ServiceNow | Entitle

Manage and automate access to your organization's ServiceNow instance with Entitle. With this integration, you can request access to ServiceNow resources, including global roles, applications, and groups. If you grant Entitle the admin role, Entitle also displays ACL-controlled resources in the permission graph.

Prerequisites

• ServiceNow administrator access
• Entitle administrator access

Configuration in ServiceNow

Create a user in ServiceNow

1. In ServiceNow, go to All > Users and Groups > Users.
2. Click New.
3. Enter the following details:

4. Click Submit.

Assign roles to the user

You can either assign the built-in admin role or create a custom role with minimum required permissions. The admin role is simpler to set up and allows Entitle to display ACL-based permissions in the permission graph. The custom role follows least-privilege principles, granting only the permissions the integration needs to function.

Option A – Full permissions (admin role)

1. Search for the user you created and select it.
2. Under Roles, click Edit.
3. Add the admin role, then click Save.

Option B – Least privilege (custom role)

1. Download the entitle_access_management.xml.
2. Open a new tab and go to All > Retrieved Update Sets.
3. Select Import Update Set from XML, upload the Entitle-supplied XML file, then click Save.
4. Select the file you just uploaded called entitle_access_management, then click Preview Update Set, then Commit Update Set.
5. Click Update.
6. Go to Roles and confirm the file is committed.
7. Select the role, then click Contains Roles > Edit. Add snc_platform_rest_api_access , then click Update.
8. Return to the previous tab with the user you created and select it.
9. Under Roles, click Edit.
10. Choose entitle_access_management, then click Update.

Set authentication

Choose one of the following authentication methods:

Option A – Password (basic)

1. On the user record, click Set Password > Generate.
2. Save the password.

Option B – OAuth client credentials (recommended)

1. Type sys_properties.do in the search bar.
2. Create a new system property record and enter the following details:

3. Click Submit.
4. Go to Inbound Integrations > New Integration > OAuth – Client Credentials Grant.
5. Enter the following details:

5. Copy the Client ID and Client Secret.
6. Click Save.

Configure the integration in Entitle

1. In Entitle, navigate to Integrations and click Add Integration.

   

2. Choose ServiceNow under Application.

   

3. Enter the integration details:

   Field	Description
   Name	Enter a display name for the integration.
   Owner	Select the Entitle user who is responsible for managing this integration.
   Default Approval Workflow	Select the approval workflow that applies to access requests for this integration, if no other workflows apply.

   
   

4. Select integration behavior options:

   Option	Behavior
   Readonly	Select to disable any automated permission granting - will show resources and permissions in the application but any permission changes will be done manually.
   Allow changing account permissions	Select to allow Entitle to grant and revoke permissions. When deselected, Entitle can track but not modify permissions.
   Allow creating accounts	Allows new accounts to be created when granting access, so a user can choose to not provide an account when requesting access.
   Allow users to edit accounts	Users will be able to edit their account for this integration.
   Requestable	Select to allow end-users to request access for resources in this integration. When deselected, this integration is not available under New request.
   Requestable by default	When selected, new resources will allow requests by default. Otherwise, requests for new resources will not be allowed, by default.
   Auto assign recommended resource owners	If recommendations are available during sync, override existing resource owners with the recommended users
   Auto assign recommended resource maintainers	If recommendations are available during sync, override existing resource maintainers with the recommended users
   Notify about external permission changes	If accounts receive roles outside of the request access flow, notifications will be sent to admins and integration owner.
   Override allowed durations	Changes the allowed duration options for this integration. Bundles containing this integration will not be affected.

   
   

5. Select the location to save the integration connection settings under Save on.

6. Under Connection, populate the JSON configuration.

7. Click Check configuration to test the integration.

8. Click Save.