Skip to content

Integrating SailPoint with ServiceNow Identity Governance SaaS

The ServiceNow Identity Governance SaaS connector is an identity governance platform that provides visibility, control, and automation for the lifecycle of user access to applications and data.

The ServiceNow Identity Governance SaaS connector allows you to load your user account data from ServiceNow into SailPoint using a direct connection. You can manage the loaded data either by creating an identity profile based on the source or by verifying that the loaded accounts are correlated to the existing identity. After loading the accounts, you can configure the connector for provisioning new accounts in ServiceNow.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The ServiceNow Identity Governance SaaS connector supports the following features:

  • Loading and *provisioning of ServiceNow Accounts
  • Delta aggregation to synchronize the changes from ServiceNow
  • *Password management
  • Enable/Disable account
  • Delete accounts
  • Unlock account
  • Aggregation of ServiceNow AI Agents and Agentic Workflows during Agent Aggregation
  • Activate/Deactivate aggregated AI Agents and Agentic Workflows from SailPoint.

Note

  • To use any of the above items marked with an asterisk(*), approach SailPoint for activation of these features for your site.
  • Defining a SailPoint Identity Governance SaaS connector for ServiceNow is separate from creating a ServiceNow integration. For more information about integration options, see the ServiceNow SIM Integration Guide.
  • Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to SailPoint Agentic Fabric.

The following feature support is not applicable for the ServiceNow Identity Governance SaaS connector:

  • Removing Entitlement / Removing Group

Group and Multi-Group Entitlements

Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details from the managed system. These objects have separate schemas defining a list of attributes that the aggregation task fetches as additional details when aggregation is run for the respective Group or Multi-Group Entitlement type.

Feature Users Groups Roles
Aggregate ✔ ✔ ✔
Create ✔ N/A N/A
Password Management ✔ N/A N/A
Read Group Hierarchy N/A N/A ✔
Group Entitlements (Read, Request) ✔ ✔ ✔

Activity Insights

Activity Insights supports activity from ServiceNow and its associated accounts. This allows you to gather account information and activity data from ServiceNow.

Important

Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings.

For more information on features, refer to Source Features.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Non-Human Identity Discovery

  • Aggregate ServiceNow AI Agents

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level Description
High Administrative level access to accounts
Medium Administrative level access for a specific role or function
Low Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Supported Managed Systems

  • The ServiceNow Identity Governance SaaS connector supports the ServiceNow releases mentioned in the ServiceNow Store.

Prerequisites

  • The SailPoint Identity Governance connector for ServiceNow is certified and published on the ServiceNow Application store. You can directly install it from the store and begin using it.

  • You must install the SailPoint Identity Governance connector for ServiceNow from the ServiceNow Application store. Go to the ServiceNow Application Store > Search for the SailPoint Identity Governance connector.

    Note

    The Service Account is the account that is used during source configuration to connect to the managed system.

  • x_sapo_iiq_connect.admin is required for both Basic and OAuth2. The Service Account user should create the OAuth Client.

  • On the Table API or Import Set API table, if REST API ACL is enabled, make sure to add the snc_platform_rest_api_access role to the x_sapo_iiq_connect.admin role.
  • sn_aia_admin is required to create, read, update, and delete ServiceNow Agents.
  • sn_aia_viewer is required to read ServiceNow Agents.
  • access_analyzer_admin is required to read the associated roles created for AI Agents.
  • Set system property x_sapo_iiq_connect.allow_ai_agent_config_update to true to allow SailPoint to activate/deactivate AI Agents and Agentic Workflows through the Import Set tables. When false, updates to sn_aia_agent_config and sn_aia_usecase_config_override are rejected. Default: false.

Note

For more information on creating an ACL, refer to ServiceNow: Create an ACL rule.

Required Permissions

For the ServiceNow Identity Governance SaaS connector to work smoothly, ensure that the following tables have read, create, and update access and can be accessed through Web Services.

  • User [sys_user]
  • Group [sys_user_group]
  • Group Member [sys_user_grmember]
  • User Role [sys_user_has_role] (This is required for multiple group objects.)

Complete the following to provide the application access:

  1. Select the Global scope in ServiceNow.
  2. Go to System Definition > Tables.
  3. Search for the table using the label or name.
  4. Select the table and scroll to Application Access.
  5. Select Can read.
  6. Select Can create.
  7. Select Can update.
  8. Select Allow Access to this table via web services.
  9. Select Update to save the table.

Activity Insights Permissions

An administrator requires the following additional permission to use Activity Insights:

Scope Description
Task [task] Read access on task table.

For more information on configuring Activity Insights, refer to Activity Insights Settings.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.