Multi-factor authentication verification methods
Summarize
Summary of Multi-factor Authentication Verification Methods
ServiceNow's multi-factor authentication (MFA) enhances security by requiring users to verify their identity through additional methods beyond their username and password. Supported verification methods include Authenticator Apps, FIDO2, Time-based One-Time Passwords (TOTP), and various independent factors such as biometric scanners and hardware keys.
Show less
Key Features
- Authenticator Applications: Third-party software that generates temporary passcodes, which users enter along with their passwords. Recommended apps include Google Authenticator and Microsoft Authenticator.
- Biometric Scanners and Hardware Keys: Using the Integration - Web Authentication plugin, users can authenticate via fingerprint or facial recognition, or through physical hardware keys that connect to their devices.
- Passkey Authentication: A passwordless login method that utilizes device unlocking through biometric sensors, PINs, or patterns.
- SMS OTP: Administrators can configure instances to require a one-time password sent via SMS to the user’s registered mobile number for verification during login.
- Email OTP: Similar to SMS, this method sends a one-time password to the user's email address for identity verification during the login process.
Key Outcomes
Implementing these MFA methods improves security by ensuring that only authorized users can access ServiceNow instances. Users will experience a more secure login process, while administrators have the flexibility to configure MFA settings tailored to their organization's needs.
ServiceNow's MFA supports verification methods such as Authenticator App, Fast IDentity Online 2 (FIDO2) and Time-based One-Time Password (TOTP).
The users can use the following options in addition to their user name and password to fulfill multi-factor authentication requirements. The users can setup MFA factors such as Authenticator applications, Biometric scanners, Hardware Keys, and SMS independently.
Authenticator applications
An authenticator application is third-party software that generates temporary passcodes. Users can use these passcodes along with their password to log in into an instance that requires multi-factor authentication (MFA). For more detail on these applications, see Authenticator applications.
Hardware Keys and Biometric scanners (Web Authentication)
The Integration - Web Authentication (com.snc.integration.webauthn) plugin allows hardware key or biometric reader authentication on your instance.
Biometric authenticators use fingerprint or facial recognition to identify users. Your users can use these authenticators on their devices as part of the multi-factor login process. For details on registering biometric authenticators, see Register a biometric authenticator.
Hardware keys are physical hardware that you can use to authenticate. Hardware keys are inserted into a port on your device to provide authentication. For details on registering hardware keys, see Register a hardware security key.
Passkey
Passkey authentication is a secure, password less method of log in, where the users use a passkey by unlocking their device with a biometric sensor, PIN, or pattern.
SMS
Admin can configure ServiceNow instance to require users who attempt to log in to the instance using SMS based OTP.
When users attempt to log in to ServiceNow, SMS OTP is sent to the mobile number associated with the sys_user record. Users can enter the six-digit verification code that it sent to the mobile device and verify their identity. For more information, see SMS as an MFA factor.
Admin can configure ServiceNow instance to require users who attempt to log in to the instance using Email based OTP.
When users attempt to log in to ServiceNow, Email OTP is sent to the email address of the user. Users can enter the six-digit verification code that it sent to the email address and verify their identity. For more information, see Email as an MFA factor.
