Edit

Connect ServiceNow to Microsoft Defender for Cloud Apps

  • Article
  • 3 minutes to read

Note

Microsoft Defender for Cloud Apps (previously known as Microsoft Cloud App Security) is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services. Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. For more information about these changes, see Microsoft Defender for Cloud Apps in Microsoft 365 Defender.

This article provides instructions for connecting Microsoft Defender for Cloud Apps to your existing ServiceNow account using the app connector API. This connection gives you visibility into and control over ServiceNow use. For information about how Defender for Cloud Apps protects ServiceNow, see Protect ServiceNow.

Note

We recommend deploying ServiceNow using OAuth app tokens, available for Fuji and later releases (see the relevant ServiceNow documentation. For earlier releases, a legacy connection mode is available based on user/password. The username/password provided are only used for API token generation and are not saved after the initial connection process.

Note

Defender for Cloud Apps supports the following ServiceNow versions: Eureka, Fiji, Geneva, Helsinki, Istanbul, Jakarta, Kingston, London, Madrid, New York, Orlando, Paris, Quebec, Rome, San Diego, and Tokyo. In order to connect ServiceNow with Defender for Cloud Apps, you must have the role Admin and make sure the ServiceNow instance supports API access. For more information, see the ServiceNow product documentation.

How to connect ServiceNow to Defender for Cloud Apps using OAuth

  1. Sign in with an Admin account to your ServiceNow account.

    Note

    The username/password provided are only used for API token generation and are not saved after the initial connection process.

  2. In the Filter navigator search bar, type OAuth and select Application Registry.

  3. In the Application Registries menu bar, select New to create a new OAuth profile.

    ServiceNow new OAuth profile.

  4. Under What kind of OAuth application?, select Create an OAuth API endpoint for external clients.

    ServiceNow OAuth type.

  5. Under Application Registries New record fill in the following fields:

    • Name field, name the new OAuth profile, for example, CloudAppSecurity.

    • The Client ID is generated automatically. Copy this ID, you need to paste it into Defender for Cloud Apps to complete connection.

    • In the Client Secret field, enter a string. If left empty, a random Secret is generated automatically. Copy and save it for later.

    • Increase the Access Token Lifespan to at least 3,600.

    • Select Submit.

    ServiceNow profile IDs.

  6. In the Defender for Cloud Apps portal, select Investigate and then Connected apps.

  7. In the App connectors page, select the plus button and then ServiceNow.

    connect ServiceNow.

  8. In the pop-up, add your ServiceNow user ID, password, instance URL, Client ID, and Client secret in the appropriate boxes. To find your ServiceNow User ID, in the ServiceNow portal, go to Users and then locate your name in the table.

    ServiceNow user ID.

  9. Select Connect.

    ServiceNow connect to CAS.

  10. Make sure the connection succeeded by selecting Test now.

    Testing may take a couple of minutes. After receiving a success notice, select Close.

After connecting ServiceNow, you'll receive events for seven days prior to connection.

Legacy ServiceNow connection

To connect ServiceNow with Defender for Cloud Apps, you must have admin-level permissions and make sure the ServiceNow instance supports API access.

  1. Sign in with an Admin account to your ServiceNow account.

  2. Create a new service account for Defender for Cloud Apps and attach the Admin role to the newly created account.

  3. Make sure the REST API plug-in is turned on.

    ServiceNow account.

  4. In the Defender for Cloud Apps portal, select Investigate and then Sanctioned apps.

  5. In the ServiceNow row, select Connect in the App Connector status column, or select the Connect an app button and then ServiceNow.

    connect ServiceNow.

  6. In the ServiceNow settings page, on the API tab, add your ServiceNow user ID, password, and instance URL in the appropriate boxes.

  7. Select Connect.

    ServiceNow update password.

  8. Make sure the connection succeeded by selecting Test API.

    Testing may take a couple of minutes. After receiving a success notice, select Close.

After connecting ServiceNow, you'll receive events for seven days prior to connection.

If you have any problems connecting the app, see Troubleshooting App Connectors.

Next steps

Control cloud apps with policies

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.