Verification types in the base system

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Verification types in the base system

    ServiceNow's base system provides several verification types that serve as templates for designing custom verifications, primarily to support identity verification during password reset processes. These verification types facilitate secure user authentication either through user data, codes, or security questions and are tailored for different operational contexts including service desk assistance and self-service password resets.

    Show full answer Show less

    Key Verification Types and Their Uses

    • Personal Data Confirmation: Enables service desk agents to verify user identity by reviewing data from the User [sysuser] table without requiring user enrollment. Ideal for agent-assisted verification but not supported by the Password Reset Windows Application.
    • Personal Data: Requires users to answer questions based on their user table data with no enrollment needed. Multiple verifications of this type are supported in the Password Reset Windows Application.
    • Email Code: Sends a verification code to the user's registered or authorized email during password reset. Users enter this code on the Password Reset Verify page. Multiple verifications of this type are supported in the Password Reset Windows Application.
    • Google Authenticator: Users enter a code generated by their paired Google Authenticator app to verify identity during password reset.
    • Security Questions: Presents personal security questions that users must answer correctly to verify identity. Only a single verification of this type is supported in Password Reset and its Windows Application.
    • SMS Code: Sends a code to an authorized SMS-capable device for identity verification during password reset. Only a single verification of this type is supported in Password Reset and its Windows Application.
    • Mock: A non-functional verification type used for demonstration or testing purposes in password reset workflows. Not supported by the Password Reset Windows Application.

    Practical Considerations for ServiceNow Customers

    • Choose the verification type based on the password reset workflow and whether the process is agent-assisted or self-service.
    • Be aware of application support limitations, such as the Password Reset Windows Application's lack of support for Personal Data Confirmation and Mock verification types, and restrictions on multiple verifications for Security Questions and SMS Code types.
    • Use multiple verifications for Personal Data and Email Code types where supported to enhance security.
    • Customization is possible by creating custom password reset verification types based on these templates.

    Use a verification type in the base system as a template to design a custom verification.

    Table 1. Verification types in the base system
    Verification type Description
    Personal Data Confirmation Verifies user identity using data from the User [sys_user] table. The user data is displayed to a service desk agent. The agent verifies the data.

    Enrollment is not required for this type.

    Recommended for service desk-assisted processes.
    Note:
    The Password Reset Windows Application does not support the Personal Data Confirmation Verification type.

    See Personal data identification types and confirmation type verifications.
    Personal Data Verifies user identity using data from the User [sys_user] table. The user is required to answer questions.

    Enrollment is not required for this type.

    Note:
    The Password Reset Windows Application allows you to define and use multiple verifications of the Personal Data type.
    See Personal data identification types and confirmation type verifications.
    Email Code When a user requests password reset, the system sends a verification code to the email address in the user profile or to an email address that the user authorized during enrollment. To verify identity, the user then submits the code on the Password Reset Verify page.
    Note:
    The Password Reset Windows Application allows you to define and use multiple verifications of the Email Code type.
    See Personal data identification types and confirmation type verifications.
    Google Authenticator While requesting password reset, the user reads a code from the Google Authenticator app on a device that the user has paired. To verify identity, the user then submits the code on the Password Reset Verify page.
    Note:
    The Password Reset and Password Reset Windows Application support only a single verification of the SMS Code type.
    Security Questions Verifies user identity by presenting personal security questions that the user must answer correctly.
    Note:
    The Password Reset and Password Reset Windows Application support only a single verification of the Security Questions type.

    See Add a custom question to the Security Questions verification.
    SMS Code When a user requests password reset, the system sends a code to an SMS-capable device that the user has authorized. To verify identity, the user then enters the code on the Password Reset web page.
    Note:
    The Password Reset and Password Reset Windows Application support only a single verification of the SMS Code type.
    See SMS Code Verification type for Password Reset.
    Mock Not a functional identity verification. Demonstrates how to add a verification type in a Password Reset process.
    Note:
    The Password Reset Windows Application does not support the Mock verification type.
    • The enrollment UI macro for this verification gets the user input and returns the entered value in the enrollment processor.
    • The Password Reset UI macro for this verification gets input from the user and returns the entered value through the verification processor.