Access Control Lists

Australia Platform security
Release
australia
ft:locale
en-US
ft:publication_title
Australia Platform security
ft:clusterId
psec
bundleId
psec
workflow
Platform
  • Secure your instance
  • ServiceNow Vault
  • Exploring ServiceNow Vault
  • AI in ServiceNow Vault
  • Vault Suite
  • Configuring ServiceNow Vault
  • Install ServiceNow Vault
  • Install Vault Suite
  • Vault roles
  • Install plugins
  • Install Now Assist for Vault
  • Use guided setup
  • Use agentic AI
  • Securing custom apps with Vault agents agentic workflow
  • Access Observer configuration agentic workflow
  • Summarize Access Observer logs agentic workflow
  • Field encryption with Vault module agentic workflow
  • Use generative AI skills
  • Generate a custom data pattern by using Now Assist for Vault
  • Check role access for an encrypted column with Now Assist for Vault
  • Schedule a Data Discovery job with Now Assist for Vault
  • ServiceNow Vault console dashboard
  • Tools and metrics
  • Default policies and configurations
  • Now Assist for Vault
  • Platform Security
  • Security Center
  • Security Center landing page
  • Security Tasks
  • Automatic Security Task generation
  • Edit Security Tasks
  • Export Security Tasks
  • Security posture console
  • Security Best Practices
  • Complete a best practice
  • View activity of a best practice
  • View data of completed best practices
  • Filters the security best practices table
  • Best Practices
  • Security posture dashboards
  • Access Management
  • Security configuration console
  • Security hardening
  • All settings
  • Hardening settings details
  • Filter hardening settings
  • Hardening compliance score trend
  • Increase score
  • Hardening score comparison
  • Security scanner
  • Scan findings
  • Security scan comparison
  • Scan findings trend
  • Scan checks
  • Scan suites
  • Access Controls Auditor checks
  • Security Center Scan Suites
  • Create a scan suite
  • Clone the access controls auditor suite
  • View the Access Controls Auditor Suite
  • Reschedule a scan suite
  • Scan results
  • Customer Actions
  • Implement Customer Actions
  • View Customer Actions
  • Security monitoring console
  • Security Event Notifications
  • Create custom policies
  • Modify policies
  • Configure policy preferences
  • Create custom email
  • Security Event Notifications history
  • Security metrics
  • Customize the dashboard
  • Configure email notifications on threshold triggers
  • All Security Metrics
  • Active Sessions
  • Adaptive authentication Security Metrics
  • Antivirus
  • Authentication
  • Data Classification
  • Authentication metrics
  • Email
  • Export
  • Integration Accounts
  • Privileged Identity
  • Privileged Users
  • Session management
  • Users
  • Security learning
  • ServiceNow Security Center announcements
  • Granular roles for Security Center
  • Instance Security Center
  • Migrating to Security Center
  • Monitor security events
  • Configure the security event ribbon
  • Set preferences for security event notifications
  • Check the daily compliance score and configure security property settings
  • Adjust instance security settings to increase compliance
  • How Daily Compliance score, trend, and graph data is refreshed
  • PCI compliance score dashboard
  • PCI configuration controls score dashboard
  • Scan for incorrect security definitions
  • Monitor instance metrics
  • User metrics
  • Export metrics
  • Export metrics settings
  • Authentication Metrics
  • Adaptive authentication metrics
  • Email metrics
  • Designate email domains as untrusted or trusted
  • Antivirus metrics
  • MFA metrics dashboard
  • Activate the ISC Virtual Agent interface
  • Hardening settings
  • Baseline versions
  • New hardening settings
  • Baseline version 8.0
  • Baseline version 7.0
  • Baseline version 6.0
  • Baseline version 5.0
  • Baseline version 4.0
  • Baseline version 2.0
  • Updated hardening settings
  • Baseline version 8.0
  • Baseline version 7.0
  • Baseline version 6.0
  • Baseline version 5.0
  • Baseline version 4.0
  • Baseline version 2.0
  • Deleted hardening settings
  • Baseline version 8.0
  • Baseline version 7.0
  • Baseline version 6.0
  • Baseline version 5.0
  • Baseline version 4.0
  • Baseline version 2.0
  • Access control
  • Anti-CSRF token validation time
  • Apply domain separation on dot walked fields
  • Block access for delegated developers
  • Block Expired Anti-CSRF Tokens
  • Check UI action conditions before execution
  • Configure event management assignment group admin roles [New in Security Center 1.5]
  • Configure Service Portal Widgets Allow List
  • Configure Service Portal Widgets Table Allow List
  • Deny internal access to explicit external roles [Updated in Security Center 1.3 and 1.5]
  • Deny unauthorized access to request items
  • Display recommendations for high risk UI pages
  • Disable Adding Default Roles to Skill ACLs
  • Disable inbound emails for locked out users
  • Disable Voice Chat Guest Impersonation
  • Double check inbound transactions
  • Enable scoped admin application ACLs
  • Enable work order management query rules for service organizations
  • Enable ACLs to Control Live Profile Details
  • Enable ACLs for Encoded Query in Simple List Widget
  • Enable Guardian for External Agents
  • Enable Anti-CSRF token [New in Security Center 1.3, updated in 1.5, and removed in 2.0]
  • Enable contextual security plugin
  • Enable Cross Scope Privilege Checks on Service Portal Form [New in Security Center 7.0]
  • Enable policy based session access for mobile
  • Enable Role Masking for Agents
  • Enable multiple (permission policy and boundary) checks to ensure that the Role is privileged in AWS/Bedrock
  • Enable report view ACLs
  • Enforce ACL on HR Lifecycle Events Data [New in Security Center 2.0]
  • Enforce ACL on HR Core Data [New in Security Center 2.0]
  • Enforce ACL on HR Virtual Agent Data [New in Security Center 2.0]
  • Enforce application specific ACLs only for application data
  • Enforce application scope restrictions [New in Security Center 1.3 and removed in 1.5]
  • Enforce field-level ACLs on records created from the query string of the Filtered List view UI of a table
  • Enforce Read Roles for Catalog Variable Search [New in Security Center 7.0]
  • Enforce security rules to sharing dashboards
  • Enforce scope security for public sector digital services [New in Security Center 1.3]
  • Enforce scoped ACL access for information request playbooks [New in Security Center 1.3 and updated in 1.5]
  • Enforce strict elevate privilege
  • Enforce security scope license and permit playbook [New in Security Center 1.5 and updated in 2.0]
  • Enforce Security Scope for Agent Workspace for HR Case Management [New in Security Center 1.5 and updated in 2.0]
  • Enforce Security Scope for Service Application Information [New in Security Center 2.0]
  • Enforce Scope Access Controls on New Tables
  • Enforce field level ACLs in GlideRecordSandbox
  • Enforce GroupBy ACLs
  • Ensure archive table ACLs are checked
  • Ensure dashboards creation/deletion requires access check [New in Security Center 1.3 and updated in 2.0]
  • Exclude Sensitive Tables and Fields from Data Generation [New in Security Center 7.0]
  • Prevent Users From Accepting Warning To Bypass CSRF Validation [Updated in Security Center 1.3 and 1.5]
  • Restrict allowed domains for cross-origin iframe communication
  • Restrict delegated developers read access [Updated in Security Center 1.3]
  • Require AJAXGlideRecord ACL checking
  • Restrict write access on system fields to admin users [New in Security Center 7.0]
  • Require Multi-Factor Authentication for AI Voice Agent
  • Require approval for agent-based Office 365 group membership changes [New in Security Center 7.0]
  • Prevent impersonating user from viewing application data
  • Enforce oauth state parameter validation
  • Enforce Strict User Image Upload
  • Restrict email domains for external user registration [Updated in Security Center 1.3, 1.5, and 2.0]
  • Enable High Security Plugin
  • Honor Admin Override ACLs
  • Prevent inactive users from logging in
