--- sourceDocument: brazil Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/delta-australia-brazil Release : - brazil ft:locale : - en-US ft:publication_title : - brazil Combined Product Files ft:clusterId : - delta3ba bundleId : - delta3ba --- # Combined Authentication release notes for upgrades from Australia to Brazil # Combined Authentication release notes for upgrades from Australia to Brazil {#ariaid-title1} Release version: Brazil Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 10 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Authentication Release Notes for Upgrades from Australia to Brazil This consolidated release note guide assists ServiceNow customers in upgrading Authentication features from the Australia release to the Brazil release. It highlights new features, changes, deprecations, and important upgrade tasks to ensure a smooth transition while maintaining secure and efficient authentication processes. Show full answer Show less ## New Features * **Policy-Based Login Experience:** Brazil introduces an identifier-first login framework allowing admins to create tailored login policies that present relevant authentication methods based on user context (e.g., username or email), streamlining the user login experience. * **SAML Certificate Expiry Notifications:** The Brazil release adds proactive banner alerts on the homepage for expiring SAML SP signing and encryption certificates, linking directly to remediation actions in Security Center to prevent SSO disruptions. * **Email OTP for AI Voice Agents:** Email one-time passcodes can now be used as standalone, primary, or secondary authentication factors in AI voice agent flows, enhancing security and flexibility when authenticating callers. * **Authenticate Callers at Call Start:** Brazil allows prompting for caller authentication or identification at the very start of every call before the AI voice assistant responds, improving security for voice interactions. * **Workload Identity Federation:** Authenticate outbound connections to Microsoft Azure and Google Cloud Platform using federated identity, eliminating the need to store or rotate client secrets. * **Domain-Level Certificate Validation Exclusion:** Configure SSL/TLS validation policies per outbound endpoint, allowing granular control over hostname verification and certificate checks without affecting global settings. * **RS256-Signed ID Tokens:** The OpenID Provider now issues ID tokens signed with the RSA SHA-256 (RS256) algorithm, enabling OAuth client applications to verify end-user identity more securely. * **Basic Authentication Restriction:** Use a tracking period to identify Basic Auth users then enforce access restrictions via an allowlist, enhancing instance security by limiting Basic Auth usage. * **External Authorization for MCP Clients:** Register external authorization servers (e.g., Microsoft Entra ID, Okta) as trusted token issuers, allowing MCP clients to authenticate with enterprise identity providers without relying solely on ServiceNow authorization. * **Step-Up Authentication for AI Voice Agents:** Require additional authentication challenges (Okta Verify push, SMS code, or TOTP) for sensitive requests, strengthening security in voice agent interactions. ## Key Changes * **OAuth Enhancements (Australia to Brazil):** Options to use opaque or JWT tokens for inbound integrations, and finer scope management for API access. Outbound integrations benefit from resource parameter configuration in OAuth token requests. * **SAML Certificate Expiry Alerts:** Brazil improves the timeliness and detail of expiry notifications for SAML certificates. * **Max Age Parameter Handling:** Authentication requests can specify maxage to enforce reauthentication if the last login exceeds a defined time, aligning with OpenID Connect Core 1.0 standards. * **Knowledge-Based Authentication (KBA) for AI Voice:** KBA is enhanced with automated voice service mappings and configurable base system questions at identification and authentication levels. ## Deprecations and Removals * **Deprecated Australia Configurations:** OAuth API endpoints for external clients and OIDC providers used for verifying ID tokens are deprecated due to new simplified inbound integration configurations. * **Deprecated Properties:** The property glide.login.noblankpassword is deprecated and no longer affects login behavior. * **No removals or deprecations were introduced in the Brazil release.** ## Activation and Requirements * Authentication remains a ServiceNow AI Platform product that is active by default in both Australia and Brazil releases. * No additional browser or platform requirements were introduced in the Brazil release. ## Accessibility and User Experience * The Coral theme continues as the default for new portal, web, and mobile experiences with Next Experience or Core UI enabled, offering brand-neutral illustrations and available dark mode options. ## Practical Benefits for ServiceNow Customers * Enhanced security and user experience through granular login policies and proactive certificate expiry notifications. * Stronger voice authentication capabilities including multi-factor and step-up authentication for sensitive calls. * Improved integration security with workload identity federation and external authorization support. * Greater control over Basic Auth usage, OAuth flows, and certificate validation policies to align with organizational security standards. * Streamlined upgrade preparation with consolidated notes highlighting changes and deprecated features to avoid disruption. Consolidated page of all release notes for Authentication from Australia to Brazil. