ServiceNow Azure Active Directory Integration Guide

Architecture Overview

Implementation Steps

// Test Microsoft Graph API connection
var r = new sn_ws.RESTMessageV2('Microsoft Graph', 'GET');
r.setEndpoint('https://graph.microsoft.com/v1.0/users?$top=1');
r.setAuthenticationProfile('oauth2', 'azure_ad_oauth_credential');
var response = r.execute();
gs.info('Graph API Response: ' + response.getStatusCode() + ' - ' + response.getBody());

// LDAP connection test script for MID Server
var ldapServer = new GlideRecord('ldap_server_config');
ldapServer.get('name', 'Azure AD LDAP');
var testResult = new LDAPConnectionTest(ldapServer);
if (testResult.testConnection()) {
    gs.info('LDAP connection successful to Azure AD');
} else {
    gs.error('LDAP connection failed: ' + testResult.getErrorMessage());
}

// Transform script for Azure AD user import
(function runTransformScript(source, map, log, target) {
    // Map Azure AD department to ServiceNow department
    if (source.department) {
        var dept = new GlideRecord('cmn_department');
        dept.addQuery('name', source.department.toString());
        dept.query();
        if (dept.next()) {
            target.department = dept.sys_id;
        }
    }
    
    // Set user to active if account is enabled in AD
    target.active = (source.userAccountControl != '514');
})(source, map, log, target);

// Business rule for automatic role assignment based on AD groups
(function executeRule(current, previous) {
    var groupName = current.group.name.toString();
    var userId = current.user.toString();
    
    // Map Azure AD groups to ServiceNow roles
    var roleMap = {
        'ServiceNow_Admins': 'admin',
        'ServiceNow_ITILUsers': 'itil',
        'ServiceNow_EndUsers': 'snc_external'
    };
    
    if (roleMap[groupName]) {
        var gr = new GlideRecord('sys_user_has_role');
        gr.initialize();
        gr.user = userId;
        gr.role = roleMap[groupName];
        gr.insert();
    }
})(current, previous);

// Monitoring script for Azure AD integration health
var healthCheck = {
    checkLDAPConnection: function() {
        var ldap = new GlideRecord('ldap_server_config');
        ldap.get('name', 'Azure AD LDAP');
        return ldap.isValidRecord() && ldap.active;
    },
    
    checkRecentImports: function() {
        var importRun = new GlideRecord('sys_import_set_run');
        importRun.addQuery('sys_created_on', '>', gs.daysAgoStart(1));
        importRun.addQuery('state', 'complete');
        importRun.query();
        return importRun.hasNext();
    }
};

gs.info('Azure AD Integration Health: LDAP=' + healthCheck.checkLDAPConnection() + ', Imports=' + healthCheck.checkRecentImports());

Common Use Cases

Troubleshooting

Pro Tips

• →Configure LDAP import schedules during off-peak hours and implement delta imports using Azure AD's whenChanged attribute to reduce processing time and system impact. Set up monitoring dashboards that track import success rates and user authentication patterns to proactively identify integration issues before they affect end users.
• →Implement certificate monitoring workflows that alert administrators 30 days before SAML signing certificates expire, and maintain a certificate rotation runbook that includes both Azure AD and ServiceNow update procedures. Use ServiceNow's Scheduled Script Execution to automate certificate expiration checks and create incident records for proactive renewal.
• →Create custom business rules that log Azure AD group membership changes to audit tables for compliance reporting and access review purposes. Implement approval workflows for high-privilege role assignments that require manager approval even when automatically triggered by Azure AD group membership changes.
• →Configure Azure AD app registration with multiple redirect URIs for different ServiceNow environments (dev, test, production) but use separate client credentials for each environment to maintain proper segregation. Set up Azure AD application proxy connectors for hybrid scenarios where on-premises ServiceNow instances need secure access to cloud-based Azure AD.
• →Use ServiceNow's Integration Hub Microsoft Graph spoke actions for real-time user attribute updates instead of relying solely on scheduled LDAP imports for time-sensitive changes. Implement event-driven workflows that trigger immediate user updates when critical attributes like department or manager change in Azure AD.
• →Configure Azure AD B2B guest user policies to automatically provision external users in ServiceNow with restricted roles when they're invited to collaborate on specific projects. Set up automated cleanup processes that deactivate ServiceNow accounts when Azure AD guest accounts expire or are removed from the tenant.

Known Limitations

• —Microsoft Graph API throttling limits restrict high-volume user synchronization to 10,000 requests per 10-minute window, potentially causing delays in large organization deployments with frequent user changes. LDAP import operations are limited by domain controller performance and network latency, typically supporting batch imports of 5,000-10,000 users per hour depending on attribute complexity and MID Server resources.
• —SAML 2.0 attribute mapping is limited to static field assignments and doesn't support complex transformations or conditional logic that might be available in other identity providers. Nested Azure AD group memberships aren't automatically flattened during LDAP imports, requiring custom scripting or separate import processes to handle complex organizational hierarchies.
• —Azure AD Connect synchronization delays can cause up to 30-minute latency between on-premises Active Directory changes and availability in ServiceNow when using hybrid identity scenarios. Conditional access policies applied to ServiceNow may interfere with automated integration scripts and service account operations, requiring careful exception configuration.
• —MID Server LDAP connectivity requires persistent network connections and doesn't support dynamic port allocation or load balancing across multiple domain controllers without additional configuration. Cross-forest or multi-tenant Azure AD scenarios require separate LDAP configurations and credential management, increasing complexity for large enterprise deployments.
• —ServiceNow's native SAML implementation doesn't support advanced Azure AD features like session lifetime policies or continuous access evaluation, limiting real-time risk-based authentication capabilities. Role-based access control mapping is limited to group membership evaluation and doesn't integrate with Azure AD Privileged Identity Management just-in-time access features.

Frequently Asked Questions