Configure ServiceNow for automatic user provisioning

This article describes the steps that you'll take in both ServiceNow and Azure Active Directory (Azure AD) to configure automatic user provisioning. When Azure AD is configured, it automatically provisions and deprovisions users and groups to ServiceNow by using the Azure AD provisioning service.

For more information on the Azure AD automatic user provisioning service, see Automate user provisioning and deprovisioning to SaaS applications with Azure Active Directory.

Capabilities supported

  • Create users in ServiceNow
  • Remove users in ServiceNow when they don't need access anymore
  • Keep user attributes synchronized between Azure AD and ServiceNow
  • Provision groups and group memberships in ServiceNow
  • Allow single sign-on to ServiceNow (recommended)

Prerequisites

  • An Azure AD user account with an active subscription. If you don't already have one, you can Create an account for free.
  • One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
  • A ServiceNow instance of Calgary or higher
  • A ServiceNow Express instance of Helsinki or higher
  • A user account in ServiceNow with the admin role

Step 1: Plan your provisioning deployment

Step 2: Configure ServiceNow to support provisioning with Azure AD

  1. Identify your ServiceNow instance name. You can find the instance name in the URL that you use to access ServiceNow. In the following example, the instance name is dev35214.

    Screenshot that shows a ServiceNow instance.

  2. Obtain credentials for an admin in ServiceNow. Go to the user profile in ServiceNow and verify that the user has the admin role.

    Screenshot that shows a ServiceNow admin role.

Add ServiceNow from the Azure AD application gallery to start managing provisioning to ServiceNow. If you previously set up ServiceNow for single sign-on (SSO), you can use the same application. However, we recommend that you create a separate app when you're testing the integration. Learn more about adding an application from the gallery.

Step 4: Define who will be in scope for provisioning

The Azure AD provisioning service allows you to scope who will be provisioned based on assignment to the application, or based on attributes of the user or group. If you choose to scope who will be provisioned to your app based on assignment, you can use the steps to assign users and groups to the application. If you choose to scope who will be provisioned based solely on attributes of the user or group, you can use a scoping filter.

Keep the following tips in mind:

  • When you're assigning users and groups to ServiceNow, you must select a role other than Default Access. Users with the Default Access role are excluded from provisioning and will be marked as not effectively entitled in the provisioning logs. If the only role available on the application is the Default Access role, you can update the application manifest to add more roles.

  • If you need additional roles, you can update the application manifest to add new roles.

Step 5: Configure automatic user provisioning to ServiceNow

This section guides you through the steps to configure the Azure AD provisioning service to create, update, and disable users and groups in TestApp. You can base the configuration on user and group assignments in Azure AD.

To configure automatic user provisioning for ServiceNow in Azure AD:

  1. Sign in to the Azure portal. Select Enterprise applications > All applications.

    Screenshot that shows the Enterprise applications pane.

  2. In the list of applications, select ServiceNow.

  3. Select the Provisioning tab.

  4. Set Provisioning Mode to Automatic.

  5. In the Admin Credentials section, enter your ServiceNow admin credentials and username. Select Test Connection to ensure that Azure AD can connect to ServiceNow. If the connection fails, ensure that your ServiceNow account has admin permissions and try again.

    Screenshot that shows the Service Provisioning page, where you can enter admin credentials.

  6. In the Notification Email box, enter the email address of a person or group that should receive the provisioning error notifications. Then select the Send an email notification when a failure occurs check box.

  7. Select Save.

  8. In the Mappings section, select Synchronize Azure Active Directory Users to ServiceNow.

  9. Review the user attributes that are synchronized from Azure AD to ServiceNow in the Attribute-Mapping section. The attributes selected as Matching properties are used to match the user accounts in ServiceNow for update operations.

    If you choose to change the matching target attribute, you'll need to ensure that the ServiceNow API supports filtering users based on that attribute.

    Select the Save button to commit any changes.

  10. In the Mappings section, select Synchronize Azure Active Directory Groups to ServiceNow.

  11. Review the group attributes that are synchronized from Azure AD to ServiceNow in the Attribute-Mapping section. The attributes selected as Matching properties are used to match the groups in ServiceNow for update operations. Select the Save button to commit any changes.

  12. To configure scoping filters, see the instructions in the Scoping filter tutorial.

  13. To enable the Azure AD provisioning service for ServiceNow, change Provisioning Status to On in the Settings section.

  14. Define the users and groups that you want to provision to ServiceNow by choosing the desired values in Scope in the Settings section.

    Screenshot that shows choices for provisioning scope.

  15. When you're ready to provision, select Save.

This operation starts the initial synchronization cycle of all users and groups defined in Scope in the Settings section. The initial cycle takes longer to perform than subsequent cycles. Subsequent cycles occur about every 40 minutes, as long as the Azure AD provisioning service is running.

Step 6: Monitor your deployment

After you've configured provisioning, use the following resources to monitor your deployment:

  • Use the provisioning logs to determine which users have been provisioned successfully or unsuccessfully.
  • Check the progress bar to see the status of the provisioning cycle and how close it is to completion.
  • If the provisioning configuration seems to be in an unhealthy state, the application will go into quarantine. Learn more about quarantine states.

Troubleshooting tips

  • When you're provisioning certain attributes (such as Department and Location) in ServiceNow, the values must already exist in a reference table in ServiceNow. If they don't, you'll get an InvalidLookupReference error.

    For example, you might have two locations (Seattle, Los Angeles) and three departments (Sales, Finance, Marketing) in a certain table in ServiceNow. If you try to provision a user whose department is "Sales" and whose location is "Seattle," that user will be provisioned successfully. If you try to provision a user whose department is "Sales" and whose location is "LA," the user won't be provisioned. The location "LA" must be added to the reference table in ServiceNow, or the user attribute in Azure AD must be updated to match the format in ServiceNow.

  • If you get an EntryJoiningPropertyValueIsMissing error, review your attribute mappings to identify the matching attribute. This value must be present on the user or group you're trying to provision.

  • To understand any requirements or limitations (for example, the format to specify a country code for a user), review the ServiceNow SOAP API.

  • Provisioning requests are sent by default to https://{your-instance-name}.service-now.com/{table-name}. If you need a custom tenant URL, you can provide the entire URL as the instance name.

  • The ServiceNowInstanceInvalid error indicates a problem communicating with the ServiceNow instance. Here's the text of the error:

    Details: Your ServiceNow instance name appears to be invalid. Please provide a current ServiceNow administrative user name and password along with the name of a valid ServiceNow instance.

    If you're having test connection problems, try selecting No for the following settings in ServiceNow:

    • System Security > High security settings > Require basic authentication for incoming SCHEMA requests

    • System Properties > Web Services > Require basic authorization for incoming SOAP requests

      Screenshot that shows the option for authorizing SOAP requests.

    If you still can't resolve your problem, contact ServiceNow support, and ask them to turn on SOAP debugging to help troubleshoot.

  • The Azure AD provisioning service currently operates under particular IP ranges. If necessary, you can restrict other IP ranges and add these particular IP ranges to the allowlist of your application. That technique will allow traffic flow from the Azure AD provisioning service to your application.

  • Self-hosted ServiceNow instances aren't supported.

Additional resources

Next steps