---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Basic authentication restriction

# Basic authentication restriction {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Basic Authentication Restriction

Basic authentication restriction is a security feature in ServiceNow that controls which accounts are permitted to use basic authentication on an instance.
It enables administrators to review accounts that use basic authentication, assign specific access decisions per account, and configure enforcement settings to enhance security by limiting access methods.
Show full answer Show less  

## Key Features

* **Review and Decision Assignment:** Administrators can review identified users on the Basic Auth Restriction page and assign one of several decisions per account before enforcement begins.
* **Decisions for Identified Users:**
  * **Maintain current login:** Allows both Basic Auth API and UI logins by granting the `sncbasicauthapiaccess` role.
  * **Revoke Basic Auth API login:** Blocks Basic Auth API login but allows UI login by withholding the exception role.
  * **Convert to web service access only account:** Allows API login but blocks UI login; no roles assigned.
  * **Apply default system property:** Access is granted or denied based on the global property `glide.authenticate.basicauth.restriction.defaultdecision`.
* **Enforcement Controls:** Administrators can configure when enforcement begins and whether it is active or in tracking mode.
* **Security and Access Requirements:** Enforcement blocks basic authentication requests unless the account has Web Services Access Only (WSAO), valid MFA one-time password, or the `sncbasicauthapiaccess` role.
* **Feature Toggles:** Separate toggles control the overall feature activation and enforcement status, allowing emergency disablement or tracking without enforcement.
* **Role Requirement:** Changes require the `securityadmin` role, and the Basic Auth Restriction page is read-only based on protection policies.

## Key Outcomes

* **Improved Security:** Restricts basic authentication use to approved accounts, reducing risk from unauthorized API or UI logins.
* **Granular Control:** Allows administrators to tailor authentication permissions at the account level before enforcing restrictions.
* **Flexible Enforcement:** Enables a tracking period where accounts are monitored without blocking access, facilitating informed decision-making.
* **Emergency Management:** Feature toggles provide quick options to disable enforcement if needed without complex configuration changes.  
Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.
The Basic Auth Restriction page provides guidance on available actions and controls the enforcement configuration. Administrators are prompted to review the identified users and take action before the enforcement period begins.  
Important:  
The Basic Auth Restriction page is read-only based on its protection policy. The `security_admin` role is required to make any changes.

Navigate to AllBasic Auth RestrictionProperties to open the page.

## Actions available for identified users {#basic-auth-restriction__bar-take-action}

Review the Identified Users table and set a decision for
each account. The following decisions are available:

Maintain current login --- Basic Auth API and UI login allowed
:   The `snc_basic_auth_api_access` role is granted to the
    account. Basic authentication access continues when enforcement
    begins.

Revoke Basic Auth API login --- Basic Auth API login blocked and UI login
allowed
:   The account is not granted the exception role. Basic auth access fails
    when enforcement begins.

Convert to web service access only account --- Basic Auth API login allowed
and UI login blocked
:   The account is converted to a web service access only account. The account can't make UI logins, but basic authentication continues to work past the enforcement period. No roles are assigned.

Apply default from system property
:   Basic auth access is granted or denied based on the decision configured in
    the global property
    `glide.authenticate.basic_auth.restriction.default_decision`.
    Review or change this on the property page.

Administrators should also review and adjust the start of the enforcement period
from the enforcement schedule job.

## How enforcement works {#basic-auth-restriction__bar-how-enforcement-works}

Once enforcement is enabled, basic authentication requests are blocked unless the
requesting account matches one of the following:

* Accounts having Web Services Access Only (WSAO).
* Accounts presenting a valid MFA one-time password.
* Accounts having the `snc_basic_auth_api_access` role.

## Basic Auth Restriction settings {#basic-auth-restriction__bar-settings}

The Basic Auth Restriction page includes the following configurable
settings:

Default value
:   The default decision applied to new rows in the Basic Auth Exception table
    during the tracking period. Per-row decisions in the Basic Auth Exception
    table override this default.

Feature toggle
:   A feature toggle for the Basic Authentication restriction feature on the
    instance. When unchecked (false), no enforcement occurs regardless of the
    value of `glide.authenticate.basic_auth.restriction.enforce`.
    Use this as an emergency disable to halt the feature without changing other
    settings.

Enforcement toggle
:   Controls whether enforcement is active. When unchecked (false), accounts
    using basic authentication are recorded but no requests are blocked ---
    tracking mode. When checked (true), basic authentication requests are blocked
    unless the requesting account is on the allow-list --- enforcing mode. Has no
    effect when the feature toggle is set to false.

*[\>]: and then