---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Pre-work for CA

# Pre-work for Continuous Authentication {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Perform the following pre-work before using Continuous Authentication (CA).

CA is built on ServiceNow's zero trust access security architecture that aims to enhance security by verifying that the user remains who they claim to be, even after the initial authentication process.  
Note:  
You must install the Zero Trust - Continuous Authentication (`com.snc.zero_trust_continuous_authentication`) to opt in to CA, which requires a license.

CA configuration can be performed based on the following:

* [LDAP or Local login (Username and Password)](https://www.servicenow.com/docs/u_DQ6kp5x6tkpvHnAatKKw#pre-work-ca__section_jqr_nhw_ycc)
* [SSO login (SAML or OIDC)](https://www.servicenow.com/docs/u_DQ6kp5x6tkpvHnAatKKw#pre-work-ca__section_plh_4hw_ycc).

{#pre-work-ca__ul_fj1_pj2_ddc}

## CA for local login {#pre-work-ca__section_jqr_nhw_ycc}

When the users are performing local login and to verify the identity of the users, MFA is used as an authentication mechanism. If the users haven't set up MFA, it is compulsory to complete the setup.  
Note:  
* From Yokohama, MFA is enforced for users for every login to ServiceNow performing local login.
* Make sure the MFA properties are Active and configured based on your requirement. To learn more about MFA properties, see [Multi-factor Authentication system properties](https://www.servicenow.com/docs/Bd8zZ0XuXsmK5n0mFq00gw "Use system properties to enable and customize MFA to meet your security requirements.").
{#pre-work-ca__ul_tzb_ydc_d2c}

To learn more, see [High assurance session for non-SSO login](https://www.servicenow.com/docs/O2UeynGhsVl6qbsude3GWQ "Establish a high assurance session for non-SSO logins (local or LDAP) with ServiceNow continuous authentication.").

## CA for SSO login {#pre-work-ca__section_plh_4hw_ycc}

When the users are performing SSO based login (SAML or OIDC). To verify the identity of the users, the same SSO used during initial login is shown as the reverification with re-authentication or IdP's MFA.  
Note:  
* You must install the Zero Trust - Continuous Authentication (`com.snc.zero_trust_continuous_authentication`) to opt in to CA, which requires a license.
* Activate the Integration - Multiple Provider Single Sign-On Installer (com.snc.integration.sso.multi.installer) plugin.
{#pre-work-ca__ul_crf_1kc_d2c}  
You must configure the identity provider (IdP) for CA as follows:

* Enable the check box that must be set on a given multi SSO record to validate that the set is ready for using CA.
* For OIDC, CA relies on redirecting back to the `api/now/continuous_authentication/high_assurance/oidc/consumer` endpoint, which must be configured on the IdP. Both re-authentication and IdP's MFA options are available.
* For SAML, the SSO records use the default re-authentication script for all Identity Providers (IdP) to support re-authentication.  
  Note:  
  * To configure step up for Okta you can use the ContinuousAuth_Okta_StepUp_Script in the IdP record. To learn more, see this [documentation](https://developer.okta.com/docs/guides/step-up-authentication/main/).
  * To configure step up for Entra ID or Azure you can use the ContinuousAuth_Azure_StepUp_Script and add the required claim. To learn more, see this [documentation](https://learn.microsoft.com/en-us/entra/identity-platform/developer-guide-conditional-access-authentication-context).
  {#pre-work-ca__ul_d2s_phy_mdc}
{#pre-work-ca__ul_yn3_ljz_3dc}

To learn more, see [High assurance for SSO login](https://www.servicenow.com/docs/TkWIRdWigDu9pqJDTtb71Q "Establish a high assurance session for SSO login with ServiceNow continuous authentication.").
**Related concepts**   

* [Exploring Continuous Authentication](https://www.servicenow.com/docs/_kJBRfk~J9nZC3TujI~svQ "ServiceNow's continuous authentication (CA) enables you to re-verify and authenticate a user if they access resources that are protected by you.")  
**Related tasks**   

* [Activate Continuous Authentication](https://www.servicenow.com/docs/kOp1XBrAy_7K1E932VtvXQ "To activate the Continuous Authentication feature on your instance, install the Zero Trust - Continuous Authentication (com.snc.zero_trust_continuous_authentication) plugin.")
* [Configure Continuous Authentication](https://www.servicenow.com/docs/35wTHNadPCtuuTNpq7qEiA "Configure continuous authentication (CA) policies to re-authenticate the users if there's an attempt to access resources that are protected by you.")