---
sourceDocument: Xanadu Employee Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/employee-service-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Employee Service Management

ft:clusterId :

    - emplsm

bundleId :

    - emplsm

workflow :

    - Employee


---

# Simplifying the authentication experience for your remote employees

# Simplifying the authentication experience for your remote employees {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

With the Issue Auto Resolution application, you can simplify the
authentication experience for your remote employees. Instead of entering a user name and
password to access the service portal, your remote employees can get to the portal through a
link in a short messaging service (SMS) or email.
By using the Issue Auto Resolution application, your remote employees
who don't have the corporate credentials can still access your service portal
without entering a user name and password. When you create a case for the employee,
that employee gets a link through a text (SMS) or email. That link directs them to
the login page where they're prompted to enter a user name and password. With this
simplified authentication experience feature, these employees, who fulfill the user
criteria mentioned in the sn_iar_hr.digest_link_user_criteria
system property, can access the portal without entering credentials.

You can install the Time Limited Authentication
(com.snc.authenticate.time_limited_authentication) plugin to extend the core
functionality of the Issue Auto Resolution application.

## Successful and simplified login experience {#iar-simplified-authentication-experience__section_crg_5h1_dwb}

Let's say that a remote employee recently joined your organization. Your employee
doesn't have the corporate credentials to access the service portal but that
employee has a query about the dental benefits enrollment. With the Issue Auto Resolution application, your employee can access the
service portal through an email by using a personal device.

The following example shows how a remote employee can log in to the portal without
credentials by using a digest link.
Figure 1. Simplified log in experience for remote workers  
The process is as follows:

1. The remote employee gets the digest link through an email.
2. The link directs the employee to verify the identity page, where the employee has to enter a one-time password (OTP) received through an email.
3. The employee is then directed to the standard ticket page, where the employee can view the recommendations.  
   Note:  
   The link's validity depends on the values that are defined in the time-limited authentication configuration record. In this case, the maximum number of times an employee can use the link is set to one.
4. The employee is redirected to the expired link page when the employee tries to use the same link again.
5. The employee gets an email with a new digest link.
{#iar-simplified-authentication-experience__ol_ipc_fh1_dwb}

## Time-limited authentication {#iar-simplified-authentication-experience__section_rz1_w5b_dwb}

You can do the following tasks to set the existing time-limited authentication properties:

* Enable the time-limited authentication glide.authenticate.enable.time_limited_authentication property.
* Disable the account recovery property.
* Enable multi-provider single sign-on (SSO).
* Enable the Active field in the time limited authentication properties config record.

{#iar-simplified-authentication-experience__ul_y5f_vtt_cwb}To learn how to configure the properties, see [Time Limited Authentication Properties form](https://www.servicenow.com/docs/wHMYUARp7hRg2deXCW2ObQ "Use the Issue Auto Resolution time-limited authentication record to set the fields that are related to the link's validity, expiry, and failed redirect.").

To learn more about time-limited authentication, see [Time limited
authentication](https://www.servicenow.com/docs/access?context=time-based-authentication-with-mfa&version=xanadu&pubname=xanadu-platform-security&ft:locale=en-US).

## User criteria for generating the digest link {#iar-simplified-authentication-experience__section_mlg_bvb_dwb}

You can use the sn_iar_hr.digest_link_user_criteria system property to get and
validate the user criteria for generating the digest link. This link appears in an
SMS or email that is sent to the employee. The value should be the sys_id of the
active user criteria. For more information, see [User criteria
form](https://www.servicenow.com/docs/YVEYJh1JKghvUutwEVukGQ "ServiceNow Universal Request empowers customers in their journey toward Enterprise Service Management (ESM) or Global Business Services (GBS) by enabling agents to resolve cases seamlessly across the enterprise to provide a better employee experience.").

Users with the admin and sn_hr_core.admin roles can assign the
sn_iar_hr.digest_link_user role. This role is added to the available user criteria
to validate if that user qualifies for digest link generation.