Integrating SailPoint with ServiceNow Identity Governance

The ServiceNow Identity Governance connector is an identity governance platform that provides visibility, control, and automation for the lifecycle of user access to applications and data.

The ServiceNow Identity Governance connector allows you to load your user account data from ServiceNow into SailPoint using a direct connection. You can manage the loaded data either by creating an identity profile based on the source or by verifying that the loaded accounts are correlated to the existing identity. After loading the accounts, you can configure the connector for provisioning new accounts in ServiceNow.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The ServiceNow Identity Governance connector supports the following features:

Loading and provisioning of ServiceNow Accounts
Delta aggregation to synchronize the changes from ServiceNow
*Password management

Important

To use any of the features marked with an asterisk(*), SailPoint must activate them for your site.
Defining a SailPoint Identity Governance Connector for ServiceNow is separate from creating a ServiceNow integration. For more information about integration options, see the ServiceNow SIM Integration Guide.

The following feature support is not applicable for this connector:

Removing Entitlement / Removing Group
Deleting User

Group and Entitlement Objects

This connector supports the following group and entitlement objects:

ServiceNow Managed System Object	ServiceNow Source Object	Supported Operation
Groups in the Group `[sys_user_group]` table	Group names as group object	Read
Groups in the Group `[sys_user_group]` table	'groups' as entitlement object	Add entitlements

Group and Multi-Group Entitlements

Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details from the managed system. These objects have separate schemas defining a list of attributes that the aggregation task fetches as additional details when aggregation is run for the respective Group or Multi-Group Entitlement type.

Feature	Users	Groups	Roles
Aggregate	✔	✔	✔
Create	✔	N/A	N/A
Password Management	✔	N/A	N/A
Read Group Hierarchy	N/A	N/A	✔
Group Entitlements (Read, Request)	✔	✔	✔

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

The password policy defined in SailPoint applies to accounts on this source.
If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level	Description
High	Administrative level access to accounts
Medium	Administrative level access for a specific role or function
Low	Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Supported Managed Systems

The ServiceNow Identity Governance connector supports the ServiceNow releases mentioned in the ServiceNow Store.
ServiceNow Rest API supports Basic and OAuth2 authentication methods with the Refresh Token and Client Credentials Grant Type.
Each client must perform the OAuth setup to participate in OAuth authorization.

Prerequisites

The SailPoint Identity Governance connector for ServiceNow connector is certified and published on the ServiceNow Application store. You can directly install the app from the store and begin using it.
You must install the update set from the ServiceNow Application store. Go to the ServiceNow Application Store > Search for SailPoint Identity Governance Connector.
You must assign the x_sapo_iiq_connect.admin role to the Service Account of SailPoint Identity Governance connector for ServiceNow.
ServiceNow security limits access to higher privileged roles unless the user possesses that specific role. This restriction applies to roles such as "admin," "sn_hr_core.admin," or any role with the "Assignable by" field populated.
To ensure that the connector user can access these roles correctly, it is recommended to assign all such roles manually to the connector user based on their usage.
Note
- The Service Account is the account that is used during source configuration to connect to the managed system.
- The provisioning and de-provisioning of the security_admin role is not supported by the ServiceNow Governance connector due to its heightened security implications.
x_sapo_iiq_connect.admin is required for both Basic and OAuth2. The Service Account user should create an OAuth Client for the Refresh Token Grant Type.

Note

For Basic Authentication, if Basic authentication restriction is enabled, assign the snc_basic_auth_api_access role to the service account or enable Web service access only. This applies from ServiceNow Yokohama, Zurich, and later versions of ServiceNow. Confirm the restriction under All > Basic Auth Restriction > Properties. OAuth is not affected. For more information, refer to Basic authentication restriction.
For the OAuth2 Client Credentials Grant Type:
ServiceNow validates the access token received from the OpenID Connect (OIDC) provider and matches the User Claim (e.g., email) and User Field (email) for successful authentication. Users found with the User Field value should have the x_sapo_iiq_connect.admin role.
On the API table or Import Set API table, if REST API ACL is enabled, make sure to add the snc_platform_rest_api_access role to the x_sapo_iiq_connect.admin role.
Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.

Supporting the Unlock Operation in ServiceNow

Create the following Access Control List (ACL) in global scope and assign it to the x_sapo_iiq_connect.admin role:

ACL	Type	Operation	Name	Attribute
sys_user.locked_out	record	read	User `[sys_user]`	Locked out

Note

For more information on creating an ACL, refer to ServiceNow: Create an ACL rule.

Note

For more information on configuring any custom field refer to Custom Attribute for SailPoint Identity Governance Connector for ServiceNow.

Required Permissions

For the ServiceNow Identity Governance connector to work smoothly, ensure that the following tables have read, create, and update access and can be accessed through Web Services.

User [sys_user]
Group [sys_user_group]
Group Member [sys_user_grmember]
User Role [sys_user_has_role] (This is required for multiple group objects.)

Complete the following to provide the application access:

Select the Global scope in ServiceNow.
Go to System Definition > Tables.
Search for the table using the label or name.
Select the table and scroll to Application Access.
Select Can read.
Select Can create.
Select Can update.
Select Allow Access to this table via web services.
Select Update to save the table.

If Update is unavailable, select Save.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.