ServiceNow Microsoft Azure Integration Guide

Architecture Overview

Implementation Steps

// Example identification rule for Azure VMs
var azureVm = new GlideRecord('cmdb_ci_computer');
azureVm.addQuery('install_status', '!=', '7'); // Not retired
azureVm.addQuery('name', 'CONTAINS', 'azure');
azureVm.query();
while (azureVm.next()) {
    // Update Azure-specific attributes
    azureVm.cloud_provider = 'Microsoft Azure';
    azureVm.update();
}

(function process(request, response) {
    var payload = request.body.dataString;
    var alertData = JSON.parse(payload);
    
    var incident = new GlideRecord('incident');
    incident.initialize();
    incident.short_description = 'Azure Alert: ' + alertData.data.essentials.alertRule;
    incident.description = alertData.data.essentials.description;
    incident.priority = alertData.data.essentials.severity == 'Sev0' ? '1' : '3';
    incident.category = 'Infrastructure';
    incident.subcategory = 'Cloud Services';
    incident.assignment_group = 'Cloud Operations';
    incident.caller_id = 'azure.monitor';
    var incidentSysId = incident.insert();
    
    response.setStatus(200);
    response.setBody({result: 'Incident created: ' + incidentSysId});
})(request, response);

// Example workflow script for VM power management
var azureAction = new sn_hub_ctf.IntegrationHubActionRunner();
azureAction.setActionName('Microsoft Azure', 'Start Virtual Machine');
azureAction.setParameter('connection_alias', 'Azure_Connection');
azureAction.setParameter('subscription_id', workflow.variables.subscription_id);
azureAction.setParameter('resource_group', workflow.variables.resource_group);
azureAction.setParameter('vm_name', workflow.variables.vm_name);
var result = azureAction.execute();
if (result.getStatusCode() == 200) {
    workflow.variables.operation_status = 'Success';
} else {
    workflow.variables.operation_status = 'Failed: ' + result.getErrorMessage();
}

// Health check script for Azure integration
var healthCheck = new GlideRecord('sys_hub_action_status');
healthCheck.addQuery('action_name', 'CONTAINS', 'Microsoft Azure');
healthCheck.addQuery('sys_created_on', '>', gs.hoursAgoStart(1));
healthCheck.addQuery('status', 'error');
healthCheck.query();
if (healthCheck.getRowCount() > 5) {
    gs.eventQueue('azure.integration.health.warning', null, 
        'High error rate detected in Azure integration: ' + healthCheck.getRowCount() + ' errors in last hour');
}

Common Use Cases

Troubleshooting

Pro Tips

• →Implement credential rotation automation by creating a scheduled script that monitors Azure service principal certificate expiration dates and generates ServiceNow tasks for renewal 30 days before expiration. This prevents integration outages due to expired credentials and provides audit trails for security compliance.
• →Use Azure resource tags strategically to drive ServiceNow automation by syncing tag values into CMDB CI attributes, enabling automatic assignment group determination and cost center allocation based on Azure tagging standards. Configure discovery schedules to prioritize critical resource types during business hours while running comprehensive scans during maintenance windows.
• →Optimize Azure API rate limit utilization by implementing intelligent batching in custom scripts that group multiple resource operations into single API calls where possible. Monitor rate limit headers in API responses and implement exponential backoff retry logic to handle temporary rate limiting gracefully without failing entire workflows.
• →Enhance security by implementing Azure Managed Identity authentication where possible for MID Servers running on Azure VMs, eliminating the need to store long-lived secrets in ServiceNow credential records. Use Azure Key Vault integration to dynamically retrieve credentials and implement automatic rotation workflows.
• →Create comprehensive integration dashboards using Performance Analytics to track key metrics like API call success rates, CMDB synchronization lag, incident creation velocity from Azure alerts, and cost optimization workflow effectiveness. Set up automated anomaly detection to alert on unusual integration patterns that might indicate configuration issues or Azure service problems.
• →Implement disaster recovery procedures by maintaining backup Connection & Credential aliases pointing to secondary Azure service principals in different regions, enabling quick failover if primary Azure AD tenant access is compromised. Document emergency procedures for manual Azure resource management when ServiceNow integration is unavailable.

Known Limitations

• —Azure Resource Manager APIs enforce rate limits of 12,000 read operations and 1,200 write operations per hour per subscription, which can constrain large-scale CMDB synchronization and bulk resource management operations. Organizations with multiple subscriptions need separate connection aliases and careful orchestration to avoid cross-subscription rate limit conflicts.
• —The Azure spoke requires IntegrationHub Professional licensing, which adds significant cost for organizations only needing basic Azure integration capabilities. Some advanced Azure services like Azure DevOps, Azure AD B2C, and specialized AI services require custom REST message development since they're not covered by the standard spoke actions.
• —Real-time synchronization is not supported due to Azure's webhook limitations for resource changes, meaning CMDB data can lag actual Azure state by several hours depending on discovery schedule frequency. Complex Azure resource hierarchies and cross-resource relationships may not be fully represented in ServiceNow's CMDB model without extensive customization.
• —MID Server dependency introduces additional infrastructure requirements and potential single points of failure, particularly for organizations preferring cloud-native integration architectures. The integration cannot leverage some advanced ServiceNow cloud features when MID Server connectivity is required for Azure API access.
• —Azure Monitor webhook payloads vary significantly between different alert types and versions, requiring constant maintenance of parsing logic as Microsoft updates alert schemas. Integration testing becomes complex when dealing with Azure's multi-tenant environments and service principal permissions that behave differently across tenant configurations.

Frequently Asked Questions