  • Prevent Unauthenticated Access to Virtual Agent Embedded Web Client
  • Restrict JSONP Requests to Trusted URLs [Updated in Security Center 1.3]
  • Prevent users from accepting warning to bypass CSRF validation
  • Disable raw database query execution [Updated in Security Center 1.3 and removed in 2.0]
  • Hide user comments on articles
  • Require authentication by default for client-callable script includes
  • Enforce production instance behavior
  • Restrict access to background script
  • Restrict access to emails with empty target table
  • Restrict access to specific IP ranges plugin
  • Restrict knowledge bases access
  • Restrict permissions for CMDB model
  • Restrict unauthenticated access to attachments
  • Restrict access to custom journal entries [Updated in Security Center 1.3 and removed in 2.0]
  • Restrict flow context read access
  • Restrict Impersonation to Admin
  • Enable security jump start plugin (ACL Rules)
  • Use of secure insert multiple operation within import set API
  • Enforce SOAP request strict security
  • Required JMS connection factories
  • Restrict Global App Development by Role
  • Review extraneous explicit role access control conditions [Removed in Security Center 1.5]
  • Specify URL allow list for cross-origin iframe communication
  • Set guest user for soap requests
  • Disable public access to favorites [Updated in Security Center 1.3 and 2.0]
  • Enable SNC access control plugin
  • Use Document Classification to limit publicly accessible documents [New in Security Center 7.0]
  • Validate query ACLs on Glide DB functions [New in Security Center 7.0]
  • API and web service
  • Validate SOAP content type
  • Prevent OAuth Clients from Using Implicit Grant
  • Require authorization for PDF requests
  • Require Authentication on Event Management HTTP Processor [New in Security Center 1.3, Updated in 1.5, and removed in 2.0]
  • Require authorization for SOAP requests
  • Require authorization for unload requests
  • Require authorization for csv requests [Updated in Security Center 1.3]
  • Require authorization for excel requests
  • Require authorization for import requests
  • Require authorization for JSONv2 request
  • Require authorization for WSDL request
  • Require authorization for XML requests
  • Require authorization for XML output requests
  • Require Authorization for XSD Requests
  • Require authorization for script requests
  • Require authorization for SCHEMA requests
  • Require authorization for RSS requests
  • Require authorization for API requests
  • Architecture, design, and threat modeling
  • Check impersonation on ACL evaluation in HR App [New in Security Center 1.3 and updated in 1.5]
  • Reduce the Scope of the IP Allow List for an Instance
  • Disable legacy JQuery behavior
  • Disable GlideRecord Scope Fencing Legacy Behavior
  • Disable legacy AngularJS behavior [Removed in Security Center 2.2]
  • Disable local login for users with Single Sign-On (SSO) enabled
  • Disable unauthenticated published reports
  • Disable public access to favorites
  • Enforce field ACLs for inbound query requests
  • Enforce read ACLs on report views
  • Enable Anti-CSRF Token for Userperf
  • Enforce Query ACLs for Knowledge Quick Links
  • Enforce Query ACLs for SubLists, List Counts and Widget Data Tables
  • Enforce valid query string choice [New in Security Center 7.0]
  • Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses
  • Ensure only Trusted IP Addresses are Allowed to Connect to An Instance
  • For Self-Hosted Instance, Ensure only Trusted IP Addresses are Allowed to Connect to An Instance
  • Require authorization for data broker rest API [Updated in Security Center 1.3]
  • Restricted Binding functionality in case Bearer Authorization [New in Security Center 7.0]
  • Deny by default with empty ACLs [Updated in Security Center 1.3]
  • Set Automatic Token Cleanup for Token Credentials
  • Authentication
  • Activate role-based multi-factor authentication [Updated in Security Center 1.3]
  • Activate role based multi-factor authentication
  • Anti-CSRF token (instance security hardening)
  • Control Lockout Time for Invalid Password Reset Attempts
  • Disable creating users from incoming emails
  • Disable password-less authentication
  • Disable resource owner password credentials (ROPC) in OAuth 2 token grants [New in Security Center 7.0]
  • Do not apply password policy at login [Updated in Security Center 1.5 and removed in 2.0]
  • Enable account recovery
  • Enable CAPTCHA for customer registration
  • Enable a deny-list password validation check
  • Enable CAPTCHA for External User Registration
  • Enable CAPTCHA in password reset
  • Enable email OTP for multi-factor authentication
  • Enable password reset policy checks
  • Enable relay state in SAML requests to prevent replay attacks
  • Enable SMS code notification for enrollment and verification
  • Enable SSL in LDAP authentication [Updated in Security Center 1.5 and 2.0]
  • Enforce current password policy compliance requirements on login
  • Enforce device encryption and passcode requirements [New in Security Center 1.3]
  • Limit Invalid Password Reset Attempts
  • Limit Allowed Number of Failed Login Attempts Before Lockout
  • Maximize failed login unlock timeout duration [Updated in Security Center 1.3]
  • Maximize reset password request retry window duration
  • Maximize reset password request unlock window duration
  • Maximize reset password SMS complexity
  • Maximize reset password SMS pause window duration
  • Maximize reset password verification delay duration
  • Minimize external user registration link expiration duration
  • Minimize reset password max SMS per day
  • Minimize failed login attempts for high assurance sessions
  • Minimize reset password request expiration duration
  • Minimize reset password request success window duration
  • Minimize reset password SMS expiry duration
  • Minimize one-time out of band verifier lifetime duration [Updated in Security Center 1.3]
  • Minimize SAML notBefore or notOnOrAfter constraint duration [Updated in Security Center 1.3 and 1.5]
  • Notify users during password reset/change process [Removed in Security Center 1.5]
  • Prohibit Use of KBA as Single Factor for AI Voice
  • Reduce allowed bypasses for multifactor setup
  • Remove credentials from Welcome page
  • Require CAPTCHA for guest walk-up experience in customer service application
  • Require obfuscation of classic mobile app UI [Updated in Security Center 1.3]
  • Require obfuscation of mobile app UI
  • Require Minimum and Maximum Password Length
  • Set OTP lifetime for password reset to 1 hour [Updated in Security Center 2.0]
  • Business Logic
  • Limit max comments per user per day
  • Limit max subscriptions per user per day
  • Minimize SMTP Recipient Quantity
  • Timeout Guest Sessions
  • Validate remote host
  • Communications
  • Enforce certificate trust [Updated in Security Center 1.3, removed in 2.0, added in 7.0]
  • Disable outbound SSLv2/SSLv3 connections
  • Do not use demo certificates for active SAML configurations
  • Disable deprecated TLS versions
  • Enforce OCSP check on network error
  • Verify certificate chain and hostname
  • Verify certificate revocation
  • Configuration
  • Auto set content type options [Removed in Security Center 1.3.3]
  • Cache-Control HTTP Header Value [Updated in Security Center 1.3 and removed in 1.5]
  • Enable HTTP response headers configuration
  • Disable legacy JQuery UI usage
  • Disable locked form elements debugging
  • Disable MultiSSO Debugging
  • Disallow target cloning [New in Security Center 1.3]
  • Disable soap fault stack trace display
  • Restrict performance monitoring access
  • Enforce secure referrer policy
  • Ensure minimum private key size
  • Implement the x-frame-options: SAMEORIGIN security header
  • Require write access to access service catalog add item page
  • Set Xframe options to prevent embedding third-party websites
  • Data protection
  • Remove remember me
  • Require clearing pasteboard when backgrounding mobile application
  • Restrict HR case updates from personal emails