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Authentication release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Australia to Brazil. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Authentication to Brazil Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-authentication-summary__entry__2} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## New features Between your current release family and Brazil, new features were introduced for Authentication. {#dfrn3-authentication-summary__entry__8} | Release | Release notes | |-|-| | Australia | [Authentication factors for AI voice service](https://www.servicenow.com/docs/access?context=authentication-factors&family=australia&ft:locale=en-US) : Enable caller access to AI voice agents by configuring the required identification and authentication factors. [Web Embeddables](https://www.servicenow.com/docs/access?context=web-embeddables&family=australia&ft:locale=en-US) : Secure the web embeddables feature for authenticating the ServiceNow®'s web components that are used in third-party portals. [Granular admin roles](https://www.servicenow.com/docs/access?context=granular-admin-roles&family=australia&ft:locale=en-US) : The granular admin role enables developers and administrators to complete administrative configuration tasks for Authentication without requiring the full admin role. | | Brazil | [Policy-based login experience](https://www.servicenow.com/docs/access?context=next-gen-login-experience&family=brazil&ft:locale=en-US) : Use the Policy-based experience (identifier-first login) framework in the Authentication Console to craft login policies to simplify the login experience by presenting relevant login methods based on user context, such as username or email. [SAML certificate expiry notifications](https://www.servicenow.com/docs/access?context=c_SAML2.0WebBrowserSSOProfile&family=brazil&ft:locale=en-US) : Receive banner alerts on the home page when SAML SP signing or encryption keystores are approaching or past their expiry date. The instance displays two separate banners --- one for signing certificates and one for encryption certificates --- each linking to a dedicated customer action in Security Center. [Email OTP as an authentication factor](https://www.servicenow.com/docs/access?context=email-otp-authentication&family=brazil&ft:locale=en-US) : Use Email OTP as a standalone factor, a primary factor, or a secondary factor in AI voice agent authentication flows. When a caller reaches the voice agent, a one-time passcode is sent to their registered email address. The caller provides the passcode to complete authentication. Authenticate callers at the start of every call : Prompt callers for authentication or identification details at the start of every call, before the voice-only assistant responds to any request, using the Authenticate at the start of the call option on the Assistant Designer's Caller verification page. [Workload Identity Federation for Microsoft Azure and Google Cloud Platform](https://www.servicenow.com/docs/access?context=workload-identity-federation&family=brazil&ft:locale=en-US) : Authenticate outbound connections to Microsoft Azure and Google Cloud Platform using federated identity. [Domain-Level Certificate Validation Exclusion](https://www.servicenow.com/docs/access?context=outbound-certificate-policies&family=brazil&ft:locale=en-US) : Configure SSL/TLS certificate validation for individual outbound endpoints by creating outbound certificate policies, so you can adjust hostname verification, certificate chain validation, and revocation checking for a specific host without changing the global validation policy for every other endpoint. Issue ID tokens signed with RS256 : Issue ID tokens signed with the RSA SHA-256 algorithm (RS256) from the OpenID Provider. Use the ID Tokens in OAuth client applications to verify end-user identity. [Restrict Basic Authentication access with the Basic Auth Restriction page](https://www.servicenow.com/docs/access?context=basic-auth-restriction&family=brazil&ft:locale=en-US) : Use the Basic Auth Restriction page to strengthen instance security by limiting Basic Authentication access to a defined allowlist. Run the tracking period first to identify users currently relying on Basic Auth, then enable enforcement to block Basic Auth requests that don't match the allowlist. The allowlist covers Web Services Access Only (WSAO) users, SNC users, OAuth ROPC flow users, users presenting a valid OTP, and users granted the snc_basic_auth_api_access role. [Authenticate MCP clients with external authorization servers](https://www.servicenow.com/docs/access?context=mcp-3p-auth-concept&family=brazil&ft:locale=en-US) : Register an external authorization server as a trusted token issuer for the MCP Server by creating an OIDC Provider Configuration that identifies the provider's issuer URI and metadata endpoint. The MCP Server validates a token from a registered provider locally --- confirming the issuer is trusted, the signature is valid, the audience matches, and the token has not expired --- without depending on the ServiceNow authorization server. Tokens from issuers that aren't registered and active are rejected. [Step-up authentication for AI voice agents](https://www.servicenow.com/docs/access?context=step-up-authentication&family=brazil&ft:locale=en-US) : Require a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request, such as a password reset or access to bank account details. Select Okta Verify push notification, SMS verification code, or authenticator app time-based one-time password (TOTP) as the step-up factor on