Basic authentication restriction

  • Release version: Zurich
  • Updated June 18, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Basic authentication restriction

    Basic authentication restriction is a security feature in ServiceNow that controls which user accounts can use basic authentication on an instance. It allows administrators to review accounts identified for basic auth usage and set per-account decisions before enforcing restrictions. This helps secure the instance by limiting basic authentication access to approved accounts only.

    Show full answer Show less

    Key Features

    • Review and Decision-Making: Administrators use the Basic Auth Restriction page to review identified users and assign one of several decisions regarding their basic authentication access.
    • Decisions per Account:
      • Maintain current login: Allows both API and UI basic auth login, assigns the sncbasicauthapiaccess role.
      • Revoke Basic Auth API login: Blocks API login but allows UI login; no exception role granted.
      • Convert to web service access only account: Allows API login only and blocks UI login; no roles assigned.
      • Apply default from system property: Uses the global property glide.authenticate.basicauth.restriction.defaultdecision to allow or deny access.
    • Enforcement Control: Enforcement start time is configurable via an enforcement schedule job, allowing administrators to prepare before restrictions apply.
    • Feature and Enforcement Toggles:
      • Feature toggle: Enables or disables the entire basic auth restriction feature as an emergency stop without changing other settings.
      • Enforcement toggle: Switches between tracking mode (logging but no blocking) and enforcing mode (blocking unauthorized basic auth requests).

    How Enforcement Works

    When enforcement is active, basic authentication requests are blocked unless the account meets one of these conditions:

    • Account is designated as Web Services Access Only (WSAO).
    • Account presents a valid Multi-Factor Authentication (MFA) one-time password.
    • Account has the sncbasicauthapiaccess role.

    Access and Permissions

    The Basic Auth Restriction page is read-only by default due to its protection policy. Only users with the securityadmin role can make changes to decisions and enforcement settings. The page is accessed via All > Basic Auth Restriction > Properties.

    Practical Implications for ServiceNow Customers

    This feature enables customers to tightly control and monitor basic authentication usage, improving security posture by limiting which accounts can authenticate via basic auth. Administrators can phase in enforcement by first reviewing and deciding on accounts, then enabling enforcement to block unauthorized basic auth requests. The ability to toggle enforcement and the feature itself provides flexibility to respond quickly to issues.

    Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.

    The Basic Auth Restriction page provides guidance on available actions and controls the enforcement configuration. Administrators are prompted to review the identified users and take action before the enforcement period begins.

    Important:
    The Basic Auth Restriction page is read-only based on its protection policy. The security_admin role is required to make any changes.

    Navigate to All > Basic Auth Restriction > Properties to open the page.

    Actions available for identified users

    Review the Identified Users table and set a decision for each account. The following decisions are available:

    Maintain current login — Basic Auth API and UI login allowed
    The snc_basic_auth_api_access role is granted to the account. Basic authentication access continues when enforcement begins.
    Revoke Basic Auth API login — Basic Auth API login blocked and UI login allowed
    The account is not granted the exception role. Basic auth access fails when enforcement begins.
    Convert to web service access only account — Basic Auth API login allowed and UI login blocked
    The account is converted to a web service access only account. The account can't make UI logins, but basic authentication continues to work past the enforcement period. No roles are assigned.
    Apply default from system property
    Basic auth access is granted or denied based on the decision configured in the global property glide.authenticate.basic_auth.restriction.default_decision. Review or change this on the property page.

    Administrators should also review and adjust the start of the enforcement period from the enforcement schedule job.

    How enforcement works

    Once enforcement is enabled, basic authentication requests are blocked unless the requesting account matches one of the following:

    • Accounts having Web Services Access Only (WSAO).
    • Accounts presenting a valid MFA one-time password.
    • Accounts having the snc_basic_auth_api_access role.

    Basic Auth Restriction settings

    The Basic Auth Restriction page includes the following configurable settings:

    Default value
    The default decision applied to new rows in the Basic Auth Exception table during the tracking period. Per-row decisions in the Basic Auth Exception table override this default.
    Feature toggle
    A feature toggle for the Basic Authentication restriction feature on the instance. When unchecked (false), no enforcement occurs regardless of the value of glide.authenticate.basic_auth.restriction.enforce. Use this as an emergency disable to halt the feature without changing other settings.
    Enforcement toggle
    Controls whether enforcement is active. When unchecked (false), accounts using basic authentication are recorded but no requests are blocked — tracking mode. When checked (true), basic authentication requests are blocked unless the requesting account is on the allow-list — enforcing mode. Has no effect when the feature toggle is set to false.