---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict basic authentication external role exemption

# Restrict basic authentication external role exemption {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.authenticate.basic_auth.allow_snc_external property controls whether users with the
snc_external role are exempt from the basic authentication restriction.
The snc_external role is the base role for all external users of the instance---customers and portal constituents. Unlike the
other exception checks in the [Basic authentication restriction](https://www.servicenow.com/docs/DtVq0Y888SZu2DXEdYVpYg "Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.") gate, this check returns unconditionally. When a user holds this role, the value of the glide.authenticate.basic_auth.allow_snc_external property is the sole, final
determinant of whether that request is allowed. The property doesn't fall back to `allowed_users`, `allowed_roles`, or the `enforcement-date` tracking flow.

External and portal users have normal interactive sessions. They can complete multi-factor authentication (MFA) enrollment through the standard UI flow. Nothing in the platform blocks them from MFA enrollment the way Web Service
Access Only (WSAO) accounts are blocked. Whether an external user is exempt from MFA is governed by a separate, admin-configured MFA context policy mechanism, not a technical requirement. This property doesn't compensate for a
population that structurally can't satisfy MFA.

## Before enforcing this restriction {#sc-restrict-basic-authentication__id_j1b_zbp_dkc}

1. Navigate to /sys_properties_list.do on the instance.
2. Identify any integration or automation accounts that hold the `snc_external` role and use Basic Auth. Migrate them to a dedicated integration role or WSAO status.
3. Set the glide.authenticate.basic_auth.allow_snc_external property to <kbd class="ph userinput">false</kbd>.
{#sc-restrict-basic-authentication__ol_mdb_zbp_dkc}

## More information {#sc-restrict-basic-authentication__section_x4l_wh5_dkc}

{#sc-restrict-basic-authentication__table_a7c_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.basic_auth.allow_snc_external |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Category | [Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Data type | Boolean |
| Recommended value | false |
| Default value | true |
| Fallback value | true |
| Functional impact | Setting this property to `false` requires all `snc_external` users to satisfy MFA (or use allowed_users, allowed_roles paths) to continue using Basic Auth. Before disabling, verify that external integrations or automation accounts don't depend on this role. Migrate service accounts to a dedicated integration role or WSAO status instead. |
| Security risk | * CVSS score: 8.1 * CVSS rating: High * The external-role check returns unconditionally. Leaving the `glide.authenticate.basic_auth.allow_snc_external` property at its default value of <kbd class="ph userinput">true</kbd> grants every `snc_external` user an unconditional, unlogged Basic Authentication Restriction gate bypass. This applies to the entire external and customer-facing population. These users gain access regardless of MFA enrollment. This covers a broader population than other exception mechanisms in this control family. Unlike WSAO accounts, these users can enroll in MFA. The exemption here is a compatibility allowance, not a technical necessity. An attacker who obtains an external-role password can authenticate directly against the API. No second factor is required. |
| Dependencies and prerequisites | Takes effect only when glide.authenticate.basic_auth.restriction.active is `true`. |
[ ]

{#sc-restrict-basic-authentication__table_a7c_b43_3kb}