🎫 ServiceNow

ServiceNow — IT service management (ITSM) platform. Provisioning target for users, groups, roles.

Identification

• vendor key: servicenow
• engine: servicenow
• default role: target
• type: Out-of-the-box vendor
• vendor docs: https://developer.servicenow.com/dev.do#!/reference/api/sandiego/rest/c_TableAPI

Supported auth methods

• basic
• oauth2_client_credentials

Importable objects (4)

Object types the wizard offers to import out of the box.

Users (sys_user)

• name: users
• iga_target: identity
• path: /api/now/table/sys_user?sysparm_query=active=true&sysparm_fields=sys_id,user_name,email,first_name,last_name,department.name,title,manager.user_name,location,company,active

All active users. Remove active=true to include inactive users.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
identity_id	{{ user_name }}	✓
email	{{ email }}
first_name	{{ first_name }}
last_name	{{ last_name }}
display_name	{{ first_name }} {{ last_name }}
function	{{ title }}
department	{{ department.name }}
manager_id	{{ manager.user_name }}
location	{{ location }}
company	{{ company }}
status	{{ 'active' if active == 'true' else 'suspended' }}
native_account_name	{{ user_name }}	✓
identity_business_id	{{ email|if_null(user_name)|lower }}
is_privileged	{{ false }}
servicenow_id	{{ sys_id }}

User Groups (sys_user_group)

• name: groups
• iga_target: entitlement
• path: /api/now/table/sys_user_group?sysparm_fields=sys_id,name,description,type,active,roles

ServiceNow groups — used for ticket assignment + access control.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
name	{{ name }}	✓
description	{{ description }}
native_identifier	{{ sys_id }}
risk_level	{{ 'high' if ('admin' in (name or '')|lower or 'security' in (name or '')|lower) else 'low' }}
type	{{ type }}
status	{{ 'active' if active == 'true' else 'inactive' }}
privileged	{{ 'admin' in (name or '')|lower or 'security' in (name or '')|lower }}

Roles (sys_user_role)

• name: roles
• iga_target: entitlement
• path: /api/now/table/sys_user_role?sysparm_fields=sys_id,name,description,elevated_privilege

ServiceNow roles — fine-grained access. admin is the most privileged.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
name	{{ name }}	✓
description	{{ description }}
native_identifier	{{ sys_id }}
risk_level	{{ 'critical' if (name == 'admin') else ('high' if elevated_privilege == 'true' else 'medium') }}
privileged	{{ elevated_privilege == 'true' or name == 'admin' }}

Group memberships (sys_user_grmember)

• name: group_members
• iga_target: entitlement_assignment
• path: /api/now/table/sys_user_grmember?sysparm_fields=sys_id,user.user_name,group.name

Which user belongs to which group? For reconciliation.

Default field mappings:

IGA field	Expression	Required
business_id	{{ sys_id }}	✓
identity_business_id	{{ user.user_name }}	✓
entitlement_business_id	{{ group.name }}	✓

Onboarding setup checklist

Create a dedicated integration user in ServiceNow with the 'rest_service' + 'admin' (or, more granularly: user_admin + role_admin) roles, and retrieve the instance URL. ~10 minutes.

Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.