---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Set basic authentication restriction default decision
# Set basic authentication restriction default decision {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Set basic authentication restriction default decision
Theglide.authenticate.basicauth.restriction.defaultdecisionsystem property controls the automatic handling of basic-auth accounts during the Basic Authentication Restriction tracking period in ServiceNow.
It determines the default action applied to accounts when first detected or when their exception table entry is set to "Apply default from system property." This setting is critical for managing security risks related to basic-auth access, especially regarding multi-factor authentication (MFA) enforcement.
Show full answer Show less
## Key Features
* **Three possible default decisions:**
* **Maintain current login:** Allows unrestricted basic-auth API and UI login access.
* **Revoke Basic Auth API login:** Blocks API basic-auth access but leaves interactive UI login unaffected.
* **Convert to web service access only account:** Allows basic-auth API access but blocks interactive UI login, thereby enforcing MFA since no interactive session exists.
* Only applies when exception table rows are set to "Apply default from system property." Explicit per-account decisions override this default.
* Default value is "Maintain current login" which may create MFA bypass risks for unreviewed accounts.
## Key Outcomes
* **Security risk mitigation:** Changing the default to "Revoke Basic Auth API login" helps prevent unrestricted basic-auth API access on unreviewed accounts, reducing the risk of credential abuse and MFA bypass.
* **Enforcement impact:** Accounts not explicitly reviewed will lose basic-auth API access once enforcement begins if the default is changed to revoke; UI access remains intact.
* **Recommended action:** Before or immediately after changing the default property, review all accounts in the Basic Auth Exception table to convert legitimate integration accounts to Web Service Access Only and explicitly grant access only where necessary.
## Practical Considerations for ServiceNow Customers
To enhance security and comply with MFA policies, customers should consider updating the **glide.authenticate.basicauth.restriction.defaultdecision** property from its default setting. This ensures that new or unreviewed accounts do not automatically retain risky basic-auth API access. Conducting a thorough review of the Basic Auth Exception table is essential to avoid inadvertently blocking necessary integrations while enforcing tighter security controls.
The glide.authenticate.basic_auth.restriction.default_decision property controls the automatic decision applied to basic-auth accounts during the Basic Authentication Restriction tracking
period.
This property sets the decision automatically applied to a basic-auth account the first time it is detected during the [Basic authentication restriction](https://www.servicenow.com/docs/DtVq0Y888SZu2DXEdYVpYg "Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.") tracking period. This decision also applies to any account whose per-row entry in the Basic Auth Exception table is explicitly left as Apply default from system property.{#sc-set-basic-authentication-restriction-default-decision__set-basic-authentication-restriction-default-decision-para-1}
Three outcomes are available:{#sc-set-basic-authentication-restriction-default-decision__set-basic-authentication-restriction-default-decision-para-2}
* **Maintain current login**: Keeps unrestricted basic-auth access.
* **Revoke Basic Auth API login**: Blocks API basic-auth once enforcement begins. UI login is unaffected.
* **Convert to web service access only account**: Keeps basic-auth API access but blocks interactive UI login for that account, satisfying multi-factor authentication (MFA) policy because it no longer has an interactive session to protect.
## More information {#sc-set-basic-authentication-restriction-default-decision__section_mwc_wwc_2kc}
{#sc-set-basic-authentication-restriction-default-decision__table_7ou_ijk_2ik__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.basic_auth.restriction.default_decision |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Data type | String (Choice list) |
| Recommended value | Revoke Basic Auth API login-Basic Auth API login blocked; UI login allowed |
| Default value | Maintain current login-Basic Auth API and UI login allowed |
| Fallback value | Maintain current login-Basic Auth API and UI login allowed |
| Category | [Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: 8.1 * CVSS rating: High * Security risk details: When left at the default Maintain current login, two groups of accounts automatically keep unrestricted basic-auth API access. The first group: accounts first detected using basic auth during tracking. The second group: accounts an administrator leaves on Apply default from system property. Neither group satisfies multi-factor authentication (MFA) once enforcement begins. This creates the same credential-abuse exposure as any unrestricted basic-auth account. An attacker who obtains a valid password can use it directly against the API. They bypass the MFA that would otherwise protect interactive login. Because this is the default applied to unreviewed accounts, an instance that runs through tracking without changing this property grandfathers every detected account into permanent MFA bypass. This requires no deliberate administrator action. {#sc-set-basic-authentication-restriction-default-decision__ul_g1g_s56_xwb} |
| Functional impact | This property only takes effect for exception-table rows resolved to Apply default from system property. Any per-account decision in the exception table overrides this system property default. Changing the default to Revoke means any account an administrator has not yet explicitly reviewed will lose basic-auth API access once enforcement begins. UI login remains unaffected. Before or immediately after changing this default, complete the review of the Basic Auth Exception table: 1. Convert genuine integration accounts to Web Service Access (WSO) Only 2. Explicitly grant continued access only where justified {#sc-set-basic-authentication-restriction-default-decision__ol_nfk_kxc_2kc} Completing this review confirms unreviewed accounts retain API access. |
| Dependencies and prerequisites | None |
[ ]
{#sc-set-basic-authentication-restriction-default-decision__table_7ou_ijk_2ik}