--- updatedAt: 2026-07-16T20:45:24.000Z --- # ServiceNow user request | EPM-WM Integrate Endpoint Privilege Management with ServiceNow to manage user requests. In a typical Endpoint Privilege Management scenario, the end user tries to launch an application that requires elevated privileges or falls falls into your general application rules; for example, those matching *Any Application* or *Any UAC Prompt*. With this integration, the user sends a request to run the application from EPM to their existing ServiceNow instance as a ticket. The following ServiceNow ticket types are supported in the EPM integration: Incident, Change Request, Service Catalog - Task, and Service Catalog - Requested Item. Configuration includes: * Download the BeyondTrust Endpoint Privilege Management Integration app from the ServiceNow store. * Create a user account in ServiceNow, with required role. * Activate and configure a connection to ServiceNow in EPM. * Configure the connection details to EPM in ServiceNow. * Create an Application Rule in the Policy Editor and apply messages to the rule that are specific to ServiceNow authorization. ## In ServiceNow ### Download and install the Endpoint Privilege Management app ServiceNow app version 1.10 or later is required to use the JIT (formerly URM) API. 1. Go to the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). 2. Search for BeyondTrust. The search displays all BeyondTrust products that integrate with ServiceNow. 3. Find the BeyondTrust Endpoint Privilege Management **Integration** app. 4. Download and install the app into your ServiceNow tenant. ### Create an OAuth client If the OAuth client for EPM has not been created automatically, then install it using these steps. Otherwise, proceed to creating a user account in ServiceNow. EPM must be added as an [OAuth client in ServiceNow](https://www.servicenow.com/docs/bundle/xanadu-platform-security/page/administer/security/task/t_SettingUpOAuth.html). 1. In ServiceNow, go to **Application Registry**. 2. Configure the settings: Name, Application, Client ID, and Client Secret. From the **Accessible from list**, select **This application scope only**. Select the **Active** check box. 3. Make note of the client ID and client secret. These values are needed for section [Configure the ServiceNow Integration in EPM](#config-service-now). ### Create a user account The **API Account** is used by Endpoint Privilege Management to submit requests via the inbound integration. An OAuth token is also created as an extra layer of security. > 🚧 Important information > > When setting up the user account, the **x\_bmgr\_pmc.api** role is required. 1. Go to **User Administration > Users**. 2. Enter a **User ID** (**pmc\_api**). 3. Enter a password. 4. Select **Web service access only** and click **Submit**. 5. Browse again to **User Administration > Users**. 6. Select the API user. 7. Click the **Roles** tab, and then click the **Edit...** button. 8. From the **Collection** list, add the **x\_bmgr\_pmc.api** role to the **Roles** list, and then click **Save**. #### Assign users appropriate roles The following roles must be assigned to specific users in the ServiceNow integration: * **x\_bmgr\_pmc.itil:** Assign to any users that will be providing technical support for the integration. * **x\_bmgr\_pmc.admin:** Assign to any administrator users that you want to manage the ServiceNow integration. * **x\_bmgr\_pmc.api:** Assign to API accounts that are used by BeyondTrust Endpoint Privilege Management to submit requests via the inbound integration. > ℹ️ > > You must elevate the admin role to assign roles. To assign a role to a user: 1. Go to **User Administration > Users**. 2. Select a user. 3. Click the **Roles** tab, and then click the **Edit...** button. 4. From the **Collection** list, add the appropriate role for that user to the **Roles** list: * **x\_bmgr\_pmc.itil** * **x\_bmgr\_pmc.admin** * **x\_bmgr\_pmc.api** 5. Click **Save**. ### Configure the connection to EPM An Endpoint Privilege Management instance is required for full operation. The appliance is setup in ServiceNow to connect ServiceNow with an EPM instance. 1. Go to **BeyondTrust Endpoint Privilege Management > Configuration**. 2. To turn on the integration to EPM, select **Yes**. 3. To configure the outbound integration, enter the following: * **PMC Tenant ID:** The Tenant ID of the Endpoint Privilege Management appliance. * **PMC Client ID:** The OAuth client ID that is used to authenticate to the Endpoint Privilege Management appliance. Copy the client ID from EPM. * **PMC Client Secret:** The OAuth client secret that is used to authenticate to the Endpoint Privilege Management appliance. Copy the secret from EPM. * **PMC Service Host Name:** The hostname of the Endpoint Privilege Management appliance. * **Ticket Type:** The ticket type that is generated with a user authorization request. The ticket can be one of four types: **Incident**, **Change Request**, **Service Catalog - Task**, or **Service Catalog - Requested Item**. 4. To configure the application defaults (optional), enter the following: * **Default Assignment Group:** The default group assigned. * **Default Category for Task:** The default category for tasks created by the application. The default is **Software**. * **Default Short Description for Incidents and Change Requests:** The default short description created by the application when attempting to create an incident or change request based on the task type. * **Default Service Catalog Item Name:** The name of the service catalog item used when creating service catalog requests. * **Active State Codes for Change Request:** A comma-separated list of states in which the integration actions are available to users. This list is for change requests only. (For example,**Implement**). * **Active State Codes for Incidents:** A comma-separated list of states in which the integration actions are available to users. This list is for incidents only. (For example,**New**, **In Progress**). * **Active States for Service Catalog Tasks:** A list of states in which the integration actions are available to users. This list is for Service Catalog tasks only. * **Short Description for Service Catalog Task used to approve request:** The default short description, which is matched to place the custom form on the created application request. 5. Click **Save**. #### Test the configuration The ServiceNow Connection Test Tool verifies connectivity to the Endpoint Privilege Management host. It tests the Client ID and Client Secret. 