  • Restrict oauth parameters to POST body [New in Security Center 1.3]
  • Error handling and logging
  • Disable logger for low privilege users in script sandbox
  • Disable secure cookie debugging
  • Disable SQL error messages
  • Enable Identity and Access Audit Tool
  • Enable MID audit log
  • Enable protected tables plugin
  • Log all outbound http request fields [Removed in Security Center v1.3.2]
  • Log html sanitization [Removed in Security Center 2.0]
  • Log Impersonation History
  • Log session audit events
  • Log user impersonation
  • Prevent verbose HTTP request logging
  • Track Impersonation Events
  • Turn off verbose SQL error messages for import processor
  • File and resources
  • Disallow infected file download
  • Enable email spam scoring and filtering
  • Enable antivirus scan
  • Restrict downloadable files types in static content [Updated in Security Center 1.3]
  • Limit attachment size in training and prediction flows for GraphQL endpoints [New in Security Center 1.3 and updated in 1.5]
  • Limit attachment size in training and prediction flows [New in Security Center 1.3 and updated in 1.5]
  • Limit HTTP response body size [New in Security Center 1.3 and updated in 1.5]
  • Limit maximum number of attachments in email
  • Maximum allowed attachment size
  • Validate file mime type in AttachmentCreator soap web service [New in Security Center 1.3 and updated in 1.5]
  • Validate MIME Type of Attachments from Inbound Emails
  • Malicious code
  • Block rooted or jailbroken mobile devices
  • Enable Code Signing for application configuration data and scripts [Removed in Security Center 1.3]
  • Session management
  • Apply continuous authentication policies to mobile sessions
  • Minimize absolute session timeout duration
  • Define active session timeout exception roles
  • Enable UserCookie version 3.1
  • Enforce password reset on api requests
  • Enable HTTP Only Cookie Flag
  • Invalidate Session After OAuth Token Expiration [New in Security Center 2.0]
  • Minimize concurrent interactive session quantity [Updated in Security Center 1.3]
  • Limit concurrent sessions across all nodes
  • Activate Limit Concurrent Sessions Plugin
  • Limit guest's active session life span
  • Minimize Concurrent Interactive Sessions with Limit Concurrent Sessions Plugin
  • Limit integrations' active session life span
  • Limit policy based session access mobile refresh token interval
  • Limit UI active session life span
  • Limit session length for high assurance sessions
  • Proactively Invalidate Sessions After Defined Durations
  • Rotate HTTP session identifiers
  • Minimize concurrent interactive session quantity [Updated in Security Center 1.3]
  • Minimize session activity timeout duration
  • Minimize session window timeout duration
  • Stored cryptography
  • Enable glide KMF encrypter [Removed in Security Center 1.3.2]
  • Disable use of TripleDES/3DES encryption algorithm
  • Prevent usage of 3DES keys [New in Security Center 7.0]
  • Validation, sanitization, and encoding
  • Allow HTML Links to Trusted Domains in the Description Fields of the Impact Workspace Module [New in Security Center 7.0]
  • Enable the hardened java security manager
  • Enable HTML Sanitizer [Updated in Security Center 1.3]
  • Enforce HTML Sanitization
  • Ensure Contextual Search Do Not Contain An Unvalidated Redirect [New in Security Center 7.0]
  • Disable AJAXEvaluate
  • Disable Entity Expansion within the XMLDocument2 Streaming Parser
  • Disable external content URL
  • Disable JavaScript tags in embedded HTML
  • Disable embedded HTML code [Updated in Security Center 1.3]
  • Restrict downloadable MIME types
  • Enable HTML Sanitizer within Virtual Agent
  • Enable Jelly JS Interpolation Protection
  • Enable Jelly JS interpolation protection for nested expressions
  • Enforce relative links
  • Enforce URL allowlist check
  • Escape Excel Formulas [Updated in Security Center 1.3]
  • Escape HTML in list views [Updated in Security Center 1.3 and 1.5]
  • Escape JavaScript [Updated in Security Center 1.3]
  • Escape jelly script [Updated in Security Center 1.3 and 1.5]
  • Escape scripts in scratchpad
  • Escape XML markup
  • Escape xml response
  • Restrict access to GlideSystemUserSession scriptable API
  • Restrict allowed Java packages [Updated in Security Center 1.3]
  • Packages call removal tool
  • Unset LDAP Initial distinguished name [Updated in Security Center 1.3 and removed in 2.0]
  • Enforce strict security of session cookies
  • Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable
  • Prevent Empty ACL Creation
  • Prevent Reuse of REST API Sessions in UI/Web
  • Define restricted downloadable MIME types [Updated in Security Center 1.3, 1.5, and 2.0]
  • Restrict uploaded MIME types
  • Restrict XML external entities
  • Require XMLdoc2 entity validation with allowlist
  • Sanitize All Translated HTML Fields
  • Sanitize HTML in the Description Fields of the Impact Workspace Module [New in Security Center 7.0]
  • Set safe content security policy for SVG files
  • Validate MIME Type for Multi-Extension Filenames, Polyglot Files, and Null-Byte Injection
  • Log Export Service (LES)
  • Explore
  • Log sources
  • Administer
  • Create a log source configuration
  • Create source type and multi topics in the LES source table
  • Update system property
  • Configure
  • Kafka consumer
  • Guided setup for Kafka consumers
  • MID server consumer
  • Guided setup for MID Server consumers
  • Multi-consumer support using unique mid servers
  • Secure Hermes LES connection
  • Use
  • Reference
  • Log Export Service roles
  • Logs
  • System logs
  • System log
  • Disable stack trace formatting in system logs
  • Transaction logs
  • Client transaction timings
  • Push logs
  • System email log
  • Event logs
  • Import logs
  • System Diagnostics module
  • Customer Updates table
  • Log history
  • Use the log file browser
  • Enhanced logging security
  • Avoid log tampering
  • Configuring the log protection plugin
  • Create log protection property
  • Logging, auditing, and errors
  • Disabling SQL error messages
  • Granular admin roles for Logging tables
  • Secrets Management
  • Exploring Secrets Management
  • About client-side Secrets Management
  • Configuring client accessible secrets
  • Create encryption keys and certificate
  • Add your certificate to the ServiceNow Trusted Key Store
  • Create a secret group
  • Upload the public/private keypair to the MID Server
  • Create credentials
  • Configure Flow Designer to manage the integration
  • Test the end-to-end client-side encrypted secrets integration
  • Test a Windows Management Instrumentation credential encrypted with Secrets Management
  • Cloning and Secrets Management
  • Secrets Management dashboard
  • Secrets Management roles
  • Create a secret group cryptographic module
  • Create a basic secret group
  • Create a secret group with criteria
  • Upload a public key
  • Run jobs
  • Code Signing
  • Explore
  • Configure
  • Assign the Administrator Role
  • Trusted Instance Setup
  • Upload configuration files to your protected instance
  • Protected Instance Setup
  • Enable Certificate Validation
  • Quorum Controlled Certificate Revocation
  • Export Request
  • Import Request
  • Approve Request
  • Disable Code Signing
  • Load Key Pairs and Certificates
  • Circle of Trust
  • Manage Circle of Trust
  • Turn on Code Signing
  • Create Key Pairs and Certificates
  • Custom Firewall Rules
  • Root of Trust Settings
  • Migrate Signatures
  • Disable Root of Trust
  • Using Code Signing
  • Standalone Signing Tool
  • Use Signing Tool
  • Tool Arguments
  • JDBC Signing
  • REST and SOAP Signing
  • Sign the Existing Messages
  • Sign the New Messages
  • Sign Records and Files
  • Sign Flows and Actions
  • Signature Verification
  • Health and Status Dashboard
  • Dashboard Summary
  • Signature Status
  • MID Server Configuration
  • Key Pair and Certificates
  • Configuration Dashboard
  • Utilities Dashboard
  • Batch Signature Generator
  • Administer and Troubleshoot
  • Properties
  • Roles
  • Actions and roles
  • Logs and Errors
  • Antivirus Scanning
