Using Multi-factor authentication

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Using Multi-factor Authentication

    This guide provides essential information on implementing multi-factor authentication (MFA) for secure access to your ServiceNow instance. MFA enhances security by requiring a second form of verification beyond just your username and password.

    Show full answer Show less

    Key Features

    • Supported Authenticator Apps: ServiceNow supports various authenticator applications that utilize Time-based One-time Passwords (TOTP), including Google Authenticator, Microsoft Authenticator, LastPass Authenticator, Authy, FreeOTP, Duo, and Okta Verify.
    • Authentication Methods:
      • Authenticator Apps: After MFA is enabled, users must enter a code from their authenticator app for login.
      • Biometric Authenticators: If permitted, you can use fingerprint or facial recognition as a second authentication factor.
      • Hardware Key Authenticators: Physical security devices can also be registered for authentication.
      • SMS and Email OTP: Users can register their phone numbers or email addresses to receive one-time passwords (OTP) for additional verification.

    Key Outcomes

    By implementing MFA, you significantly enhance the security of your ServiceNow instance. Users can expect streamlined login processes while ensuring their identity is verified through multiple authentication factors, thereby safeguarding sensitive information. Each method of authentication is designed to provide flexibility and increased security tailored to your organization's needs.

    Learn how to use multi-factor authentication tools to securely access your instance.

    Login with MFA

    ServiceNow requires authenticator applications that support Time-based One-time Passwords (TOTP). ServiceNow tests MFA with the following authenticators:

    • Google Authenticator
    • Microsoft Authenticator
    • LastPass Authenticator
    • Authy
    • FreeOTP
    • Duo
    • Okta Verify
    Note:
    • Other authenticators not listed might also be compatible, but are not tested by ServiceNow.
    • For information related to browser specific behavior change, see this KB article.

    Register an authentication app

    Authenticator App
    You can use authenticator apps to use a second factor of authentication.

    If your administrator has enabled multi-factor authentication (MFA) on your instance, you are prompted for a second authentication after entering your user name and password. For details on the MFA login process, see Log in with Multi-factor Authentication.
    Validation with Authenticator app
    Enter the code displayed on your authenticator app to login.
    If you haven't configured a second form of authentication, you will see a configuration page after logging in to guide you through the process of setting up an authentication app. For details on this setup, see Set up Multi-factor authentication for the first time.
    Authenticator

    Register an authentication device

    After you've configured an authentication app, you can register other methods for authentication.
    Biometric authenticators
    You can use biometric authenticators like fingerprint or facial recognition as your second MFA authentication. If your administrator allows this option, you can configure biometric authenticators using the steps in Register a biometric authenticator.
    Biometrics icon
    Hardware key authenticators
    Hardware keys are physical security devices you can use for authentication. You can register a hardware device for use with your instance using the steps in Register a hardware security key.
    Hardware key icon
    Validation with Biometric or Hardware Key
    Use the biometric or hardware key to login.
    		 Use the Biometric or Security Key to login.
    MFA - Biometric or Hardware

    Register a phone number for OTP

    SMS
    Use SMS based OTP to require users who attempt to login.

    When users attempt to login to ServiceNow, SMS OTP is sent to the mobile number associated with the sys_user record. Users can enter the six-digit verification code that it sent to the mobile device and verify their identity.


    SMS.
    Validation with SMS
    Use the validation with SMS to login based on the OTP generated.
    		 You need to enter the 6-digit code sent to the mobile number to login. The code sent is valid for the next 5 minutes. You can use resend code to again send the code.

    Register an Email address for OTP

    Email address
    Use Email based OTP to require users who attempt to login.

    When users attempt to login to ServiceNow, Email OTP is sent to the email address associated to the user. User's can enter the six-digit verification code that it sent to the mobile device and verify their identity.


    Email.
    Validation with Email
    Use the validation with Email to login based on the OTP generated.
    		 You need to enter the 6-digit code sent to the email address to login. The code sent is valid for the next 5 minutes. You can use resend code to again send the code.
    MFA-Email.