1. Go to **BeyondTrust Endpoint Privilege Management > Connection Test Tool**. 2. Click **Test**. ### Restrict access to applications In the ServiceNow authorization request workflow, you can restrict access to application requests. On an approved request, Help Desk can set a time limit in the ServiceNow ticket. The time limit is the length of time the user can use the application before the approval automatically expires. Under the **Application**, **Policy**, or **Decision** tab, select a duration. Access time limit can be one of the following: * **Once:** Permits access to the application only one time. * **Hour:** Enter the number of hours the user will be permitted access, between 1 and 24. * **Day:** Enter a day between 1 and 31. * **Month:** Enter a month between 1 and 12. Click **Approve**. After the time expires, the user can no longer access that application. The user must go through the request workflow again, with the Help Desk personnel approving and selecting a duration time for access. Duration settings are included in the authorization auditing. The client checks an application's authorization access when the end user attempts to run the program. If the duration settings have been correctly configured, a message appears indicating the outcome of the ServiceNow request. The user receives a new message indicating that the application has been either Denied or Approved once the policy has been updated or when they attempt to run the application again. A pending message displays to the end user until a decision on their request is made in ServiceNow. To view the status on their ServiceNow ticket, the end user can click the request reference **link**. ### Use Service Catalog as the Task Type You must configure the following if your ServiceNow infrastructure uses Service Catalog to manage user requests. * In ServiceNow, select **Service Catalog - Requested Item** (or **Service Catalog - Task**) as the **Task Type** on the **Authorization Request Settings** page. * In ServiceNow, you must add EPM as a Catalog item. Specific details on configuring the catalog item depend on your Service Catalog implementation. ### Enable VirusTotal reputation score You can enable the VirusTotal reputation score on ServiceNow tickets to assist with identifying potential malware and malicious content. 1. Go to **BeyondTrust Endpoint Privilege Management > Configuration**. 2. Select **Reputation Settings** from the menu. 3. Click the toggle switch **Enable VirusTotal Reputation Integration** to turn on the feature. 4. Enter the VirusTotal API key. A VirusTotal license is required to generate an API key. 5. Click **Validate Settings** to confirm that the key is valid. > ℹ️ > > To view the VirusTotal score on a request, select the ticket in ServiceNow and then click **Authorization Request Approval** at the top of the incident grid. The VirusTotal reputation score is displayed under the **Request Summary**. > > You can click the score **link** to go to the engine that determined the score. ## In Endpoint Privilege Management Before you can configure the connection to EPM in ServiceNow, you must generate the client ID and client secret in EPM. Starting in EPM 24.3, client ID and client secret are generated in [API Settings](https://docs.beyondtrust.com/epm-wm/docs/configure-api-settings) as part an API account. Create an API account and select the API account's scope and permissions to include JIT. ### Add ServiceNow To add ServiceNow: 1. Go to **Configuration > Just-in-time (JIT) Access Settings**. 2. Select the **Application Access** tab. 3. Select **JIT Application Access Integration**. 4. Select **ServiceNow** from the menu and enter the following: * **Host name:** The host name provided on the **Configuration** page in ServiceNow. Do not include *https\://* in the hostname. * **Username** and **Password:** Enter the user account information you created in ServiceNow. * **Client ID** and **Client Secret**: Copy the values generated in ServiceNow. See [Create an OAuth Client for EPM](https://docs.beyondtrust.com/epm-wm/docs/servicenow-user-request-integration#create-an-oauth-client-for-epm). 5. Under **Notification API Configuration Details**, the **Tenant ID** and **Host Name** are auto-generated. 6. To confirm the connection, click **Validate Settings**. 7. Click **Save Changes**. 8. To copy the **Client Secret** information, at the right of the **Client Secret** field, select the **Copy** button. Proceed with configuring the connection to EPM in ServiceNow to copy the Client Secret. > ℹ️ > > You must manually copy the Client ID information from EPM to the ServiceNow BeyondTrust Endpoint Privilege Management Configuration page. ### Create a policy for ServiceNow requests With the ServiceNow authorization requests integration, when an end user tries to launch an application that requires elevated privileges or falls into your general application rules; for example, those matching *Any Application* or *Any UAC Prompt*, they can send a request which generates a ServiceNow incident to approve or deny. The final piece to complete the ServiceNow and EPM integration is to create a policy that initiates the request process to ServiceNow. In this section, details include creating a message and setting up an application rule. > ℹ️ > > For more information, visit our customer portal and view the customer portal article [ServiceNow Authorization Request Workflow.](https://beyondtrustcorp.service-now.com/csm?id=kb_article\&sysparm_article=KB0019815) #### Create a message 1. Select **Policies** from the menu, and then select **Create Policy**. 2. Go to **Messages > [Create New Message](https://docs.beyondtrust.com/epm-wm/docs/policy-messages#create-a-new-message)**. 3. Create a message that uses the **JIT Application Request Message** template. 4. Enter a name and description. 5. Set up other message properties. #### Create an application rule 1. Select **Workstyles > (Workstyle Name) > Application Rules**. 2. Click **[Create New](https://docs.beyondtrust.com/epm-wm/docs/workstyles#create-an-application-rule)**. 3. Select the rule properties. 4. In the **Rule** section, select **Action > Request**. 5. Select the message from the **End User Message** list. 6. Select an access token. This is the access that is granted when a user request is approved. For example, to run an installer the **Add Full Admin token (Required for installers)** is required so a user can run the full install process.