  • Exploring Antivirus Scanning
  • Configuring Antivirus Scanning
  • Reviewing quarantined files
  • Review antivirus activity
  • Understanding Dictionary attributes
  • HTML sanitizer
  • Exploring HTML sanitizer
  • Configuring HTML sanitizer
  • Enabling HTML sanitizer
  • Enable sanitization on individual fields
  • Enable HTML Sanitizer logging
  • Auditing
  • Exploring Auditing
  • Configuring auditing for a table
  • Enable inclusion list auditing for a table
  • Enable impersonation tracking in audit logs
  • Exclude a field from being audited (exclusion listing)
  • Include a table field in auditing (inclusion listing)
  • Enable auditing for a system table
  • Audit Management Console
  • Setup your audit retention
  • Enable an audit deletion estimate
  • Viewing Sys Audit and Audit Relationship Change tables
  • Knowing about History sets
  • Differences Between Audit and History Sets
  • Control access to history
  • Change the number of history entries
  • History List
  • History Calendar
  • History Timeline
  • View timeline of changes to related records
  • Export a snapshot of a configuration item
  • Compare CI snapshots
  • Tracking changes to reference fields
  • Tracking inserts
  • Tracking CI Relationships
  • Granular admin roles for Audit tables
  • High Security Settings
  • Exploring High Security Settings
  • Activating High Security Settings
  • Virtual Private Network (VPN)
  • Exploring Virtual Private Network (VPN)
  • Activating a VPN service
  • Configuring an address for VPN communication
  • Platform Privacy
  • Exploring Data Privacy
  • Data Privacy
  • Data Privacy for Now Assist
  • Exploring Data Privacy for Now Assist
  • Configuring Data Privacy for Now Assist
  • Data privacy (Classic)
  • Activate data privacy (Classic)
  • Installed with data privacy (Classic)
  • Data privacy (Classic) configuration
  • Create a data privacy technique configuration
  • Create a data privacy policy
  • Configure a data privacy job
  • Data privacy job rollback
  • Roll back a data privacy job
  • Data privacy clone
  • Configure data privacy clone request
  • Data Privacy Job Logs
  • Data Privacy for Virtual Agent
  • Data privacy
  • Data privacy overview
  • Data classification
  • Create data classifications
  • Classify data
  • Data anonymization
  • Create anonymization techniques
  • Create anonymization policies
  • Assign data anonymization techniques
  • Configure data anonymization clone request
  • Create anonymization job
  • Activate parallel jobs
  • Anonymization of encrypted columns
  • Real time anonymization
  • Real time anonymization failures
  • Real time protection
  • Real time protection policies
  • User sensitive data logs
  • Alert data patterns
  • Attachment quarantine policies
  • Attachment scan findings
  • Activate data privacy
  • Domain separation
  • Supported field types for anonymization
  • Data privacy roles
  • Data Discovery
  • Exploring Data Discovery (Classic)
  • Activating Data Discovery
  • Classify data
  • Data Discovery jobs
  • Configure a job
  • Attachment scanning
  • Configure patterns
  • Default regular expression data patterns
  • Default NER data patterns
  • Using Text to RegEx with the classic UI
  • Configure target tables
  • Activate parallel jobs
  • Data Discovery roles
  • Data Discovery job results
  • Data Discovery supported data types
  • Scanning with Granular Configuration
  • Granular Findings
  • Data Discovery policies
  • Create a policy
  • Data Discovery Store
  • Data Discovery Store overview
  • Data Discovery policy
  • Create new policy
  • Data Discovery sources
  • Create new data pattern
  • Using Text to RegEx
  • Generate a regular expression using the discovery UI
  • Text to RegEx error handling
  • Licensing prerequisites for Text to RegEx
  • Select active data patterns
  • Select target tables
  • Data Discovery scheduled discovery
  • Create discovery job
  • Review discovery findings
  • Create granular job
  • Review granular findings
  • Data Classification
  • Exploring Data Classification
  • Installing plugin demo data
  • Creating data classifications
  • Assigning data classifications to dictionary entries
  • Analyzing data classifications
  • Domain separation
  • Encryption
  • Key Management Framework
  • Exploring the Key Management Framework
  • Cryptographic module overview
  • Cryptographic specification overview
  • Module access policy overview
  • Instance level keys in the Key Management Framework
  • Configuring the Key Management Framework
  • Assign Key Management Framework roles
  • Configure field encryption settings to select key type
  • Create a cryptographic module
  • Create a cryptographic specification
  • Configure key lifecycle states
  • Generate a ServiceNow cryptographic key
  • Create a module access policy
  • Create a cryptographic module life-cycle policy
  • Create module life-cycle policy exceptions
  • Key Management Framework Reference
  • Key Management Framework key life-cycle states
  • Roles installed with Key Management Framework
  • Module access policy visualization
  • Module access policy debugger
  • Encryption and Key Management subscription bundle
  • Key management actions
  • View and manage keys
  • Rotate keys
  • Import a key from a web service
  • Key Management Framework Health
  • Prepare your instance for GlideEncrypter deprecation
  • GlideEncrypter deprecation
  • Deprecate GlideEncrypter usage of 3DES for password2 fields
  • Key Management Framework Resource Exchange
  • Key Management Framework Key Exchange
  • Configure Key Exchange
  • Rekey ciphertext with Key Exchange
  • Recurring Key Exchange walkthrough
  • Infrastructure Security
  • Generate a Certificate Signing Request
  • Password2 encryption with the Key Management Framework (KMF)
  • FlowKMFEncrypter API
  • FlowKMFEncrypter in a Flow Action
  • Certificates
  • Exploring Certificates
  • Generating an LDAP client certificate
  • Generating a server certificate
  • Uploading a certificate to an instance
  • Uploading a trusted server certificate
  • Field Encryption
  • Exploring Field Encryption
  • Field Encryption Enterprise
  • Configuring Field Encryption
  • Activate Field Encryption
  • Role requirements for Field Encryption
  • Configure Field Encryption modules
  • Cryptographic specifications for Field Encryption
  • Module keys for Field Encryption
  • Module lifecycle policy exceptions for Field Encryption
  • Configure Customer-supplied keys for Field Encryption Enterprise
  • Configure properties for customer-supplied key
  • Wrap your customer-supplied key
  • Configure encrypted field configurations for fields or attachments
  • Configure multi-module encrypted field configurations
  • Configure module access policies for Field Encryption
  • Migrating to Field Encryption
  • Field Encryption migration status page
  • Migrate from Edge Encryption to Field Encryption
  • Configure Field Encryption for your Edge Encrypted fields
  • Field Encryption and system clones
  • Prevent users from attaching unencrypted files
  • Using Field Encryption
  • Create cryptographic module for Field Encryption
  • Using multiple encryption modules
  • Encrypt data using Row Conditions
  • Encrypt data using the Multiple Modules feature
  • Create a cryptographic specification for Field Encryption
  • Configure advanced algorithms for Field Encryption Enterprise
  • Using customer-supplied keys with Field Encryption Enterprise
  • Configure properties for customer-supplied keys
  • Wrap your customer-supplied key
  • Configure and upload your customer supplied key
  • Encrypting fields and attachments
  • Set encrypted field configurations
  • Script access for cryptographic modules
  • Configure script access to encrypted data
  • View declined cryptographic module usage requests
  • Schedule mass encryption, decryption, and rekeying jobs
  • Run mass encryption or decryption
  • Upload attachments for encryption
  • Module access policies for inbound email attachment encryption
  • Create a system module access policy
  • Create a user module access policy
  • Field Encryption Enterprise examples
