Combined Authentication release notes for upgrades from Xanadu to Zurich

  • Release version: Zurich
  • Updated July 20, 2026
  • 8 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Combined Authentication Release Notes for Upgrades from Xanadu to Zurich

    This document consolidates the release notes for ServiceNow Authentication from the Xanadu through Zurich releases, helping customers understand key new features, changes, and deprecations to prepare for upgrading Authentication to the Zurich release.

    Show full answer Show less

    Authentication remains an active ServiceNow AI Platform product by default across all releases.

    New Features

    • Yokohama Release: Introduced Continuous Authentication to require step-up or re-authentication before granting access to sensitive information. Added support for various OAuth grant types (Authorization Code, Resource Owner Password Credential, SAML bearer, JWT bearer) for outbound integration requests through MID Server.
    • Zurich Release: Launched Machine Identity Console for simplified inbound integration management. Introduced a Multi-factor Authentication (MFA) Dashboard to monitor MFA enrollment, privileged admin compliance, and overall MFA status. Added MFA Guided Setup to assist administrators in enforcing MFA for users currently using username and password only. Enabled filtering authentication based on attributes from OIDC identity provider responses.

    Changes

    • Xanadu: Expanded MFA factor options to include FIDO2 authenticators, passkeys, biometric authenticators, and hardware security keys without requiring an authenticator app setup.
    • Yokohama: Mandated MFA for all non-SSO login users.
    • Zurich: Enhanced the Single Sign-On (SSO) login and logout experience with features such as displaying active SAML and OIDC IdPs on login pages, assigning users to groups during SAML/OIDC auto-provisioning, supporting multiple OIDC configurations using the same well-known URL, and improving login failure messaging. Added enhanced email notifications for SAML certificate and encryption key updates. Introduced FIDO2 enforcement policies as an MFA factor. OAuth integrations now support longer client secrets, JWKS URL for automatic public key updates, and additional JWT signing algorithms with customizable JWT claim names.

    Deprecations

    • Xanadu: Deprecated MultiSSO v1 plugin—customers should upgrade to MultiSSO v2. Also deprecated SAML 1.1 plugins and OpenID SSO plugin; these have been replaced by configurations under MultiSSO v2 for SAML 2.0 and OIDC support.
    • Zurich: Deprecated certain inbound integration configurations in the Application Registry due to the new Machine Identity Console, including OAuth API endpoints for external clients and OIDC provider verification methods.

    Additional Highlights

    • OAuth inbound integrations now allow specifying a Provider name to improve monitoring and distinguish between integrations.
    • OAuth enhancements include support for opaque and JWT token types, scope-based API access control, and resource parameter configuration for outbound integrations.
    • Authentication factors for AI voice services have been introduced to enable caller access by configuring required identification and authentication factors.

    Upgrade Guidance

    Before upgrading to Zurich, it is important to review and complete any pre- and post-upgrade tasks related to Authentication. Customers should especially note plugin deprecations and migrate accordingly to maintain support and functionality.

    Familiarize yourself with new MFA and SSO enhancements to improve security posture and user experience.

    Consolidated page of all release notes for Authentication from Xanadu to Zurich.

    How to use this page

    To help you prepare for your upgrade, we have combined the cross-family Authentication release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Zurich.

    Tip:
    If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

    Important information for upgrading Authentication to Zurich

    Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    New features

    Between your current release family and Zurich, new features were introduced for Authentication.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama
    Continuous Authentication
    Use Continuous Authentication to require step-up authentication or re-authentication to the users before allowing access to sensitive or high-privilege information.
    OAuth Grant Types for MID Server
    Use the Authorization code, resource owner password credential, SAML bearer, and JWT bearer OAuth grant types of OAuth for outbound integration requests through the MID Server. Personal Auth is also supported through the MID server. MID Servers facilitate communication and data movement between a single ServiceNow® instance and external applications, data sources, and services.

