--- sourceDocument: Brazil Impact sourceDocumentLink: https://www.servicenow.com/docs/r/impact Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Impact ft:clusterId : - ipact bundleId : - ipact --- # Scan Engine integrations # Scan Engine integrations {#ariaid-title1} Release version: Brazil Updated October 27, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Scan Engine integrates with other ServiceNow instances and external agile systems to synchronize definitions, manage exception reasons, create user stories, and enforce governance over app deployments. Scan Engine integrates with your other environments running Impact so that you can: * Compare technical debt across instances * Sync custom definitions across instances * Enable approvals for finding exceptions in production * Create user stories from findings Before you configure any integration, complete the setup in [Instance integration setup](https://www.servicenow.com/docs/~yEpvL~QDR2CmID3p~L7rg "Setup for Scan Engine integrations between instances starts with common steps. The roles and platform requirements depend on the integration."). It covers the inputs, setup sequence, required roles, and platform notes that apply to every integration. The following integrations are available for the Scan Engine. The table shows where each integration is configured. {#instance-integration-scan-engine__table_i33_xr5_3hc__entry__3} | Integration | Description | Where to configure | |-|-|-| | [Definitions integration](https://www.servicenow.com/docs/4nZ_yboriqpn0168nqeKnA "The Definitions integration manually syncs new, customized, and overridden definitions from development to production and the other instances.") | Synchronizes definition overrides and custom definitions between non-production and production instances so a consistent ruleset applies throughout the instance stack. | * Development instances only. Enable it in My SN Instances on each development instance. * Only development instances can manually push definition sync requests to the rest of the stack. * Test and production instances don't trigger definition syncs. {#instance-integration-scan-engine__ul_mnb_yxz_1lc} | | [Exception reason integration](https://www.servicenow.com/docs/EFG6Ypsvg2voyT~Lb9VZUA "You can synchronize exception reasons from non-production to Production instances after a record is created or updated.") | * Synchronizes exception reasons between non-production and production instances. * Facilitates the approval or rejection of exception reasons in the production environment. {#instance-integration-scan-engine__ul_j33_xr5_3hc} | * Configure it on each instance where exceptions are raised. * On production, the approval group is specified here, and that group is notified when a new exception is raised. {#instance-integration-scan-engine__ul_nsg_2yz_1lc} | | [User story integration](https://www.servicenow.com/docs/QBCS3RB3C09UVcigbHwG0A "The User story integration creates agile tasks and stories directly from Scan Engine finding records in ServiceNow, Jira, Azure DevOps, or any external system.") | Creates tasks for findings from a ServiceNow instance to: * ServiceNow production instance * Jira * Azure DevOps * Others {#instance-integration-scan-engine__ul_l33_xr5_3hc} Note: Jira and Azure DevOps authenticate with a Basic auth record and an API token, configured in Scan Engine Properties. The Other type takes a username and API token directly on Scan Engine Properties. None of these types use My SN Instances. | * ServiceNow user story integration: * Configure on the source instance where the findings originate. * The target is production. {#instance-integration-scan-engine__ul_xvd_ryz_1lc} * Jira, Azure DevOps, or the Other types: * Configure on the instance where Scan Engine runs and the findings are generated. * These types don't need a My SN Instances record. {#instance-integration-scan-engine__ul_z3p_syz_1lc} {#instance-integration-scan-engine__ul_mmv_fyz_1lc} | | [Deployment and synchronization integrations](https://www.servicenow.com/docs/QiWji3GVGe9K5OapqePfKg "The AES/AEMC and Update set integrations control how custom app deployments are governed and how scan results are synchronized across your instance stack.") | * Update sets: Synchronizes update set summary scans to the production instance from instances where this integration is enabled. * AES/AEMC: * Provides automated governance for custom app deployments by validating deployment requests against admin-defined conditions before approval. * When a developer submits a deployment request, the system automatically runs checks to verify all required rules are met, blocking deployment if conditions fail. {#instance-integration-scan-engine__ul_tsr_nyz_1lc} | * Update sets: * Enable it on each instance whose update set scan data you want to share. * Scan data goes to production and to all other instances in the integration, so you can check it from any instance. {#instance-integration-scan-engine__ul_r2v_hyz_1lc} * AES/AEMC: * Enable it on production only. Production needs one My SN Instances record whose environment is Production. * Cross-instance deployment calls also depend on the `sn_pipeline_environment` table from Pipelines and Deployments. * Each Environment record has an Instance credential field that points to a Connection and Credential Alias. {#instance-integration-scan-engine__ul_clg_kyz_1lc} {#instance-integration-scan-engine__ul_q13_hyz_1lc} | [Table 1. Scan Engine integrations] {#instance-integration-scan-engine__table_i33_xr5_3hc} * **[Instance integration setup](https://www.servicenow.com/docs/~yEpvL~QDR2CmID3p~L7rg)** Setup for Scan Engine integrations between instances starts with common steps. The roles and platform requirements depend on the integration. * **[Create an integration user account](https://www.servicenow.com/docs/L7u6ANwPaPvCvoYiwpoeyg)** Create a dedicated integration user account and assign the required roles so that the Scan Engine can authenticate and communicate between your ServiceNow instances. * **[Grant Key Management Framework access on an instance](https://www.servicenow.com/docs/XWpnleOsoKncEGm_C4OnwA)** Give the setup user KMF roles and approve the Scan Engine decryption policy so that imported credentials can be decrypted on the instance. * **[Integrations across multiple instances](https://www.servicenow.com/docs/tIMizVShwuQ1XAshW5FUQg)** A stack with more than two instances needs an OAuth provider registry and an OAuth client registry for every instance in the stack. * **[Register your instance](https://www.servicenow.com/docs/qVtcMVX4ueNM5WLtwJLobg)** Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration. * **[Definitions integration](https://www.servicenow.com/docs/4nZ_yboriqpn0168nqeKnA)** The Definitions integration manually syncs new, customized, and overridden definitions from development to production and the other instances. * **[Exception reason integration](https://www.servicenow.com/docs/EFG6Ypsvg2voyT~Lb9VZUA)** You can synchronize exception reasons from non-production to Production instances after a record is created or updated. * **[User story integration](https://www.servicenow.com/docs/QBCS3RB3C09UVcigbHwG0A)** The User story integration creates agile tasks and stories directly from Scan Engine finding records in ServiceNow, Jira, Azure DevOps, or any external system. * **[Deployment and synchronization integrations](https://www.servicenow.com/docs/QiWji3GVGe9K5OapqePfKg)** The AES/AEMC and Update set integrations control how custom app deployments are governed and how scan results are synchronized across your instance stack. * **[Configure other integration options](https://www.servicenow.com/docs/9Y5m1O9SFVNtppvAQUbQjQ#configure-other-integration-options)** Configure the Other integration to create work items in any external system by using a payload script, an endpoint, a username, and an API token.