--- sourceDocument: Brazil Impact sourceDocumentLink: https://www.servicenow.com/docs/r/impact Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Impact ft:clusterId : - ipact bundleId : - ipact --- # Instance integration setup # Instance integration setup {#ariaid-title1} Release version: Brazil Updated October 28, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Setup for Scan Engine integrations between instances starts with common steps. The roles and platform requirements depend on the integration. ## Before you begin {#instance-integrations-overview__before-you-begin} Gather these inputs before you set up an integration between ServiceNow instances. The Jira, Azure DevOps, and Other integration types need different inputs, which their topics list. Each row shows where you use the input. {#instance-integrations-overview__table_inputs__entry__3} | Input | Details | Topic | |-|-|-| | Instance name and URL | The instance name must match the `instance_name` system property. Use the URL format `https://instancename.service-now.com`. | [Register your instance](https://www.servicenow.com/docs/qVtcMVX4ueNM5WLtwJLobg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.") | | Environment type | Development, Test, or Production. Only one instance in the stack can be Production. | [Register your instance](https://www.servicenow.com/docs/qVtcMVX4ueNM5WLtwJLobg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.") | | Integration user ID and password | Record the password in a secure location. You re-enter it in several fields. | [Create an integration user account](https://www.servicenow.com/docs/L7u6ANwPaPvCvoYiwpoeyg "Create a dedicated integration user account and assign the required roles so that the Scan Engine can authenticate and communicate between your ServiceNow instances.") | | Authentication method | Use either OAuth or Basic authentication for an integration. You can't use both or combine them. OAuth is recommended. | [Configure the OAuth authentication method development instance](https://www.servicenow.com/docs/JMYCW35QMol3B5RjYlAheQ "Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries.") or [Configure the Basic authentication method](https://www.servicenow.com/docs/sqSEawQaR6_jbGjrlIhFCQ "Confirm an integration user, create a Basic authentication record, then connect your instances using basic authentication. Basic authentication is supported but OAuth is recommended for production environments.") | [Table 1. Setup inputs] {#instance-integrations-overview__table_inputs} ## Setup roadmap {#instance-integrations-overview__setup-roadmap} Complete steps 1 to 6 in order for integrations between ServiceNow instances, including the User story integration when its integration type is ServiceNow instance. The Jira, Azure DevOps, and Other integration types connect to an external system and don't use My SN Instances records, so those steps don't apply to them. Open the linked topic for details. {#instance-integrations-overview__table_setup_roadmap__entry__3} | Step | Task | Run on | |-|-|-| | 1 | [Create an integration user account](https://www.servicenow.com/docs/L7u6ANwPaPvCvoYiwpoeyg "Create a dedicated integration user account and assign the required roles so that the Scan Engine can authenticate and communicate between your ServiceNow instances."). Assign the roles in the table of integration user roles. | Each instance | | 2 | [Register your instance](https://www.servicenow.com/docs/qVtcMVX4ueNM5WLtwJLobg "Register each participating ServiceNow instance in the My SN Instances table before configuring any instance-to-instance integration.") | 1. Development first 2. Then production 3. Then any additional instances {#instance-integrations-overview__ol_bm1_sq5_ykc} | | 3 | [Configure the OAuth authentication method development instance](https://www.servicenow.com/docs/JMYCW35QMol3B5RjYlAheQ "Set up OAuth authentication for instance-to-instance Scan Engine integrations using several stages, an integration user account, an OAuth2 configuration record, and provider and client application registries.") and [Configure the OAuth authentication method production instance](https://www.servicenow.com/docs/9E6CdgkChtoyz8~j8M11mg "Export OAuth records from the development instance, import them into the production instance, and correct Key Management Framework (KMF) credential encryption. Configure development-to-production authentication so that both instances can validate their connections to each other."), or [Configure the Basic authentication method](https://www.servicenow.com/docs/sqSEawQaR6_jbGjrlIhFCQ "Confirm an integration user, create a Basic authentication record, then connect your instances using basic authentication. Basic authentication is supported but OAuth is recommended for production environments.") | 1. Development 2. Then production {#instance-integrations-overview__ol_wpp_tq5_ykc} | | 4 | [Grant Key Management Framework access on an instance](https://www.servicenow.com/docs/XWpnleOsoKncEGm_C4OnwA "Give the setup user KMF roles and approve the Scan Engine decryption policy so that imported credentials can be decrypted on the instance.") | Each instance that receives imported records | | 5 | [Validate your instance connection](https://www.servicenow.com/docs/D7DhNjyDy2a0UaVjDi5Uqg "Validate the connection between registered instances to confirm that authentication and My SN Instances configuration are correct before enabling integrations.") | Each instance | | 6 | [Integrations across multiple instances](https://www.servicenow.com/docs/tIMizVShwuQ1XAshW5FUQg "A stack with more than two instances needs an OAuth provider registry and an OAuth client registry for every instance in the stack.") | After the first pair validates, each additional non-production instance | | 7 | Configure the integrations you need: * [Definitions integration](https://www.servicenow.com/docs/4nZ_yboriqpn0168nqeKnA "The Definitions integration manually syncs new, customized, and overridden definitions from development to production and the other instances.") * [Exception reason integration](https://www.servicenow.com/docs/EFG6Ypsvg2voyT~Lb9VZUA "You can synchronize exception reasons from non-production to Production instances after a record is created or updated.") * [User story integration](https://www.servicenow.com/docs/QBCS3RB3C09UVcigbHwG0A "The User story integration creates agile tasks and stories directly from Scan Engine finding records in ServiceNow, Jira, Azure DevOps, or any external system.") * [Deployment and synchronization integrations](https://www.servicenow.com/docs/QiWji3GVGe9K5OapqePfKg "The AES/AEMC and Update set integrations control how custom app deployments are governed and how scan results are synchronized across your instance stack.") * [Configure other integration options](https://www.servicenow.com/docs/9Y5m1O9SFVNtppvAQUbQjQ#configure-other-integration-options "Configure the Other integration to create work items in any external system by using a payload script, an endpoint, a username, and an API token.") | Varies by integration. Open each topic to see which instances to use. | [Table 2. Setup roadmap] {#instance-integrations-overview__table_setup_roadmap} ## Role requirements {#instance-integrations-overview__role-requirements} Two sets of roles apply to this setup. The first set is the roles you need to set up the integrations. The second set is the roles you assign to the integration user. {#instance-integrations-overview__table_roles_to_set_up__entry__2} | Role | When you need it | |-|-| | Scan Engine admin, `sn_se.scan_engine_admin` | To configure Scan Engine properties and the integrations | | admin | To create the integration user and the setup records | | KMF admin, `sn_kmf.admin` | Only if validation fails after you complete all of the setup. See [Grant Key Management Framework access on an instance](https://www.servicenow.com/docs/XWpnleOsoKncEGm_C4OnwA "Give the setup user KMF roles and approve the Scan Engine decryption policy so that imported credentials can be decrypted on the instance."). | [Table 3. Roles you need to set up the integrations] {#instance-integrations-overview__table_roles_to_set_up} {#instance-integrations-overview__table_role_requirements__entry__3} | Role | Purpose | Where required | |-|-|-| | `sn_se.scan_engine_admin` | Full admin access to Scan Engine configuration | Integration user on all instances | | `sn_se.internal_rest_integration` | Allows REST calls between instances | Integration user on each instance that receives calls | | `sn_se.scan_engine_user` | Runs update set scans | Scanning user for the Update set integration, unless that user also has `sn_se.scan_engine_admin` | [Table 4. Integration user roles] {#instance-integrations-overview__table_role_requirements} Important: The platform admin role does not include the Scan Engine roles. Assign them explicitly on every instance the integration user is imported to. ## Platform notes {#instance-integrations-overview__platform-notes} Key Management Framework (KMF) : KMF encrypts passwords with a key that is unique to each instance, so imported passwords must be re-entered on the receiving instance. See [Grant Key Management Framework access on an instance](https://www.servicenow.com/docs/XWpnleOsoKncEGm_C4OnwA "Give the setup user KMF roles and approve the Scan Engine decryption policy so that imported credentials can be decrypted on the instance.") for the steps. ECMAScript 2021 (ES12) mode : For User Story integrations, enable ECMAScript 2021 (ES12) mode in Scan Engine Properties to use modern JavaScript syntax in field mapping scripts. Without this mode, only the application default JavaScript mode is available.