  • External Key Management Service
  • Configuring External Key Management Service
  • Activate External Key Management Service
  • Configure an external key definition
  • Create a cryptographic module with external key wrapping
  • Create Encrypted Field Configurations
  • Set up Module Access Policies
  • Test an external key definition
  • Using External Key Management Service
  • Change the status of an AWS KMS Key
  • Check External Key Management Service Key Status
  • Change synchronization frequency
  • External Key Management Service and instance automation
  • Column Level Encryption
  • Exploring Column Level Encryption
  • Column Level Encryption Guided Tour
  • Column Level Encryption Enterprise
  • Configuring Column Level Encryption
  • Activate Column Level Encryption Enterprise
  • Migrating to Column Level Encryption
  • Prevent users from attaching unencrypted files
  • Using Column Level Encryption
  • Create cryptographic module for Column Level Encryption
  • Encrypt data using the Multiple Modules feature
  • Create a cryptographic specification for Column Level Encryption
  • Configure advanced algorithms for Column Level Encryption Enterprise
  • Using customer supplied keys with Column Level Encryption Enterprise
  • Configure properties for customer-supplied keys
  • Wrap your customer-supplied key
  • Configure and upload your customer supplied key
  • Encrypting fields and attachments
  • Set encrypted field configurations
  • Script access for cryptographic modules
  • Configure script access to encrypted data
  • View declined cryptographic module usage requests
  • Schedule mass encryption, decryption, and rekeying jobs
  • Run mass encryption or decryption
  • Column Level Encryption Enterprise examples
  • Column Level Encryption Enterprise walkthrough
  • Attachment encryption walkthrough
  • Cloud Encryption with Key Management
  • Key management operations
  • Quorum Control Policy
  • Configure Quorum Control Policy Settings
  • Manage Quorum Control
  • Approve or deny a quorum control request
  • Approve or deny a quorum request
  • Key management transactions
  • Cloud Encryption logging
  • Tamper Detection
  • Full disk encryption
  • Edge Encryption
  • Exploring Edge Encryption
  • Edge Encryption components
  • Edge Encryption clients
  • Key management for Edge Encryption
  • SafeNet key versioning
  • Encryption configurations and patterns
  • Installed with Edge Encryption
  • Planning for Edge Encryption
  • System requirements
  • Sizing your environment
  • Calculate the order-preserving and tokenization database size
  • Edge Encryption limitations
  • Installing Edge Encryption
  • Request Edge Encryption
  • Set up an Edge Encryption user account
  • Download the Edge Encryption proxy server
  • Install the Edge Encryption proxy server using the interactive installer
  • Install the proxy server (interactive installer)
  • Configure CyberArk properties protection
  • Configure the signature key
  • Configure the HTTPS certificate
  • Configure the AES 128-bit encryption key
  • Configure the AES 256-bit encryption key
  • Update SSL certificate
  • Configure the proxy database
  • Launch the proxy server
  • Verify and troubleshoot proxy server installation
  • Install the Edge Encryption proxy server using the command line installer
  • Install the proxy server (command line installer)
  • Create and configure the RSA key pair for the digital signature
  • Import and configure the certificate for secure SSL connection
  • Set up a keystore and encryption keys
  • Set up a Java KeyStore keystore
  • Create encryption keys using the Java KeyStore keytool
  • Set up a SafeNet KeySecure keystore
  • Set up Unbound Technology keys
  • Create an encryption key stored in a file
  • Configure encryption keys on the instance
  • Configure additional properties
  • Configure a web proxy
  • Set proxy server memory limits
  • Start the proxy
  • Obfuscate passwords in the properties file
  • Manually add an additional proxy
  • Authenticate a proxy server
  • Stop the proxy
  • Uninstall the proxy on Linux
  • Uninstall the proxy on Windows
  • Set up multiple provider SSO
  • Edge Encryption proxy server properties
  • CyberArk integration with the Edge proxy server
  • Using a load balancer with the Edge proxy server
  • Upgrading Edge Encryption
  • Schedule proxy server upgrade
  • Manually upgrade a proxy server running on Linux
  • Manually upgrade a proxy server running on Windows
  • Roll back a proxy server upgrade
  • Configuring Edge Encryption
  • Rotate encryption keys
  • Encrypt fields using encryption configurations
  • Encrypt attachments using standard encryption
  • Change a field or attachment's encryption type
  • Tokenize strings using encryption patterns
  • Repair or recover order-preserving encrypted data
  • Configure the IP address deny list
  • Encrypt data from a record producer
  • Define a custom encryption rule
  • Inspect the client request
  • Create an encryption rule
  • Encryption rule conditions
  • Encryption rule actions
  • Encryption rule objects and APIs
  • request
  • POST and URL parameter APIs
  • XML APIs
  • XMLContent
  • XMLElementIterator
  • XMLElement
  • JSON APIs
  • JsonNode
  • JsonNodeIterator
  • print(String message)
  • Prohibited keywords
  • Edge Encryption dictionary attributes
  • Domain separation and Edge Encryption
  • Data integration with Edge Encryption
  • ODBC driver integration
  • MID Server integration
  • Diagnostics and performance
  • Increase debug logging for the proxy
  • Database Encryption
  • Exploring Database Encryption
  • Requesting database key rotation
  • Database Encryption with Customer Controlled Switch
  • Access Management
  • Zero Trust Access
  • Explore ZTA
  • Activating ZTA
  • Configuring Session Access role
  • System properties
  • Session Access Audits
  • Tutorial: Use ZTA
  • Configure IDP attribute for Session Access
  • ZTA for Mobile
  • Continuous Authentication (CA)
  • Exploring CA
  • Policies
  • Metrics
  • System properties
  • Pre-work for CA
  • Activating CA
  • Configuring CA
  • Tutorial: Configure CA for a Table
  • Tutorial: Configure CA for a Data Class
  • High Assurance
  • SSO Login
  • Non-SSO login
  • Audit logs
  • Domain separation for service providers
  • Exploring domain separation
  • Delegating configuration options to customers
  • Domain assignment
  • Visibility domains and Contains domains
  • Domain scope
  • Concepts for service providers
  • Global queue v.2
  • Service provider connector
  • Installed with domain separation
  • Application support for domain separation
  • Recommended practices for service providers
  • Domain separation explained
  • Value proposition
  • Definition of domain separation
  • Domain separation hierarchies
  • Context and domain separation
  • Segregating and securing data
  • Cross tenant intelligence
  • Alternatives to domain separation
  • Evaluating the need for domain separation
  • Benefits of domain separation
  • How a database query works with domain separation
  • Domain separation levels of support
  • Service provider reference architecture
  • Decision trees
  • Dedicated instances
  • Hybrid solution
  • Service Integration Management (SIAM)
  • Domain separation terms
  • Domain-separate a custom table
  • Customizing domain properties and themes
  • Managing domain separation for specific uses
  • Configuring domain separation with the domain picker
  • Performance considerations
  • Setting up domain hierarchies
  • Checking domain logs for errors and warnings
  • Importance of the Default domain
  • Contains queries and domain access
  • Domain paths query method
  • Slow queries and SQL debugging
  • Before Query business rules
  • Avoiding domain path in scripts
  • Domain assignments
  • CSM plugin
  • Domain Separation Help
  • Setup and administration
  • Request domain separation
  • Domain separation plugin
  • Domain system properties and user preferences
  • Create a domain
  • Make a domain the default
  • Manually manage the domain for particular records
  • Domain Separated Tables
  • Domain Override Viewer
