# Integrating SailPoint with ServiceNow Identity Governance SaaS The ServiceNow Identity Governance SaaS connector is an identity governance platform that provides visibility, control, and automation for the lifecycle of user access to applications and data. The ServiceNow Identity Governance SaaS connector allows you to load your user account data from ServiceNow into SailPoint using a direct connection. You can manage the loaded data either by creating an identity profile based on the source or by verifying that the loaded accounts are correlated to the existing identity. After loading the accounts, you can configure the connector for provisioning new accounts in ServiceNow. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The ServiceNow Identity Governance SaaS connector supports the following features: - Loading and \*provisioning of ServiceNow Accounts - Delta aggregation to synchronize the changes from ServiceNow - \*Password management - Enable/Disable account - Delete accounts - Unlock account - Aggregation of ServiceNow AI Agents and Agentic Workflows during Agent Aggregation - Activate/Deactivate aggregated AI Agents and Agentic Workflows from SailPoint. > [!NOTE] > > - To use any of the above items marked with an asterisk(\*), approach SailPoint for activation of these features for your site. > - Defining a SailPoint Identity Governance SaaS connector for ServiceNow is separate from creating a ServiceNow integration. For more information about integration options, see the [ServiceNow SIM Integration Guide](). > - Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. For more information, refer to [SailPoint Agentic Fabric](). The following feature support is not applicable for the ServiceNow Identity Governance SaaS connector: - Removing Entitlement / Removing Group ### Group and Multi-Group Entitlements Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details from the managed system. These objects have separate schemas defining a list of attributes that the aggregation task fetches as additional details when aggregation is run for the respective Group or Multi-Group Entitlement type. | Feature | Users | Groups | Roles | | --- | --- | --- | --- | | Aggregate | ✔ | ✔ | ✔ | | Create | ✔ | N/A | N/A | | Password Management | ✔ | N/A | N/A | | Read Group Hierarchy | N/A | N/A | ✔ | | Group Entitlements (Read, Request) | ✔ | ✔ | ✔ | ### Activity Insights Activity Insights supports activity from ServiceNow and its associated accounts. This allows you to gather account information and activity data from ServiceNow. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to [Activity Insights Settings](). For more information on features, refer to [Source Features](). ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ### Non-Human Identity Discovery - Aggregate ServiceNow AI Agents Refer to Dataset Management for more information. Refer to [Discovering Potential Non-Human Accounts]() for more information. ## Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ## Supported Managed Systems - The ServiceNow Identity Governance SaaS connector supports the ServiceNow releases mentioned in the [ServiceNow Store](). ## Prerequisites - The SailPoint Identity Governance connector for ServiceNow is certified and published on the ServiceNow Application store. You can directly install it from the store and begin using it. - You must install the SailPoint Identity Governance connector for ServiceNow from the [ServiceNow Application store](). Go to the ServiceNow Application Store \> Search for the SailPoint Identity Governance connector. > **Note** > > The Service Account is the account that is used during source configuration to connect to the managed system. - `x_sapo_iiq_connect.admin` is required for both Basic and OAuth2. The Service Account user should create the OAuth Client. - On the Table API or Import Set API table, if REST API ACL is enabled, make sure to add the `snc_platform_rest_api_access` role to the `x_sapo_iiq_connect.admin` role. - `sn_aia_admin` is required to create, read, update, and delete ServiceNow Agents. - `sn_aia_viewer` is required to read ServiceNow Agents. - `access_analyzer_admin` is required to read the associated roles created for AI Agents. - Set system property `x_sapo_iiq_connect.allow_ai_agent_config_update` to `true` to allow SailPoint to activate/deactivate AI Agents and Agentic Workflows through the Import Set tables. When `false`, updates to `sn_aia_agent_config` and `sn_aia_usecase_config_override` are rejected. Default: `false`. > [!NOTE] > > For more information on creating an ACL, refer to [ServiceNow: Create an ACL rule](). ## Required Permissions For the ServiceNow Identity Governance SaaS connector to work smoothly, ensure that the following tables have read, create, and update access and can be accessed through Web Services. - User `[sys_user]` - Group `[sys_user_group]` - Group Member `[sys_user_grmember]` - User Role `[sys_user_has_role]` (This is required for multiple group objects.) Complete the following to provide the application access: 1. Select the Global scope in ServiceNow. 2. Go to **System Definition \> Tables**. 3. Search for the table using the label or name. 4. Select the table and scroll to **Application Access**. 5. Select **Can read**. 6. Select **Can create**. 7. Select **Can update**. 8. Select **Allow Access to this table via web services**. 9. Select **Update** to save the table. ### Activity Insights Permissions An administrator requires the following additional permission to use Activity Insights: | Scope | Description | | --- | --- | | Task \[task\] | Read access on task table. | For more information on configuring Activity Insights, refer to [Activity Insights Settings]().