Multi-factor authentication adds a required second factor — typically a time-based code or email OTP — to protect ServiceNow logins. You'll set up MFA policies, assign them to users or groups, and configure the authentication methods your organization supports.
Why ServiceNow MFA matters now
Password-only authentication for ServiceNow access is increasingly insufficient, especially for instances that contain sensitive data or connect to critical business systems. Compliance frameworks like SOX and PCI-DSS often require MFA for administrative accounts, and security teams are pushing for broader MFA adoption after high-profile breaches. The stakeholders here are security teams who mandate MFA requirements, platform admins who implement the policies, and end users who need to enroll and use the additional authentication factors. Without proper MFA implementation, you're relying solely on password strength and user behavior — both notoriously weak security controls.
How ServiceNow MFA policies work
ServiceNow MFA operates through policies that define when to require additional authentication factors and which methods are acceptable. You start with the Multi-Factor Authentication plugin, create MFA policies that specify the authentication methods (TOTP apps like Google Authenticator, or email-based OTP), then assign those policies to users through roles or groups. The key piece most people miss: policies are evaluated in order, and the first matching policy wins. A basic implementation covers admin users with TOTP, but production deployments typically layer multiple policies — stricter requirements for privileged accounts, different methods for different user populations, and bypass mechanisms for service accounts that can't perform interactive authentication.
Scaling MFA beyond the basics
Once basic MFA works, the improvements that matter are: risk-based policies that require MFA only from untrusted locations or devices, integration with enterprise identity providers for SSO + MFA, and automated enrollment processes that don't rely on users following documentation. Production-quality MFA implementations also include monitoring and reporting on MFA adoption rates, clear procedures for users who lose access to their second factors, and tested disaster recovery procedures for when MFA systems fail. The difference between basic and enterprise MFA is the operational processes around it — enrollment, recovery, monitoring, and integration with your broader identity management strategy.
Before you start
- •admin role or mfa_admin role
- •Multi-Factor Authentication plugin activated (com.glide.authentication.multi_factor)
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Step by step
Create the MFA policy
Navigate to System Security > Multi-Factor Authentication > Policies and click New. Give the policy a descriptive Name like 'Admin Users MFA Required'. Set Order to 100 (you'll add more specific policies with lower numbers later). Check the Active checkbox and set User criteria to specify which users this policy covers — typically start with a role like 'admin' or a specific group.
Set Order to 100 for your first policy so you can insert more specific policies with lower order numbers later.
Configure authentication factors
In the Authentication Factors related list, click New to add supported MFA methods. For TOTP (recommended for admin users), select 'TOTP' as the Factor type and check Enabled. For email OTP, select 'Email OTP' as Factor type. TOTP is more secure since it doesn't rely on email delivery, but email OTP works better for occasional users who won't maintain authenticator apps.
Enable both TOTP and Email OTP initially — users can choose their preferred method during enrollment.
Set policy conditions and timing
Back on the policy record, set When to apply to 'Always' for consistent security, or 'Conditional' if you want location-based or risk-based MFA. Set Grace period (hours) to 24 or 168 (one week) — this determines how often users must re-authenticate with their second factor. Leave Advanced script condition empty unless you need custom logic for when MFA applies.
Configure service account bypass
Navigate to System Security > Multi-Factor Authentication > Policies and create a second policy with Order 50. Name it 'Service Account MFA Bypass' and set User criteria to match your service accounts (typically by role like 'web_service_admin' or by group). Leave Authentication Factors empty — this creates a bypass policy. Position this policy before your main MFA policy so service accounts are excluded from MFA requirements.
Test with admin accounts first
Before activating policies for all users, enroll your admin account in MFA by logging out and back in — ServiceNow will prompt for MFA setup if the policy applies to you. Complete the enrollment process with your chosen method (scan QR code for TOTP or receive email for OTP). Verify you can successfully log in with your second factor before expanding to other users.
Monitor enrollment and failures
Navigate to System Security > Multi-Factor Authentication > User Factors to see which users have enrolled in MFA and which factors they're using. Check System Logs > Authentication for MFA-related failures. Users who haven't enrolled will be prompted during their next login, but you may need to communicate the change and provide enrollment instructions.
Best practices
Always enroll admin users in MFA before activating policies that affect them — if something goes wrong with the MFA system, you need a way to get back in.
Create bypass policies for service accounts with lower order numbers than your main MFA policies — service accounts can't perform interactive MFA and will break integrations.
Use TOTP over email OTP for privileged accounts — email-based authentication is vulnerable to email compromise and delivery delays.
Set up monitoring for MFA authentication failures and enrollment rates — users will need support during the rollout, and ongoing failures indicate system issues.
Don't set grace periods longer than your password expiration policy — it defeats the purpose of requiring regular re-authentication.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue