🎫 ServiceNow

ServiceNow — IT service management (ITSM) platform. Provisioning target for users, groups, roles.

Identification

vendor key: servicenow
engine: servicenow
default role: target
type: Out-of-the-box vendor
vendor docs: https://developer.servicenow.com/dev.do#!/reference/api/sandiego/rest/c_TableAPI

Supported auth methods

basic
oauth2_client_credentials

Importable objects (4)

Object types the wizard offers to import out of the box.

Users (sys_user)

name: users
iga_target: identity
path: /api/now/table/sys_user?sysparm_query=active=true&sysparm_fields=sys_id,user_name,email,first_name,last_name,department.name,title,manager.user_name,location,company,active

All active users. Remove active=true to include inactive users.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ sys_id }}`	✓
`identity_id`	`{{ user_name }}`	✓
`email`	`{{ email }}`
`first_name`	`{{ first_name }}`
`last_name`	`{{ last_name }}`
`display_name`	`{{ first_name }} {{ last_name }}`
`function`	`{{ title }}`
`department`	`{{ department.name }}`
`manager_id`	`{{ manager.user_name }}`
`location`	`{{ location }}`
`company`	`{{ company }}`
`status`	`{{ 'active' if active == 'true' else 'suspended' }}`
`native_account_name`	`{{ user_name }}`	✓
`identity_business_id`	`{{ email\|if_null(user_name)\|lower }}`
`is_privileged`	`{{ false }}`
`servicenow_id`	`{{ sys_id }}`

User Groups (sys_user_group)

name: groups
iga_target: entitlement
path: /api/now/table/sys_user_group?sysparm_fields=sys_id,name,description,type,active,roles

ServiceNow groups — used for ticket assignment + access control.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ sys_id }}`	✓
`name`	`{{ name }}`	✓
`description`	`{{ description }}`
`native_identifier`	`{{ sys_id }}`
`risk_level`	`{{ 'high' if ('admin' in (name or '')\|lower or 'security' in (name or '')\|lower) else 'low' }}`
`type`	`{{ type }}`
`status`	`{{ 'active' if active == 'true' else 'inactive' }}`
`privileged`	`{{ 'admin' in (name or '')\|lower or 'security' in (name or '')\|lower }}`

Roles (sys_user_role)

name: roles
iga_target: entitlement
path: /api/now/table/sys_user_role?sysparm_fields=sys_id,name,description,elevated_privilege

ServiceNow roles — fine-grained access. admin is the most privileged.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ sys_id }}`	✓
`name`	`{{ name }}`	✓
`description`	`{{ description }}`
`native_identifier`	`{{ sys_id }}`
`risk_level`	`{{ 'critical' if (name == 'admin') else ('high' if elevated_privilege == 'true' else 'medium') }}`
`privileged`	`{{ elevated_privilege == 'true' or name == 'admin' }}`

Group memberships (sys_user_grmember)

name: group_members
iga_target: entitlement_assignment
path: /api/now/table/sys_user_grmember?sysparm_fields=sys_id,user.user_name,group.name

Which user belongs to which group? For reconciliation.

Default field mappings:

IGA field	Expression	Required
`business_id`	`{{ sys_id }}`	✓
`identity_business_id`	`{{ user.user_name }}`	✓
`entitlement_business_id`	`{{ group.name }}`	✓

Onboarding setup checklist

Create a dedicated integration user in ServiceNow with the 'rest_service' + 'admin' (or, more granularly: user_admin + role_admin) roles, and retrieve the instance URL. ~10 minutes.

Estimated time: ~10 min. The wizard exposes this checklist as a drawer (📋 button) during onboarding. See the Onboarding wizard walkthrough for context.