---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Ensure MID Server Users Have Appropriate Access Levels

# Ensure MID Server Users Have Appropriate Access Levels {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Ensure MID Server Users Have Appropriate Access Levels

This guidance emphasizes the importance of restricting MID Server user accounts to the minimum necessary permissions within ServiceNow.
Granting admin-level privileges such asadmin,securityadmin, ordiscoveryadminto MID Server users creates a major security risk by violating the principle of least privilege and expanding the system's attack surface.
Show full answer Show less  
MID Server accounts act as a communication bridge between your ServiceNow instance and external systems, handling sensitive data and credentials. Excessive permissions increase the risk of attackers gaining broad access if the account is compromised.

## Practical Recommendations

* Regularly review MID Server user roles by checking the **User Roles \[sysuserhasrole\]** table.
* Ensure MID Server accounts do not have any administrative roles such as **admin** , **discoveryadmin**, or any other high-level admin roles listed.
* Assign only the **midserver** role and any additional custom roles strictly required for your integrations.
* Avoid temporary elevation of privileges to resolve issues without promptly removing those elevated permissions afterward.

## Security Implications

Granting unnecessary admin-level roles to MID Server users significantly increases the risk of unauthorized access, data exfiltration, and privilege escalation within your ServiceNow environment. Proper role assignment helps maintain secure and compliant operations by limiting exposure and maintaining strict access controls.

## Expected Outcomes

* MID Server functions effectively without requiring admin-level privileges.
* Reduced security vulnerabilities by minimizing the attack surface related to MID Server accounts.
* Improved adherence to security best practices such as the principle of least privilege.  
Verify that your MID Server user accounts does not have more the necessary granted permissions.
Granting the MID Server user account admin-level privileges (such as admin, security_admin or discovery_admin) presents a significant security vulnerability that violates the principle of least privilege and dramatically expands
the attack surface.

Administrators sometimes grant elevated permissions to quickly resolve connectivity issues or enable new integrations, then do not remove those permissions afterward. The result is a service account with far more access than
necessary to perform its legitimate functions of facilitating communication between the ServiceNow instance and external systems within your network.

Review the User Roles \[sys_user_has_role\] table for MID Server users and confirm that the following roles are not assigned:  

    access_analyzer_admin, activity_admin, actsub_admin, admin, advisor_admin, agent_security_admin, ai_user_admin, aig_admin,
    ais_admin, all_high_security_admin, aisa_admin, alm_admin, analytics_categories_admin, analytics_filter_admin, analytics_task_admin,
    announcement_admin, antivirus_admin, app_engine_admin, app_metadata_admin, app_template_admin, approval_admin, assessment_admin,
    assignment_rule_admin, asset_admin, auth_factors_admin, backup_restore_admin, business_process_admin, business_rule_admin, canvas_admin,
    catalog_admin, catalog_lookup_admin, certification_admin, change_admin, chart_admin, chat_admin, chat_analytics_admin, chat_survey_admin,
    client_script_admin, clone_admin, clone_profile_admin, cmdb_consumer_admin, cmdb_dedup_admin, cmdb_import_admin, cmdb_inst_admin,
    cmdb_ms_admin, cmdb_payload_admin, connection_admin, content_admin, core_ui_analytics_admin, cors_rule_admin, credential_admin,
    currency_admin, currency_instance_admin, currency_instance_report_admin, customer_admin, data_classification_admin, data_destruction_admin,
    data_manager_admin, data_policy_admin, decision_table_admin, df_connection_admin, discovery_admin, ecmdb_admin, email_access_notification_admin,
    email_account_admin, email_client_admin, embedded_help_admin, evam_admin, export_set_admin, external_app_install_admin, fal_service_admin,
    financial_mgmt_admin, form_admin, formula_admin, function_field_admin, graphql_schema_admin, guided_tour_admin, health_log_admin, hp_publisher_admin,
    iam_security_admin, iar_admin, image_admin, import_admin, inbound_integration_metering_admin, integration_action_admin, inventory_admin, itil_admin,
    itom_admin, kafka_admin, kafka_namespace_admin, knowledge_admin, live_feed_admin, megaphone_admin, metadata_admin, mi_admin, ml_admin,
    mobile_analytics_admin, mobile_metadata_report_admin, ms_perm_no_extextend_admin, nlq_admin, nlu_admin

## More information {#sc-ensure-mid-server-users-have-appropriate-access-levels__section_wc1_cqn_phc}

{#sc-ensure-mid-server-users-have-appropriate-access-levels__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | sys_user_has_role.table, mid_server_user.role |
| Configuration type | User Roles (/sys_user_has_role.do) |
| Data type | User Roles \[sys_user_has_role\] record |
| Recommended value | mid_server, and additional custom roles that may vary based on customer integrations |
| Default value | mid_server |
| Fallback value | N/A |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 5.7 * CVSS rating: Medium * Security risk details: Granting the MID Server user account admin-level privileges represents a significant security vulnerability that violates the principle of least privilege and dramatically expands the attack surface. The MID Server acts as a bridge between trusted internal networks and the ServiceNow instance, processing credentials, executing discovery probes, and handling sensitive configuration data. If a MID Server user account with excessive privileges is compromised, an attacker gains a powerful foothold with the ability to read, modify, or delete critical data across the entire ServiceNow instance. This could enable data exfiltration of sensitive CMDB information, manipulation of incident records, unauthorized access to customer data, or even privilege escalation to compromise additional systems. {#sc-ensure-mid-server-users-have-appropriate-access-levels__ul_g1g_3sf_xwb} |
| Functional impact | MID Server is expected to run as intended without admin-level privileges. |
| Dependencies and prerequisites | None |
[ ]

{#sc-ensure-mid-server-users-have-appropriate-access-levels__table_ajc_b43_3kb}