---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Register an external authorization server for the ServiceNow MCP Server

# Register an external authorization server for the ServiceNow MCP Server {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create an OIDC Provider Configuration to register an external authorization server, such as Microsoft Entra ID or Okta, as a trusted token issuer for the ServiceNow MCP Server.

## Before you begin

* The issuer URI and OIDC metadata URL of the external authorization server must be available.
* The role required to manage OIDC Provider Configurations and OAuth Protected Resources must be assigned.

Role required: oauth_admin

## About this task

Registering an external authorization server involves creating an OIDC Provider Configuration that identifies the provider and defines how its tokens are validated. To advertise the protected resource to MCP clients, you also
confirm an OAuth Protected Resource record for the resource the MCP Server exposes.

## Procedure

1. Navigate to the OIDC Provider Configurations list.
2. Select New.
3. Complete the fields that identify the external authorization server:
   1. In the OIDC Provider field, enter a name for the provider configuration.
   2. In the Issuer URI field, enter the provider's issuer identifier.
   3. In the OIDC Metadata URL field, enter the provider's metadata discovery endpoint.
4. Set how tokens from the provider are validated and mapped:
   1. To validate the JTI claim on incoming tokens, select Enable JTI claim verification and set the JTI Claim field.
   2. In the User Claim and User Field fields, set the token claim used to identify the user and the ServiceNow user field it maps to.
   3. Set the OIDC Configuration Cache Life Span to control how long the instance caches the provider's metadata.

5. Select the Active check box, and then select Submit.
6. Confirm that an OAuth Protected Resource record exists for the resource the MCP Server exposes.  
   The OAuth Protected Resource record defines the resource that the Protected Resource Metadata endpoint advertises, including the resource identifier and the Glide APIs an authenticated client is allowed to call. See the reference topic for the field details.
{#mcp-3p-auth-task__register-mcp-external-auth-server-steps}

## Result

The external authorization server is registered as a trusted token issuer. MCP clients can now obtain a token from the provider and use it to authenticate to the ServiceNow MCP Server. Tokens from issuers that are not registered
and active are rejected.