  • Enable or disable a domain
  • Add a domain field to a table
  • View upgraded processes or records in the global domain
  • Review overridden records
  • View domain relationships
  • Select a primary domain
  • Create Contains relationships between domains
  • Expand domain scope
  • Add domains to a visibility domains list
  • Grant visibility domains to an individual user
  • Create a domain-specific choice list
  • Advanced administration
  • Use domain selection menus
  • Enable domain selection menus in Core UI
  • Restrict access to the domain picker
  • Application properties
  • Domain Migration Tool
  • Process administration
  • Example: Domain specific applications
  • Enable logging and debug messages
  • View a real-time domain message
  • View a historical domain message
  • Troubleshoot domain separation errors
  • Post-Production Domain Separation Activation Utility
  • Domain Job Management
  • Delete by domain
  • Domain Separation Center
  • Configure the Domain Separation Center
  • Configure audits
  • Schedule audits
  • Execute audits immediately
  • View audits with warnings and errors
  • View running and pending results
  • View inactive audits
  • Security data filters
  • Create a security data filter
  • Default security filters
  • Authentication
  • Adaptive authentication
  • Activate adaptive authentication
  • Filter criteria
  • IP Filter
  • Create IP filter criteria
  • Role Filter
  • Create role filter criteria
  • Group Filter
  • Create group filter criteria
  • Location Filter
  • Activate Location Based Access
  • Create Location filter criteria
  • Tutorial: Use Location Filter criteria
  • Use Location Filter in Pre Authentication Context
  • Use Location Filter Post Authentication Context
  • Use Location Filter in MFA Context
  • Use Location Filter for Session Access
  • Identity Provider Attributes Filter
  • Attributes for SAML
  • Use as filter criteria for SAML
  • Attributes for OIDC
  • Use as filter criteria for OIDC
  • Authentication policy contexts
  • Pre authentication context
  • Post-authentication context
  • MFA context
  • Account recovery context
  • Session validation context
  • Activate session validation context
  • Tutorial: Configuring session validation
  • Authentication policies
  • Configure a policy
  • Add to an authentication policy context
  • Adaptive authentication events
  • Configure properties
  • Tutorial: Configure adaptive authentication
  • Adaptive authentication for Trusted Mobile apps
  • Activate Trusted Mobile app
  • Register a trusted device
  • Manage your trusted device
  • Registration details of registered devices
  • Trusted Mobile app troubleshooting
  • API Authentication
  • Certificate based authentication
  • OAuth
  • Token-based authentication
  • API Key and HMAC Authentication for inbound REST APIs
  • Activate API Key and HMAC Authentication
  • Configure API key - Token-based authentication
  • Configure HMAC - Token-based authentication
  • Cleaning up token Expiry
  • Basic authentication
  • Basic authentication restriction
  • Basic authentication exceptions
  • API access policy
  • REST API access policies
  • Activate REST API access policy
  • Create an authentication profile
  • Create REST API access policy
  • API access policy prioritization
  • REST API Auth Scope
  • Activate REST API Auth Scope
  • Properties and tables
  • Configure auth scope
  • Troubleshooting
  • SOAP API access policies
  • Activate SOAP API access policy
  • Create an authentication profile
  • Create SOAP API access policy
  • Create a global API access policy to protect SOAP APIs
  • Filter criteria for APIs
  • API Authentication Policies
  • Create a policy
  • Configure global blocking policy for APIs
  • System or Export Processors
  • Activate Processor access policy
  • Configure an Authentication profile
  • Authentication factors
  • Explore authentication factors for AI voice agents
  • Configure authentication factors for AI voice agents
  • Configure voice input for authentication factors
  • TOTP authentication
  • Push notification - Okta verify
  • Configure push notification (Okta Verify)
  • Soft PIN authentication
  • Configure Soft PIN
  • SMS OTP authentication
  • Email OTP authentication
  • Configure Email OTP
  • Knowledge-based authentication
  • Configure KBA
  • Create KBA questions
  • Create KBA answers
  • Map KBA questions to answers
  • AI voice agent service mapping with KBA
  • Certificate-based authentication
  • Set up
  • Log in
  • Custom instance URLs
  • Activate custom URLs
  • Set as the instance URL
  • Identity Provider
  • Datacenter job information
  • Generate SP metadata for SAML/SSO
  • Custom URL errors and fixes
  • Installation exits
  • IP range based authentication
  • IP Address Access Control
  • Find denied IP addresses
  • LDAP integration
  • Understand LDAP integration
  • LDAP integration requirements
  • LDAP integration setup
  • Install the LDAP X.509 SSL certificate
  • Define an LDAP server
  • Enable an LDAP listener and set system properties
  • Specify the LDAP attributes
  • Test an LDAP connection
  • Define LDAP organizational units
  • Create a data source for LDAP
  • Auto provision LDAP users
  • LDAP integration via MID Server
  • Configure LDAP connection monitoring
  • Import binary data through a MID Server
  • Troubleshooting LDAP integration via MID Server
  • Import and map data
  • LDAP transform maps
  • LDAP scripting
  • Set choice action for reference field imports
  • Verify LDAP mapping
  • LDAP integration troubleshooting
  • View the LDAP monitor
  • LDAP error codes
  • Send a one-time password when the LDAP server is down
  • LDAP record synchronization
  • LDAP refresh filters
  • LDAP extraction
  • Inactive LDAP user accounts
  • Use the userAccountControl field
  • LDAP script examples
  • Active Directory Application Mode (ADAM)
  • Configuring an instance
  • Set up the ADAM console
  • Create containers and organizational units
  • Delegation with ADAM
  • Populating ADAM Objects
  • Testing and troubleshooting
  • Backup and recovery
  • Use LDAPS with ADAM
  • Assign the certificate to ADAM
  • Export the public key certificate
  • ADAM access account
  • Test the LDAPS connections
  • Use ADAMSync to populate ADAM
  • Define ADAM user accounts
  • Set up ADAMSync
  • Install the ADAM configuration file
  • Example ADAM configuration files
  • Configure Microsoft AD for secure LDAPS communication
  • Set up a stand-alone certificate authority
  • Generate a certificate from an internal certificate authority
  • Test the LDAPS connectivity locally
  • Export the public key certificate to trust the LDAP certificate
  • LDAP global catalog usage
  • OpenLDAP minor schema modification
  • Modify the schema
  • Record LDAP deletions
  • Limit concurrent sessions
  • Explore limit concurrent sessions
  • Configure the plugin
  • Set a limit by user or role
  • Disable a limit by user or role
  • Local authentication
  • Login and authentication security
  • Explore login and authentication security
  • Define login scenarios
  • Employee self-service portal
  • Specify a login landing page
  • Specify lockout for failed login attempts
  • Make UI pages public or private
  • Password complexity requirements
  • Explore Password complexity requirements
  • Enable password policies on your instance
  • Password policy properties
  • Configure your password policy
  • Configure password for a user
  • Exclude passwords on your instance
  • Unsupported password characters
  • Password Reset
  • Modify notification email
  • Configure properties
  • Remember me
  • Configure the logout confirmation prompt
  • Implement a nonce
  • Nonce process flow
  • Implement a nonce
  • Multi-factor authentication
  • MFA enforcement
  • Changes due to the MFA enforcement
  • MFA enforcement properties
  • Troubleshooting MFA enforcement
  • Frequently asked questions
  • MFA enforcement requirements – What and Why
  • MFA enforcement scope
  • MFA enforcement timeline
  • MFA enforcement exception
  • MFA metrics
  • MFA types
  • MFA reset
  • Exploring MFA
  • Configuring MFA