    Zurich
    Machine Identity Console
    Manage your inbound integration with ServiceNow's Machine Identity Console. Inbound integration in Machine Identity Console provides a simplified configuration experience for your inbound integrations.
    Multi-factor Authentication dashboard
    Use the new MFA Dashboard to understand insights such as MFA user enrollment, privileged admins who haven't opted in to MFA, and compliance. You can verify that all users have MFA enabled for enhanced security with the help of the MFA Dashboard.
    Multi-factor Authentication Guided Setup
    Use the new MFA Guided setup to configure multi-factor Authentication (MFA) for users who currently log in to ServiceNow with only a user name and password. This update enhances security by guiding administrators through the MFA setup process and verifying that all users are protected with an additional layer of authentication.
    Attributes for OIDC
    Use the Identity Provider (IDP) Attributes received from the OIDC response from the Identity Provider as a filter criteria for authentication.

    Changes

    Between your current release family and Zurich, some changes were made to existing Authentication features.

    Release Release notes

    Xanadu
    Multi-factor Authentication (MFA)
    Use the FIDO2 authenticator, passkeys, biometric authenticators, and hardware security keys as multi-factor authentication (MFA) factors without requiring an authenticator app setup.

    Yokohama
    Multi-factor authentication (MFA) enforcement
    MFA is mandated and is enforced to all the non-SSO login users accessing ServiceNow®.

    Zurich
    Enhanced SSO login and logout experience
    Use the enhanced SSO login and logout experience. Enhancement includes:
    • Display of active SAML and OIDC Identity Providers (IdPs) on the ServiceNow platform and portal login pages.
    • Assign users to specific groups during SAML and OIDC auto-provisioning.
    • Set up OIDC with the same well-known URL. The OIDC configurations can use the same well-known URL of the IdPs for multiple SSO records.
    • Display login failure reasons to the users who logged out of ServiceNow due to session expiry or other reasons. Use the login link on the external logout page to again log in to ServiceNow in case of successful logout.
    • Display of a generic error message for unsuccessful single log out.
    • Enhanced email notifications for SAML certificate and Encryption Key store update.
    FIDO2 as an MFA factor
    Use the FIDO factor policy to enforce FIDO (Hardware key or Biometric as second factor for authentication) as second factor authentication to users who attempt to log in to the instance.
    OAuth integrations
    Configure OAuth integration that includes the following enhancements:
    • You can provide a maximum client secret length up to 4096 characters to meet security requirements of the third-party systems.
    • You can provide a JSON Web Key Set (JWKS) URL to automatically manage and update the public key for JSON Web Tokens (JWT) signature validation.
    • You can request OAuth tokens using the JWT grant type signed with Elliptic Curve Digital Signature Algorithm (ES) signing algorithms, including ES256, ES384, and ES512, for inbound JSON Web Tokens (JWT). It also supports RS256, RS384, RS512, HS256, HS384, and HS512.
    • You can customize the JWT ID (JTI) claim name in both inbound OpenID Connect (OIDC) and JWT Bearer flows.

    Removed

    Between your current release family and Zurich, some Authentication features or functionality were removed.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Deprecations

    Between your current release family and Zurich, some Authentication features or functionality were deprecated.

    Release Release notes

    Xanadu
    • The MultiSSO v1 plugin is deprecated. Upgrade to MutliSSO v2 from MultiSSO v1. For more information on how to upgrade to MultiSSO v2, refer to the knowledge article MultiSSO v2 upgrade instructions [KB9756504] in the Now Support Knowledge Base.
    • The SAML 1.1 and SAML 1.1 Single Sign-On - Update 1 plugin is deprecated. The SAML-based identity providers (IdP) have already migrated to SAML 2.0. To use SAML 2.0, you must activate the MultiSSO v2 plugin and configure your identity provider.
    • The OpenID SSO plugin is deprecated. To use OpenID Connect (OIDC), you must activate the MultiSSO v2 and configure your OIDC-based identity provider.

    Yokohama

    		 No updates for this release.

    Zurich
    Due to the launch of new simplified inbound integration configuration in Machine Identity Console, the following inbound integrations configurations in the Application registry page are deprecated:
    • OAuth API endpoint for external clients
    • OAuth JWT API endpoint for external clients
    • OIDC provider to verify ID tokens

    Activation information

    Review information on how to activate Authentication.

    Release Release notes

    Xanadu

    Authentication is a ServiceNow AI Platform product that is active by default.

