Basic trust configuration for data sync applications
Summarize
Summary of Basic trust configuration for data sync applications
ServiceNow enables certain applications to provide data visibility across multiple instances within a customer account. This cross-instance data sharing is governed by a trust configuration that is set per instance and per application. Administrators can manage data sharing permissions for both production and non-production instances to meet specific business requirements.
Show less
Key Features
- Trust Configuration Management: Accessible via All > Multi-Instance Management > Trust Configuration, this interface allows admins to configure which instances can share application data with each other.
- Default Sharing Settings: Non-production instances by default allow data sharing with production instances only, while production instances do not share data with any other instances.
- Role-Based Editing: The Grant access column shows permissions the current instance grants to others, which can be edited by the admin. The Is granting access column shows permissions granted by other instances to the current instance and is read-only.
- Instance Type Changes Reset Permissions: Promoting or demoting an instance between production and non-production resets all previous custom data sharing configurations to default.
Practical Examples and Usage
- When logged into a production instance (e.g., Prod1), you can grant or revoke access for another instance (e.g., Prod2) for a specific application by changing the Grant access value.
- From a non-production instance (e.g., Prod2), you can similarly grant or revoke data sharing access to a production instance by updating the Grant access value.
- For sub-production instances (e.g., Sub-prod2 or Sub-prod3), trust relationships can be viewed and modified to control data sharing permissions between sub-production and production instances.
- The configuration ensures mutual or one-way data sharing control, depending on business needs, helping maintain data security and appropriate visibility.
Key Outcomes
- Admins gain fine-grained control over data sharing between instances, ensuring data visibility aligns with organizational policies and compliance requirements.
- The ability to reset sharing settings automatically upon instance promotion/demotion helps maintain consistent security postures.
- Clear indicators in the interface simplify understanding the current trust relationships and facilitate efficient management of data access rights.
Certain ServiceNow applications have the ability to provide data visibility across instances within a customer’s account.
Data visibility is protected by a trust configuration per instance, per application. You can configure the data sharing for production and non-production instances for the applicable applications by navigating to .
By default, non-production instances allow application data sharing with production only. Production instances do not allow application data sharing with any other instance. However, these can be updated by the admin for each instance based on business needs.
If you demote a production instance to non-production, or promote a non-production instance to production, all previous customizations to data sharing settings are reset to the default configuration.
The Grant access column indicates the permission granted by the instance that you’re currently logged in to for the instance named in the same row’s instance column. The Is granting access column displays whether or not the instance mentioned in the Instance column has granted access to the instance you’re currently logged in to; it can’t be edited.The following are some examples for data sharing restrictions between instances.
Logged in to Prod1
In the following example, you’re logged in to Prod1. Prod1 has granted access to the instance Prod2 for the application Subscription Management, as indicated by the True value in the Grant access column.
Prod2 hasn’t granted access to Prod1, as indicated by the False value in the Is granting access column.
To revoke access for the Subscription Management app from Prod1 to Prod2, update the value in the Grant access column to False while logged in to Prod1.
Logged in to Prod2
In the following example, you’re logged in to Prod2. Prod1 has granted access to the instance Prod2 for the application Subscription Management, as indicated by the True value in the Is granting access column.
Prod2 hasn’t granted access to Prod1, as indicated by the False value in the Grant access column.
To grant access from Prod2 to Prod1 for the Subscription Management application, update the value in the Grant access column to True while logged in to Prod2.
Logged in to Sub-prod2
In the following example, you’re logged in to Sub-prod2. Prod1 hasn’t granted access to the instance Sub-prod2 for the application Subscription Management, as indicated by the False value in the Is granting access column.
Sub-prod2 has granted access to Prod1, as indicated by the True value in the Grant access column.
To revoke access from Sub-prod2 to Prod1 for the Subscription Management application, update the value in the Grant access column to True while logged in to Sub-prod2.
Logged in to Sub-prod3
In the following example, you’re logged in to Sub-prod3. Sub-prod4 has granted access to the instance Sub-prod3 for the application Subscription Management, as indicated by the True value in the Is granting access column. Sub-prod3 has also granted access to Sub-prod4, as indicated by the True value in the Grant access column.