  • MFA context
  • MFA verification methods
  • Web Authentication
  • Configuring with Biometrics
  • Authenticator configuration options
  • MFA factor policies
  • FIDO2 as an MFA factor
  • Configure FIDO2 as an MFA factor
  • SMS as an MFA factor
  • Activate the MFA with SMS plugin
  • Configure SMS as an MFA factor
  • Multi-factor authentication Providers
  • Configure MFA Provider
  • Vonage Provider custom configuration (Tutorial)
  • Email as an MFA factor
  • Configure Email as an MFA factor
  • MFA system properties
  • MFA criteria
  • Configure user-based multi-factor criteria
  • Configure role-based multi-factor criteria
  • Configure adaptive authentication policy-based multi-factor criteria
  • MFA with SSO
  • Configuring MFA with SSO
  • Reset MFA for users
  • MFA References
  • MFA Metrics
  • Using MFA
  • Set up MFA
  • Set up MFA on your user profile
  • Log in with MFA
  • Authenticator Applications
  • Change an Authenticator app
  • Web Authentication
  • Register a biometric authenticator
  • Register a hardware security key
  • MFA Dashboard
  • User Metrics
  • Log in Metrics
  • MFA Guided Setup
  • Multi-Provider single sign-on (SSO)
  • Activate Multi-Provider SSO
  • Properties, tables, and scripts
  • Multi-Provider SSO configurations
  • Configure Multi-Provider SSO properties
  • Create an external identity provider
  • Generate instance service provider (SP) metadata for SAML
  • Configure users for Multi-Provider SSO
  • Test IdP connections
  • Common IdP connection errors
  • Troubleshoot script issues with SAML
  • Log in using Multi-Provider SSO
  • Enable users to choose the identity provider for login
  • Use Service Portal with Multi-Provider SSO to redirect a URL
  • Account recovery (ACR)
  • Configure an ACR user
  • Account recovery properties
  • E-signature for Multi-Provider SSO
  • Activate Approval with e-Signature plugin
  • SSO approval for a SAML 2.0 authentication
  • SSO approval for an OIDC authentication
  • OIDC as a SSO identity provider
  • Create an OIDC configuration for SSO
  • Use Facebook-based SSO
  • Configure a Facebook-based SSO
  • SAML
  • Multi-Provider SSO (SAML) IdP authentication flow
  • Identity Provider (IdP) system properties
  • Set the IdP issuer URL
  • Set the AuthnRequest service URL
  • Set the SingleLogoutRequest service URL
  • (Optional) Enable signed logout requests
  • Service Provider (SP) system properties
  • Set the instance URL for SAML
  • Set the audience URL for SAML
  • Set up a NameID policy for SAML
  • Determine what User table field matches the NameID token
  • Set the IdP NameID policy
  • Values in the User table field for SAML
  • (Optional) Enable providing an authentication context class for SAML
  • (Optional) Set keystore properties for signing logout requests for SAML
  • Create a service provider key store for SAML
  • Install a service provider keystore for signing SAML requests
  • Create self-signed BCFKS keystore for SAML
  • (Optional) Advanced SAML properties
  • Install the identity provider certificate
  • Replace a missing certificate for SAML
  • Test the SAML integration
  • Multi-SSO (SAML 2.0) errors and fixes
  • Redirect single sign-on (SSO) logins
  • Clone an instance with a SAML integration
  • SAML 2.0 concepts
  • Typical SAML process flow (diagram)
  • Login (AuthnRequest) process flow
  • Logout (LogoutRequest) process flow
  • URL information for an SSO provider
  • SAML 2.0 configuration using Multi-Provider SSO
  • X.509 certificates for SAML
  • SAML Guided Tour
  • Integrating SAML 2.0 with other features
  • Add deep linking support for SAML
  • ADFS integration with SAML 2.0
  • Set up ADFS for SAML
  • Set up the instance for ADFS
  • Configure an ADFS relying party
  • Configure the ADFS relying party claim rules
  • Create a SAML logout endpoint
  • Test the ADFS configuration
  • (Workaround) Enable service provider-initiated authentication
  • (Workaround) Support Kerberos authentication
  • Azure AD Integration with SAML 2.0
  • Add ServiceNow from the gallery
  • Configure Azure AD SSO
  • Create an Azure AD test user
  • Assign the Azure AD test user
  • Configure ServiceNow
  • Email links with external authentication
  • Add E-Signature support for SAML
  • Migrating an existing SAML 1.1 integration to SAML 2.0
  • Update your existing SAML 2.0 integration
  • Sample SAML 2 responses after the update
  • SAML user provisioning
  • Administer SAML user provisioning
  • SAML 2.0 troubleshooting
  • Monitor the event queue for login activities
  • Event queue login events
  • OAuth authentication
  • OAuth 2.0
  • Set up OAuth
  • Activate OAuth
  • Set the OAuth property
  • Change OAuth password parameter
  • OAuth Inbound
  • Inbound Integrations
  • Auth Code Grant
  • Authorization Workflow
  • Configuration
  • Client Credentials Grant
  • Client Credentials Workflow
  • Configuration
  • Third Party Token Grant
  • User Token Flow
  • Service Token Flow
  • Configuration
  • JWT Grant
  • Workflow
  • Configuration
  • ROPC Grant
  • Password Grant Flow
  • Configuration
  • CIMD client integration
  • CIMD workflow
  • Configure a CIMD client
  • Update a CIMD client
  • Old Inbound integrations experience
  • OAuth authorization code grant flow
  • Authorize access to an OAuth endpoint using auth code flow
  • Authorization code flow state parameter requirement
  • Authorization code flow example: ServiceNow instance as authorization server
  • Create an endpoint for clients to access the instance
  • OAuth API response parameters
  • OAuth API request parameters
  • Create an OAuth JWT API endpoint for external clients (machine to machine integration)
  • Configure an OAuth OIDC provider for accepting third-party token
  • Configure client type for OAuth and SSO records
  • OAuth implicit grants
  • Client Credentials
  • Create the Client Credentials system property
  • Add the OAuth Application User
  • Manage OAuth tokens
  • Revoke an OAuth token
  • OAuth Outbound
  • Connect to a third-party OAuth provider
  • JWT Bearer
  • Set up OAuth provider with JWT Bearer grant type
  • Generate a JSON Web Token (JWT)
  • OAuth client APIs
  • OAuth parameters for default profile support
  • Private Key JWT Support for OAuth 2.0 Client Authentication
  • Configure Private Key JWT for OIDC based SSO
  • Configure Private Key JWT for Outbound OAuth
  • Create an outbound REST message
  • Personal authentication
  • Configuration
  • Get OAuth Token
  • Generate Auth URL
  • Activate Dashboard
  • Self-register to ServiceNow instance
  • Explore Self-register
  • Activate External User Self-Registration
  • External roles in self-registration
  • Configure a user registration configuration for external users
  • Configure Google reCAPTCHA for external user self-registration
  • Default registration form fields
  • Add a custom registration form field
  • Enable external user self-registration for Service Portal
  • Verify user self-registration requests
  • Token based authentication (User logins)
  • Time limited authentication
  • Explore Time limited authentication
  • Activate time limited authentication
  • Time limited authentication with SMS - Twilio Tutorial
  • Digest token authentication
  • Explore digest token authentication
  • Configure the digest properties for multi-provider single sign-on (SSO)
  • Sample digest token implementations
  • Sample Java digest algorithm for encryption
  • Sample C
  • Web Embeddables
  • Configure client session access role
  • Web service security
  • Explore Web service security
  • Configure mutual authentication
  • Access Control Lists
  • Explore Access Control Lists
  • ACL types
  • Datatype ACL
  • Create a datatype ACL
  • ACL control of function fields
  • Security jump-start - ACL rules plugin
  • Configure an ACL
  • Deny-Unless ACL
  • Allow ACL
  • Query ACLs
  • Secure records in an embedded list
  • Related record access
  • Contextual Security Manager
  • Prevent duplicate entries with Contextual Security: Role Management V2
  • Upgrade to Contextual Security: Role Management V2
  • Enable role auditing with Contextual Security: Role Management V2
