---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict MID Server users from authenticating using UI

# Restrict MID Server users from authenticating using UI {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Reduce risk from a compromised MID Server account by disallowing UI authentication.
MID Server service accounts are automated system accounts that facilitate secure communication between the ServiceNow instance and resources behind your organization's firewall. These accounts should operate under the principle of least privilege, meaning they should only possess the minimum permissions necessary
to perform their designated functions. Allowing UI authentication for MID Server accounts creates an unnecessary attack surface.

For each MID Server user record in the User \[sys_user\] table, confirm that the web_service_access_only field is set to "true".

## More information {#sc-restrict-mid-server-users-from-authenticating-via-the-ui__section_wc1_cqn_phc}

{#sc-restrict-mid-server-users-from-authenticating-via-the-ui__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | User \[sys_user\] table and mid_server_user.web_service_access_only |
| Configuration type | User \[sys_user\] table (/sys_user_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | N/A |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 3.8 * CVSS rating: Low * Security risk details: If a MID Server account is compromised, an attacker with UI access could use the web interface to modify configurations or access sensitive data within the ServiceNow environment. By restricting these accounts to web service access only (setting web_service_access_only to true for MID Server users), organizations help ensure that MID Server credentials can only be used for their intended purpose of service to service communication. {#sc-restrict-mid-server-users-from-authenticating-via-the-ui__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-restrict-mid-server-users-from-authenticating-via-the-ui__table_ajc_b43_3kb}