the Assistant Designer's Caller verification page. | [ ] ## Changes Between your current release family and Brazil, some changes were made to existing Authentication features. {#dfrn3-authentication-summary__entry__14} | Release | Release notes | |-|-| | Australia | [OAuth enhancements](https://www.servicenow.com/docs/access?context=api-inbound-and-outbound&family=australia&ft:locale=en-US) : Following are the OAuth enhancements: * Use Opaque or JWT token option for your inbound integration endpoints. * Use the Allow access only to APIs in selected scope option to enable access to the APIs that are explicitly listed in the selected scopes for your inbound integrations. * Use the OAuth Entity Resource tab for outbound integrations to configure resource parameters so they flow into the OAuth token request and are reflected in the token from your OAuth provider. | | Brazil | SAML certificate expiry notification : Receive more timely alerts --- the SAML certificate expiry notification triggers earlier and includes additional detail about affected keystores. Max age parameter handling : Set the max_age parameter in an authentication request to require that the end-user has authenticated within a specified number of seconds. When the elapsed time since the last authentication exceeds max_age, the Authorization Server reauthenticates the end-user. The max_age implementation has been refined to align with the OpenID Connect Core 1.0 specification. KBA for AI voice service : Use the KBA setup to configure Knowledge-Based Authentication (KBA) for the voice channel. Choose from base system questions at both the identification level and the authentication level. AI voice service mappings are populated automatically from your Assistant Designer selection, so manually mapping voice services is no longer a mandatory step in the KBA setup. | [ ] ## Removed Between your current release family and Brazil, some Authentication features or functionality were removed. {#dfrn3-authentication-summary__entry__20} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Deprecations Between your current release family and Brazil, some Authentication features or functionality were deprecated. {#dfrn3-authentication-summary__entry__26} | Release | Release notes | |-|-| | Australia | * Due to the launch of new simplified inbound integration configuration in Machine Identity Console, the following inbound integrations configurations in the Application registry page are deprecated: * OAuth API endpoint for external clients * OAuth JWT API endpoint for external clients * OIDC provider to verify ID tokens * The (glide.login.no_blank_password) property is deprecated, since the property is no longer used and changing this property value doesn't effect login behavior. * OAuth API endpoint for external clients * OAuth JWT API endpoint for external clients * OIDC provider to verify ID tokens | | Brazil | No updates for this release. | [ ] ## Activation information Review information on how to activate Authentication. {#dfrn3-authentication-summary__entry__32} | Release | Release notes | |-|-| | Australia | Activation information : Authentication is a ServiceNow AI Platform product that is active by default. | | Brazil | Activation information : Authentication is a ServiceNow AI Platform product that is active by default. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Authentication we have noted them here. {#dfrn3-authentication-summary__entry__38} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Authentication we have noted them here. {#dfrn3-authentication-summary__entry__44} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Authentication, such as specific requirements or compliance levels. {#dfrn3-authentication-summary__entry__50} | Release | Release notes | |-|-| | Australia | Accessibility information : Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. | | Brazil | Accessibility information : Coral theme : Coral is the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme uses brand-neutral illustrations. A dark theme option is available for web and mobile experiences. | [ ] ## Localization information If there are specific localization considerations for Authentication we have noted them here. {#dfrn3-authentication-summary__entry__56} | Release | Release notes | |-|-| | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Authentication we have noted them here. {#dfrn3-authentication-summary__entry__62} | Release | Release notes | |-|-| | Australia | [Australia Patch 7](https://www.servicenow.com/docs/access?context=australia-patch-7&family=australia&ft:locale=en-US) [Step-up authentication for AI voice agents](https://www.servicenow.com/docs/access?context=step-up-authentication&family=australia&ft:locale=en-US) : Require a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request, such as a password reset or access to bank account details. Select Okta Verify push notification, SMS verification code, or authenticator app time-based one-time password (TOTP) as the step-up factor on the Assistant Designer's Caller verification page. [Australia Patch 6](https://www.servicenow.com/docs/access?context=australia-patch-6&family=australia&ft:locale=en-US) [Human-assisted SMS OTP](https://www.servicenow.com/docs/access?context=human-assisted-sms-otp&family=australia&ft:locale=en-US) : Human-assisted SMS OTP lets a human agent verify an end user's identity by sending a one-time passcode via SMS during a live interaction. The agent initiates OTP generation and validation through the platform's scriptable APIs, and the consuming application (for example, CSM or FSO workspace) handles the