Restrict MID Server Users from Authenticating via the UI

Reduce risk from a compromised MID Server account by disallowing UI authentication

MID Server service accounts are automated system accounts that facilitate secure communication between the ServiceNow instance and resources behind your organization's firewall. These accounts should operate under the principle of least privilege, meaning they should only possess the minimum permissions necessary to perform their designated functions. Allowing UI authentication for MID Server accounts creates an unnecessary attack surface.

For each MID Server user record in the User [sys_user] table, confirm that the web_service_access_only field is set to "true".

More information

Attribute	Description
Configuration name	User [sys_user] table and mid_server_user.web_service_access_only
Configuration type	User [sys_user] table (/sys_user_list.do)
Data type	Boolean
Recommended value	true
Default value	true
Fallback value	N/A
Category	Access control
Security risk	Severity score: 3.8 CVSS rating: Low Security risk details: If a MID Server account is compromised, an attacker with UI access could use the web interface to modify configurations or access sensitive data within the ServiceNow environment. By restricting these accounts to web service access only (setting web_service_access_only to true for MID Server users), organizations help ensure that MID Server credentials can only be used for their intended purpose of service to service communication.
Functional impact	None
Dependencies and prerequisites	None