Configure Unique MID Server Users

Use unique user account for each of your MID Servers to promote auditability and security controls as well as least privilege access.

MID Server users authenticate MID Servers to the ServiceNow instance and enable communication to the instance. Configure each MID Server with a unique user account to promote auditability and security controls. Assigning a unique user account to each MID Server follows the principle of least privilege and enables proper identity and access management for your service accounts.

Configure each MID Server with a unique user account that has been assigned the mid_server role:

1. Navigate to All > User Administration > Users.
2. Create a user for each MID Server (for example, mid_server_prod_01, mid_server_dev_01).
3. In the Roles section, assign the mid_server role to each user account.
   Note:

   Roles cannot be assigned until after the record is saved.
4. Configure each MID Server to authenticate with its dedicated user account.
5. Verify no duplicate Logged in user values exist in MID Server [ecc_agent] table records.

For existing shared user accounts:

1. Identify all MID Servers sharing the same user account. (Records in the MID Server [ecc_agent] table that have identical Logged in user field values).
2. Create unique user accounts (User [sys_user] records) for each MID Server.
3. Update each MID Server's configuration to use its dedicated account.
4. Test connectivity before decommissioning the shared account.

More information

Attribute	Description
Configuration name	User [sys_user] and MID Server [ecc_agent] table records.
Configuration type	User [sys_user] and MID Server [ecc_agent] table records.
Data type	Table record
Recommended value	Each MID Server [ecc_agent] record should have a unique User [sys_user] record in it's Logged in user field. This user should have the mid_server role.
Default value	N/A
Fallback value	N/A
Category	Access control
Security risk	Severity score: 3.8 CVSS rating: Low Security risk details: When multiple MID Servers share the same user account, it is difficult to perform the following: Determine which specific MID Server performed an action Trace the source of suspicious or malicious activity Implement granular access controls per MID Server Investigate security incidents or operational issues Comply with security logging and attribution requirements
Functional impact	Creating unique user accounts for each MID Server has no functional impact on MID Server capabilities or performance. All MID Servers will continue to operate normally with the mid_server role permissions.
Dependencies and prerequisites	None