct group for them to perform the account request, approval, provisioning, and certification process. Assign members to the correct groups for proper permissions, helping prevent unauthorized access and promoting security. |
| 7 | [Creating configurations](https://www.servicenow.com/docs/VzopcoUQSqxLXCI8b6Jx4g "Setting up the Cloud Account Management app is a prerequisite task before proceeding to create, suspend, or scan a service account. By configuring Cloud Account Management, you can ensure that the application is ready to effectively execute account management tasks and deliver the desired results.") | Cloud Workspace Admin | All features | None | None | Configure before creating, suspending, or scanning accounts. |
| 8 | [Review default Cloud Account Management certification policy](https://www.servicenow.com/docs/zjeUvlWRU12kjMA5RztEhA "Review the default certification policy provided in Cloud Account Management to validate data against the policy set. This default policy certifies all available cloud service accounts every 90 days. Administrators can customize the default policy or create one as needed.") | Cloud Workspace Admin | All features | None | None | Certify all cloud service accounts either created or boarded after discovery can be certified. The admin can also customize the default policy or create a policy. The default policy helps to certify all the available cloud service accounts once every 90 days. |
[Table 2. Configuration steps for Azure]

{#configuring-cam__Azure_table}