Provisioning Policy
The ServiceNow Identity Governance SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in ServiceNow Identity Governance directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Default Create Account Attributes
The following generators create the information required for a new ServiceNow Identity Governance SaaS account. You may need to edit the contents.
| Account Attribute | Generator | Description |
|---|---|---|
| user_name | Identity Attribute | The user's name. |
| first_name | Identity Attribute | The first name of the user. |
| last_name | Identity Attribute | The last name of the user. |
| department | Disable | The user's department name. |
| title | Disable | The title or designation of the user. |
| password | Generator (Create Password) | This generator creates an initial password for the new account that matches the password policy assigned to the source. |
| password_needs_reset | Static | Indicates whether the user should be prompted to change their password the next time they sign in. |
| locked_out | Static | Indicates whether the user account is locked. |
| active | Static | Indicates whether the user account has been staged for use. |
| notification | Static | Indicates whether the user should be notified of changes made to their account. |
| calendar_integration | Static | Indicates whether change requests assigned to the user are sent to their Outlook calendar. |
| time_zone | Static | The user's time zone. |
| Identity Attribute | The user's email ID. | |
| mobile_phone | Disable | The user's mobile phone number. |
| phone | Identity Attribute | The user's phone number. |
Notes
- You can edit parts of this configuration in the user interface. Refer to Editing the Account Creation Configuration.
- The connector does not provision entitlements that do not exist in ServiceNow.
- The connector supports non-English characters in the email address attribute.
- The connector supports updating accounts with email addresses that use patterns such as
test.email@non.test-domain.com. - The source displays the
US/Centraltime zone in the create provisioning policy form.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.