---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Basic authentication restriction

# Basic authentication restriction {#ariaid-title1}

Release version: Australia  
Updated June 18, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Basic authentication restriction

Basic authentication restriction is a security feature in ServiceNow that controls which user accounts can use basic authentication on an instance.
It enables administrators to review identified users and make per-account decisions before enforcement begins, enhancing security by limiting unauthorized basic auth access.
Show full answer Show less  

## Managing Basic Authentication Access

Administrators access the Basic Auth Restriction page (under All \> Basic Auth Restriction \> Properties) to review accounts identified for basic authentication use. This page is read-only by default and requires the **securityadmin** role to make changes.

For each identified user, administrators can select one of the following actions:

* **Maintain current login:** Allows both API and UI basic auth logins by granting the `sncbasicauthapiaccess` role.
* **Revoke Basic Auth API login:** Blocks API login but allows UI login without granting the exception role.
* **Convert to web service access only account:** Permits basic auth API login but blocks UI login, converting the account to web service access only.
* **Apply default from system property:** Applies the global default decision configured in `glide.authenticate.basicauth.restriction.defaultdecision`.

## Enforcement Configuration and Behavior

Administrators can configure when enforcement begins and adjust related schedules. Enforcement controls whether basic authentication requests are blocked or tracked:

* **Tracking mode:** Basic auth usage is logged but not blocked.
* **Enforcing mode:** Blocks basic auth requests unless the account is explicitly allowed.

Allowed requests during enforcement include those from accounts with:

* Web Services Access Only (WSAO) status
* A valid multi-factor authentication (MFA) one-time password
* The `sncbasicauthapiaccess` role

## Feature Controls

The Basic Auth Restriction page provides several toggles and settings to control the feature's behavior:

* **Default value:** Sets the default decision for new exceptions during the tracking period.
* **Feature toggle:** Enables or disables the entire basic authentication restriction feature. Disabling this acts as an emergency stop without altering other settings.
* **Enforcement toggle:** Activates enforcement of restrictions. If turned off, basic auth requests are tracked but not blocked.

These controls allow ServiceNow administrators to carefully manage and phase in basic authentication restrictions, improving security posture while minimizing disruption.  
Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.
The Basic Auth Restriction page provides guidance on available actions and controls the enforcement configuration. Administrators are prompted to review the identified users and take action before the enforcement period begins.  
Important:  
The Basic Auth Restriction page is read-only based on its protection policy. The `security_admin` role is required to make any changes.

Navigate to AllBasic Auth RestrictionProperties to open the page.

## Actions available for identified users {#basic-auth-restriction__bar-take-action}

Review the Identified Users table and set a decision for
each account. The following decisions are available:

Maintain current login --- Basic Auth API and UI login allowed
:   The `snc_basic_auth_api_access` role is granted to the
    account. Basic authentication access continues when enforcement
    begins.

Revoke Basic Auth API login --- Basic Auth API login blocked and UI login
allowed
:   The account is not granted the exception role. Basic auth access fails
    when enforcement begins.

Convert to web service access only account --- Basic Auth API login allowed
and UI login blocked
:   The account is converted to a web service access only account. The account can't make UI logins, but basic authentication continues to work past the enforcement period. No roles are assigned.

Apply default from system property
:   Basic auth access is granted or denied based on the decision configured in
    the global property
    `glide.authenticate.basic_auth.restriction.default_decision`.
    Review or change this on the property page.

Administrators should also review and adjust the start of the enforcement period
from the enforcement schedule job.

## How enforcement works {#basic-auth-restriction__bar-how-enforcement-works}

Once enforcement is enabled, basic authentication requests are blocked unless the
requesting account matches one of the following:

* Accounts having Web Services Access Only (WSAO).
* Accounts presenting a valid MFA one-time password.
* Accounts having the `snc_basic_auth_api_access` role.

## Basic Auth Restriction settings {#basic-auth-restriction__bar-settings}

The Basic Auth Restriction page includes the following configurable
settings:

Default value
:   The default decision applied to new rows in the Basic Auth Exception table
    during the tracking period. Per-row decisions in the Basic Auth Exception
    table override this default.

Feature toggle
:   A feature toggle for the Basic Authentication restriction feature on the
    instance. When unchecked (false), no enforcement occurs regardless of the
    value of `glide.authenticate.basic_auth.restriction.enforce`.
    Use this as an emergency disable to halt the feature without changing other
    settings.

Enforcement toggle
:   Controls whether enforcement is active. When unchecked (false), accounts
    using basic authentication are recorded but no requests are blocked ---
    tracking mode. When checked (true), basic authentication requests are blocked
    unless the requesting account is on the allow-list --- enforcing mode. Has no
    effect when the feature toggle is set to false.

*[\>]: and then