  • Double-check form submission
  • Default deny property
  • Advanced ACL configuration
  • Provide external users access to a table
  • Apply ACL script conditions to reference fields
  • Apply ACLs to AJAXGlideRecord (client-side Glide record)
  • Evaluate the admin override at the access level
  • ACL debugging tools
  • ACL troubleshooting reference
  • ACL configuration watcher
  • Show ACL execution plan
  • Use the ACL configuration watcher
  • Access Analyzer
  • Exploring Access Analyzer
  • Using Access Analyzer
  • Using Evaluate access
  • View permissions for a user
  • View permissions for a role
  • View permissions for a group
  • Export Access Analyzer queries
  • Comparing user records
  • Comparing user access
  • Viewing previous search results in Access Analyzer
  • Permission evaluation
  • Frequently Asked Questions
  • Access Analyzer Debug logs
  • Access simulator
  • Exploring Access Simulator
  • Configuring the Access Simulator (Take actions)
  • Using the Access Simulator
  • Adding Roles to users
  • Removing Roles from users
  • Adding users to Groups
  • Removing users from Groups
  • Frequently Asked Questions
  • Access Insights
  • Exploring Access Insights
  • Configuring Access Insights
  • Using Access Insights
  • Access findings
  • Explore Access findings
  • Use Access Findings
  • Access management console
  • Explore Access management console
  • Use Access management console
  • Security Attributes
  • Security Attributes Fundamentals
  • Create Security Attributes
  • OOB (Out-of-Box) Security Attributes
  • Compound Security Attributes
  • Security Attribute Type
  • Field Query Roles and Restrictions
  • Configure a Field Query Role
  • Configure Field Query Restrictions
  • Scripting Governance Tool
  • Explore Scripting Governance Tool
  • Use Scripting Governance Tool
  • Scan for users who have scripted
  • Remove users from the Conditional Script Writer group
  • Manage Scripting Governance Tool
  • Machine identity access controls
  • Create a machine identity access control
  • Security Roles
  • Explicit Roles
  • Elevated privilege roles
  • Security_admin role
  • Elevate to a privileged role
  • Force administrators to manually elevate
  • Connections and Credentials
  • Explore credentials, connections, and aliases
  • Scope protections
  • Domain separation and Credentials and Connections
  • Connection & Credential configuration templates
  • Configure a template for OAuth JWT Bearer grant type
  • Create a configuration template
  • Get started with connections
  • Create a basic connection for PowerShell and SSH
  • Create an HTTP(s) connection
  • Create a JDBC connection
  • Create a JMS connection
  • Create connection attributes for IntegrationHub
  • Get started with credentials
  • Create a Connection & Credential alias
  • Set up OAuth integration via MID Server
  • Credential aliases for Discovery
  • Credential aliases for Orchestration activities
  • Create and test your credentials
  • Ansible Tower credentials
  • API key credentials
  • Applicative credentials
  • Basic authentication credentials
  • Chef server credentials
  • CIM credentials
  • Cloud credentials
  • Container image repository credentials
  • Infoblox credentials
  • JDBC credentials
  • JMS credentials
  • OAuth 2.0 credentials
  • SAP credentials
  • SNMP credentials
  • SSH credentials
  • VMware credentials
  • Windows credentials
  • Credential affinity for Discovery and Orchestration
  • Credentials troubleshooting
  • External credential storage
  • Request external credential storage for Discovery and Orchestration
  • External credential storage configuration
  • CyberArk credential storage integration
  • CyberArk integration configuration
  • Configure the CyberArk vault and install the AIM API
  • Import the CyberArk JAR file
  • Configure the MID Server for CyberArk AIM
  • Configure the MID Server for CyberArk CCP
  • Configure CyberArk for SNMPv2 credentials
  • Configure the CyberArk credential identifier
  • Configure AWS credentials on a CyberArk vault
  • Configure Azure credentials on a CyberArk vault
  • OAuth 2.0 authentication via MID Server using external credential storage
  • Configure a JAR file and credential identifiers
  • Configure CyberArk
  • Configure OAuth 2.0 credentials on CyberArk
  • Configure a connection to send OAuth request via the MID Server using external vault
  • Authentication Algorithms
  • Configure an authentication algorithm
  • Configure an Amazon Signature based Custom Algorithm
  • Configure a custom authentication algorithm
  • Check IP service affinity for Discovery and Orchestration
  • ServiceNow access control
  • Explore ServiceNow access control
  • Activate ServiceNow access control
  • Configure ServiceNow access control
  • Audit logging
  • Identity
  • Global Identity
  • Exploring Federated ID
  • Accessing Federated ID Criteria
  • Updating ID fields
  • Identity and Access Audit
  • Exploring Identity and Access Audit
  • Identity Audit Results
  • User Trails
  • Group Trails
  • Role Trails
  • ACL Trails
  • Security Auditable Fields
  • Configuring Tables and Fields
  • Configuring Retention Period
  • Supported and unsupported fields
  • Identity Center
  • Exploring Identity Center
  • Activating the Identity Center
  • Identity Center for users
  • Viewing Active Sessions
  • Viewing Login History
  • Viewing Registered Mobile Devices
  • Identity Metrics for administrators
  • Machine Identity Console
  • Exploring Machine Identity Console
  • Inbound integrations
  • Security findings
  • Accounts with no login for 100 days
  • Accounts using Basic Authentication
  • Integration accounts with Web Service Access set to false
  • Accounts performing both UI and API login
  • Metrics
  • Machine Identity Console Settings
  • Activating Machine Identity Console
  • Using Machine Identity Console
  • Role masking for AI agents
  • Agent Access Role Configuration
  • System for Cross-domain Identity Management (SCIM)
  • SCIM Provider
  • Exploring SCIM Provider
  • Activating the SCIM plugin
  • Tutorial: Configure SCIM for user provisioning with a Provider
  • Provisioning user using Basic Authentication
  • Provisioning user using OAuth
  • SCIM Troubleshooting
  • SCIM customization
  • SCIM customization properties and schemas
  • Create a SCIM Extension schema
  • Create a SCIM ETL definition
  • Handling unmapped fields
  • Creating a source definition
  • SCIM Client
  • Exploring SCIM Client
  • Activate the SCIM Client plugin
  • SCIM Client properties, tables, scriptable APIs, and logs
  • Create a REST message
  • Create a SCIM Provider
  • Create a SCIM Provider Resource Mapping
  • Create a SCIM attribute mapping
  • Attribute Mapping references
  • SCIM Client troubleshooting
  • Access observer
  • Configure access observation
  • Review Access Observer logs
  • Granular admin roles
  • Platform security granular admin roles
  • Additional resources
  • Virtual infrastructure security
  • Operating system security
  • Network security
  • Agentic AI security and governance
  • Permissions-based access control
  • Data protection
  • Agent traceability and monitoring
  • Governance and admin safeguards
  • AI threat protection
  • External AI agent security
  • Now Assist Guardian
  • Activate offensiveness protection for generative AI
  • Configure prompt injection attack protection
  • Configure sensitive topic filters
  • Export Now Assist Guardian logs
  • Configuring a Guardrail Service Provider
  • Create a custom guardian
  • Setup a Guardrail Service Provider
  • Create and secure an AI agent in Now Assist
  • Assess readiness
  • Plan your agent
  • Build your agent
  • Configure security controls
  • Test and validate
  • Go live and monitor

Access Control Lists

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.

    Explore ACLsLearn about Access Control Lists(ACLs).

    Configure ACLs

    Configure ACLs.

    Contextual Security Manager

    Learn about the about Contextual Security Manager.

    Advanced ACL Configuration

    Learn about Advanced ACL configurations and tools.
    Back to home page