Enable MID Server Governance Checks

  • Release version: Australia
  • Updated March 27, 2026
  • 1 minute to read

    • Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers.

    Unused MID Servers that remain active create bidirectional security risk. Their credentials can still authenticate to the ServiceNow instance, giving an attacker a valid entry point. While active, the instance can still issue commands to them, extending the attack surface of instance compromise into infrastructure no one is monitoring.

    With MID Server governance you can keep track of the last usage of each MID Server and create a policy to decommission it after a period of inactivity. The default inactivity timeout for MID Servers is 30 days.

    Confirm that the mid.inactivity.timeout.enabled property exists in the System Properties [sys_properties] table and is set to true.

    More information

    Attribute Description
    Configuration name mid.inactivity.timeout.enabled
    Configuration type System Properties (/sys_properties_list.do)
    Data type Boolean
    Recommended value true
    Default value true
    Fallback value true
    Category Session management
    Security risk
    • Severity score: 4.6
    • CVSS rating: Medium
    • Security risk details: An attacker with access to an active MID Server could compromise the credential or impersonate the server and add output records to the ECC queue. An attacker wouldn't be able to use these credentials to horizontally traverse to other MID servers by inserting commands for them inside of ECC queue due to role restrictions on each MID Server user.
    Functional impact Inactive MID Servers are decommissioned on purpose.
    Dependencies and prerequisites None