    Yokohama

    Authentication is a ServiceNow AI Platform product that is active by default.

    Zurich

    Authentication is a ServiceNow AI Platform product that is active by default.

    Additional requirements

    If any additional requirements were introduced or changed for Authentication we have noted them here.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Browser requirements

    If any specific browser requirements were introduced or changed for Authentication we have noted them here.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Accessibility information

    Review details on accessibility information for Authentication, such as specific requirements or compliance levels.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Localization information

    If there are specific localization considerations for Authentication we have noted them here.

    Release Release notes

    Xanadu

    		 No updates for this release.

    Yokohama

    		 No updates for this release.

    Zurich

    		 No updates for this release.

    Highlight information

    If there are specific highlight considerations for Authentication we have noted them here.

    Release Release notes

    Xanadu
    • Use the FIDO2 authenticator, passkeys, biometric authenticators, and hardware security keys as multi-factor authentication (MFA) factors without requiring an authenticator app setup.

    See Authentication for more information.

    Yokohama
    Yokohama Patch 11
    Authentication factors for AI voice service
    Enable caller access to AI voice agents by configuring the required identification and authentication factors.
    OAuth enhancements
    Following are the OAuth enhancements:
    • Use Opaque or JWT token option for your inbound integration endpoints.
    • Use the Allow access only to APIs in selected scope option to enable access to the APIs that are explicitly listed in the selected scopes for your inbound integrations.
    • Use the OAuth Entity Resource tab for outbound integrations to configure resource parameters so they flow into the OAuth token request and are reflected in the token from your OAuth provider.
    Provider name for Inbound integrations
    Use the Provider name field to enter the details of your inbound integrations to distinguish between different inbound integrations on your ServiceNow AI Platform®. Update the Provider name in your API integrations to improve monitoring capabilities:
    • For OAuth integrations, update the provider name using the Provider name field. To know more, see OAuth Inbound.
    • For Basic authentication integrations, update the Provider name in the integration registration form.
    Yokohama Patch 7
    OAuth token enhancement
    Use Opaque or JWT token option for your inbound integration endpoints.
    Yokohama
    • Use Continuous Authentication to require step-up authentication or re-authentication to the users before allowing access to sensitive or high-privilege information.
    • Multi-factor Authentication (MFA) is enforced by default for all non-SSO login to ServiceNow®.
    • Use the Authorization code, resource owner password credential, SAML bearer, and JWT bearer OAuth grant types of OAuth for outbound integration requests through the MID Server.

    See Authentication for more information.

    Zurich
    Zurich Patch 4
    Authentication factors for AI voice service
    Enable caller access to AI voice agents by configuring the required identification and authentication factors.
    OAuth enhancements
    Following are the OAuth enhancements:
    • Use Opaque or JWT token option for your inbound integration endpoints.
    • Use the Allow access only to APIs in selected scope option to enable access to the APIs that are explicitly listed in the selected scopes for your inbound integrations.
    • Use the OAuth Entity Resource tab for outbound integrations to configure resource parameters so they flow into the OAuth token request and are reflected in the token from your OAuth provider.
    Zurich Patch 3
    Provider name for Inbound integrations
    Use the Provider name field to enter the details of your inbound integrations to distinguish between different inbound integrations on your ServiceNow AI Platform®. Update the Provider name in your API integrations to improve monitoring capabilities:
    • For OAuth integrations, update the provider name using the Provider name field. To know more, see OAuth inbound.
    • For Basic authentication integrations, update the Provider name in the integration registration form. To know more about the integration registration form, see View dashboard.
    Zurich Patch 1
    OAuth token enhancement
    Use Opaque or JWT token option for your inbound integration endpoints.
    Zurich
    • Experience the new Inbound integration configuration in the Machine Identity Console.
    • Use the new MFA Dashboard to understand insights such as MFA user enrollment, privileged admins who haven't opted in to MFA, and compliance.
    • Use the FIDO factor policy to enforce FIDO-based authentication.
    • Use the enhanced SSO login and logout experience.
    • Configure the authentication policies to restrict access, reduce roles, or enforce MFA based on Identity Provider (IdP) attributes that are received from the OIDC response.

    See Authentication for more information.