---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Limit basic authentication restriction allowed roles

# Limit basic authentication restriction allowed roles {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Limit basic authentication restriction allowed roles

Theglide.authenticate.basicauth.allowedrolessystem property in ServiceNow specifies which user roles can bypass the Basic Authentication Restriction gate without requiring multi-factor authentication (MFA).
This property contains a comma-separated list of roles exempt from MFA enforcement during Basic Auth login.
When enabled, users with these roles authenticate via Basic Auth without additional second-factor verification.
Show full answer Show less  
This role exemption check occurs before enforcement date tracking and any per-account reviews, and it is never logged as an exception. By default, the property includes only the `sncbasicauthapiaccess` role, which is a narrowly-scoped integration role. MID Server accounts inherit this allowed role indirectly through the `midserver` role hierarchy and do not need to be explicitly listed.

## Key Configuration Details

* Property Name: `glide.authenticate.basicauth.allowedroles`
* Type: System Property (String, comma-delimited list)
* Default and Recommended Value: `sncbasicauthapiaccess`
* Purpose: Define roles that bypass Basic Auth MFA requirements
* Location to Configure: Navigate to `/syspropertieslist.do` in your instance

## Security Considerations

It is critical to restrict this property to narrow, dedicated integration or service roles only. Including broadly-held roles such as `admin`, `itil`, or `sncinternal` introduces a high security risk (severity score 8.1 - High). These broad roles would grant every user holding them a permanent, unconditional MFA bypass that is not logged or reviewed, exposing your instance to unauthorized API access if credentials are compromised.

Because role-based bypasses are never logged as exceptions, misuse or over-broad configuration could silently enable attackers to authenticate via Basic Auth without a second factor.

## Functional Impact and Best Practices

* This property only affects users not otherwise allowed by earlier checks (such as WSAO accounts, oauthtoken requests, or active MFA sessions).
* MID Server access is handled independently and is not affected by this property's listed roles.
* Removing roles from the allowed list does not immediately deny access; affected users enter a review process with tracking before enforcement.
* Before making changes, verify that only dedicated integration/service roles remain in the list and that no regular interactive user roles are included.
* Ensure the plugin `com.snc.integration.multifactor.authentication` is active, and the feature is enabled via `glide.authenticate.basicauth.restriction.active`.

## Summary for ServiceNow Customers

By carefully managing the **glide.authenticate.basicauth.allowedroles** property, you control which roles can bypass Basic Auth multi-factor authentication restrictions. This enables secure integration scenarios where trusted service accounts need streamlined authentication, while protecting your instance from broad, silent MFA bypasses that could compromise security. Restrict this list to minimal, dedicated roles to maintain strong authentication controls and reduce risk.  
The glide.authenticate.basic_auth.allowed_roles property defines roles that bypass the Basic Authentication Restriction gate without multi-factor authentication.
This system property contains a comma-separated list of role names exempt from the [Basic authentication restriction](https://www.servicenow.com/docs/DtVq0Y888SZu2DXEdYVpYg "Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.") gate. When restriction is active, any interactive-login user holding one of the listed roles can authenticate through Basic Auth without multi-factor authentication or time-based one-time
password. This role check runs unconditionally, before enforcement-date tracking logic and before any per-account review in the Basic Auth Exception table. A role match is never logged as a tracked exception and always bypasses the
gate regardless of whether enforcement is enabled.

The out-of-box value is the single, dedicated role snc_basic_auth_api_access. Management, Instrumentation, and Discovery (MID) Server accounts pass this check without being separately listed. The
mid_server role inherits snc_basic_auth_api_access through the platform role hierarchy, so a MID Server account transitively holds the allowed role without appearing in this property
value.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Ensure the glide.authenticate.basic_auth.allowed_roles property is limited to snc_basic_auth_api_access or another narrowly-scoped, dedicated integration role. Remove any broadly-held role such as admin, itil, or snc_internal.

## More information {#sc-limit-basic-authentication-restriction-allowed-roles__section_more_info}

{#sc-limit-basic-authentication-restriction-allowed-roles__table_property_details__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.basic_auth.allowed_roles |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String (comma-delimited list) |
| Recommended value | snc_basic_auth_api_access |
| Default value | snc_basic_auth_api_access |
| Fallback value | \<None\> |
| Category | [Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: 8.1 * CVSS score: High * Security risk details: If this property includes a widely-held role such as admin, itil, or snc_internal, every user holding that role receives a permanent, unconditional bypass of the Basic Authentication Restriction gate. This is not a temporary tracking-mode allowance. Unlike a per-account exception, which is logged and individually reviewed, role-based matches are never logged and never reviewed. An over-broad role grants silent, undetectable multi-factor authentication bypass to every current and future holder of that role. An attacker who obtains a valid password through phishing, credential stuffing, or a prior breach authenticates directly against the API without satisfying a second factor. This exposure extends to the entire population holding the listed role. {#sc-limit-basic-authentication-restriction-allowed-roles__ul_9i1g_3sf_xwb} |
| Functional impact | This property takes effect for users not already allowed through an earlier checks. Earlier checks include WSAO accounts, oauth_token requests, an active TOTP or multi-factor authentication session, or the allowed_users list. Keep the value limited to snc_basic_auth_api_access or another narrowly-scoped, dedicated integration role. This does not affect MID Server accounts. The mid-server role holds snc_basic_auth_api_access through role containment, independent of this property literal value. Removing a role from this list doesn't immediately deny access. Affected users fall through the same tracking and review flow as any other basic-auth user. This review process provides a safety net before actual denial takes effect. Before narrowing or auditing this property, confirm that any role kept in the list is a dedicated integration or service role, not one held by ordinary interactive users. |
| Dependencies and prerequisites | Plugin com.snc.integration.multifactor.authentication must be Active. No effect unless glide.authenticate.basic_auth.restriction.active is true. |
[ ]

{#sc-limit-basic-authentication-restriction-allowed-roles__table_property_details}