---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Basic authentication restriction

# Basic authentication restriction {#ariaid-title1}

Release version: Zurich  
Updated June 18, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Basic authentication restriction

Basic authentication restriction is a security feature in ServiceNow that controls which user accounts can use basic authentication on an instance.
It allows administrators to review accounts identified for basic auth usage and set per-account decisions before enforcing restrictions.
This helps secure the instance by limiting basic authentication access to approved accounts only.
Show full answer Show less  

## Key Features

* **Review and Decision-Making:** Administrators use the Basic Auth Restriction page to review identified users and assign one of several decisions regarding their basic authentication access.
* **Decisions per Account:**
  * **Maintain current login:** Allows both API and UI basic auth login, assigns the `sncbasicauthapiaccess` role.
  * **Revoke Basic Auth API login:** Blocks API login but allows UI login; no exception role granted.
  * **Convert to web service access only account:** Allows API login only and blocks UI login; no roles assigned.
  * **Apply default from system property:** Uses the global property `glide.authenticate.basicauth.restriction.defaultdecision` to allow or deny access.
* **Enforcement Control:** Enforcement start time is configurable via an enforcement schedule job, allowing administrators to prepare before restrictions apply.
* **Feature and Enforcement Toggles:**
  * **Feature toggle:** Enables or disables the entire basic auth restriction feature as an emergency stop without changing other settings.
  * **Enforcement toggle:** Switches between tracking mode (logging but no blocking) and enforcing mode (blocking unauthorized basic auth requests).

## How Enforcement Works

When enforcement is active, basic authentication requests are blocked unless the account meets one of these conditions:

* Account is designated as Web Services Access Only (WSAO).
* Account presents a valid Multi-Factor Authentication (MFA) one-time password.
* Account has the `sncbasicauthapiaccess` role.

## Access and Permissions

The Basic Auth Restriction page is read-only by default due to its protection policy. Only users with the `securityadmin` role can make changes to decisions and enforcement settings. The page is accessed via **All \> Basic Auth Restriction \> Properties**.

## Practical Implications for ServiceNow Customers

This feature enables customers to tightly control and monitor basic authentication usage, improving security posture by limiting which accounts can authenticate via basic auth. Administrators can phase in enforcement by first reviewing and deciding on accounts, then enabling enforcement to block unauthorized basic auth requests. The ability to toggle enforcement and the feature itself provides flexibility to respond quickly to issues.  
Basic authentication restriction is a security feature that controls which accounts can use basic authentication on a ServiceNow instance. Administrators can review identified users and assign per-account decisions before enforcement begins.
The Basic Auth Restriction page provides guidance on available actions and controls the enforcement configuration. Administrators are prompted to review the identified users and take action before the enforcement period begins.  
Important:  
The Basic Auth Restriction page is read-only based on its protection policy. The `security_admin` role is required to make any changes.

Navigate to AllBasic Auth RestrictionProperties to open the page.

## Actions available for identified users {#basic-auth-restriction__bar-take-action}

Review the Identified Users table and set a decision for
each account. The following decisions are available:

Maintain current login --- Basic Auth API and UI login allowed
:   The `snc_basic_auth_api_access` role is granted to the
    account. Basic authentication access continues when enforcement
    begins.

Revoke Basic Auth API login --- Basic Auth API login blocked and UI login
allowed
:   The account is not granted the exception role. Basic auth access fails
    when enforcement begins.

Convert to web service access only account --- Basic Auth API login allowed
and UI login blocked
:   The account is converted to a web service access only account. The account can't make UI logins, but basic authentication continues to work past the enforcement period. No roles are assigned.

Apply default from system property
:   Basic auth access is granted or denied based on the decision configured in
    the global property
    `glide.authenticate.basic_auth.restriction.default_decision`.
    Review or change this on the property page.

Administrators should also review and adjust the start of the enforcement period
from the enforcement schedule job.

## How enforcement works {#basic-auth-restriction__bar-how-enforcement-works}

Once enforcement is enabled, basic authentication requests are blocked unless the
requesting account matches one of the following:

* Accounts having Web Services Access Only (WSAO).
* Accounts presenting a valid MFA one-time password.
* Accounts having the `snc_basic_auth_api_access` role.

## Basic Auth Restriction settings {#basic-auth-restriction__bar-settings}

The Basic Auth Restriction page includes the following configurable
settings:

Default value
:   The default decision applied to new rows in the Basic Auth Exception table
    during the tracking period. Per-row decisions in the Basic Auth Exception
    table override this default.

Feature toggle
:   A feature toggle for the Basic Authentication restriction feature on the
    instance. When unchecked (false), no enforcement occurs regardless of the
    value of `glide.authenticate.basic_auth.restriction.enforce`.
    Use this as an emergency disable to halt the feature without changing other
    settings.

Enforcement toggle
:   Controls whether enforcement is active. When unchecked (false), accounts
    using basic authentication are recorded but no requests are blocked ---
    tracking mode. When checked (true), basic authentication requests are blocked
    unless the requesting account is on the allow-list --- enforcing mode. Has no
    effect when the feature toggle is set to false.

*[\>]: and then