agent-facing workflow and user interface. [Australia Patch 6](https://www.servicenow.com/docs/access?context=australia-patch-6&family=australia&ft:locale=en-US) [Human-assisted SMS OTP](https://www.servicenow.com/docs/access?context=human-assisted-sms-otp&family=australia&ft:locale=en-US) : Human-assisted SMS OTP lets a human agent verify an end user's identity by sending a one-time passcode via SMS during a live interaction. The agent initiates OTP generation and validation through the platform's scriptable APIs, and the consuming application (for example, CSM or FSO workspace) handles the agent-facing workflow and user interface. [Australia Patch 3](https://www.servicenow.com/docs/access?context=australia-patch-3&family=australia&ft:locale=en-US) [Authentication factors enhancement for AI voice service](https://www.servicenow.com/docs/access?context=explore-authentication-factors&family=australia&ft:locale=en-US) : Following are the authentication factors enhancements: * Email OTP as an authentication factor for AI voice service: Use Email OTP as a standalone factor, a primary factor, or a secondary factor in AI voice agent authentication flows. When a caller reaches the voice agent, a one-time password is sent to their registered email address. The caller provides the password to complete authentication. * KBA for AI voice service: Use the KBA setup to configure Knowledge-Based Authentication (KBA) for the voice channel. Choose from base system questions at both the identification level and the authentication level. AI voice service mappings are populated automatically from your Assistant Designer selection, so manually mapping voice services is no longer a mandatory step in the KBA setup. * Authenticate callers at the start of every call: Prompt callers for authentication or identification details at the start of every call, before the voice-only assistant responds to any request. Use the Authenticate at the start of the call option on the Assistant Designer's Caller verification page. [Australia Patch 1](https://www.servicenow.com/docs/access?context=australia-patch-1&family=australia&ft:locale=en-US) [Knowledge-based factor enhancement for AI voice service](https://www.servicenow.com/docs/access?context=knowledge-based-authentication&family=australia&ft:locale=en-US) : Following are the knowledge-based authentication (KBA) enhancements: * [Voice input support for KBA questions](https://www.servicenow.com/docs/access?context=create-knowledge-based-questions&family=australia&ft:locale=en-US): Configure KBA questions to support Voice as an input type, allowing users to provide spoken responses during identification and authentication. When Voice input is enabled, you can configure the expected format, provide examples, and optionally define a validation pattern using regular expressions. * [Script-based validation for external systems](https://www.servicenow.com/docs/access?context=create-knowledge-based-answers&family=australia&ft:locale=en-US): Configure KBA answers to validate that are created against external systems using custom scripts through the Script Configuration field. When set to Identification mode, you can write scoped scripts that validate caller identity against external authentication systems instead of internal ServiceNow AI Platform tables. Australia * Enable caller access to AI voice agents by configuring the required identification and authentication factors. * Secure the web embeddables feature for authenticating the ServiceNow®'s web components that are used in third-party portals. * Use the granular roles to complete administrative configuration tasks for Authentication without requiring the full admin role. * Use the enhanced Auth Scope for your Inbound Integrations. See [Authentication](https://www.servicenow.com/docs/access?context=c_Authentication&family=australia&ft:locale=en-US) for more information. | | Brazil | * Require a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request, such as a password reset or access to bank account details. * Simplify the login experience by crafting login policies that present relevant methods based on user context with the Policy-based experience - Identifier-first login experience. * Act before SSO is disrupted with home page banner alerts when SAML SP signing or encryption keystores are nearing or past expiry. * Authenticate callers in AI voice agent sessions using a one-time passcode delivered to a registered email address, as a standalone, primary, or secondary factor. * Connect ServiceNow to Microsoft Azure and Google Cloud Platform without storing or rotating client secrets, using federated identity based on signed JWTs. * Issue ID Tokens signed with RS256 from the ServiceNow OpenID Provider to give OAuth client applications a way to verify end-user identity. * Restrict Basic Authentication access on the instance to a defined set of trusted scenarios, with a tracking period to identify legitimate users before enforcement begins. * Configure SSL/TLS certificate validation for individual outbound endpoints by creating outbound certificate policies, so you can adjust hostname verification, certificate chain validation, and revocation checking for a specific host without changing the global validation policy for every other endpoint. * Register an external authorization server --- such as Microsoft Entra ID or Okta --- as a trusted token issuer for the MCP Server, so MCP clients can authenticate using tokens from your enterprise identity provider. See [Authentication](https://www.servicenow.com/docs/access?context=c_Authentication&family=brazil&ft:locale=en-US) for more information. | [ ]