ServiceNow Multi-Factor Authentication Setup Guide

Architecture Overview

Implementation Steps

// Test Duo Security credential configuration
var rm = new sn_ws.RESTMessageV2();
rm.setEndpoint('https://api-{hostname}.duosecurity.com/auth/v2/check');
rm.setHttpMethod('POST');
rm.setBasicAuth('{integration_key}', '{secret_key}');
var response = rm.execute();
gs.info('Duo connection test response: ' + response.getStatusCode());

// Generate TOTP secret for user enrollment
var TOTPUtil = new global.TOTPUtil();
var userSysId = gs.getUserID();
var secret = TOTPUtil.generateSecret(32);
var qrCodeData = TOTPUtil.generateQRCodeData(secret, gs.getUser().getEmail(), 'ServiceNow Production');
gs.info('TOTP QR Code data: ' + qrCodeData);

// Duo Security authentication verification
var DuoAuth = Class.create();
DuoAuth.prototype = {
  initialize: function() {
    this.restMessage = new sn_ws.RESTMessageV2('Duo Security', 'auth');
  },
  
  verifyAuth: function(username, factor, device) {
    this.restMessage.setStringParameterNoEscape('username', username);
    this.restMessage.setStringParameterNoEscape('factor', factor);
    this.restMessage.setStringParameterNoEscape('device', device);
    
    var response = this.restMessage.execute();
    var responseBody = response.getBody();
    var responseObj = JSON.parse(responseBody);
    
    return responseObj.response.result === 'allow';
  }
};

// Okta Verify push notification challenge
var OktaMFA = Class.create();
OktaMFA.prototype = {
  sendPushChallenge: function(userId, stateToken) {
    var rm = new sn_ws.RESTMessageV2('Okta MFA API', 'post');
    rm.setRequestHeader('Accept', 'application/json');
    rm.setRequestHeader('Content-Type', 'application/json');
    
    var payload = {
      stateToken: stateToken,
      factorType: 'push',
      provider: 'OKTA'
    };
    
    rm.setRequestBody(JSON.stringify(payload));
    var response = rm.execute();
    return JSON.parse(response.getBody());
  }
};

// Step-up authentication policy evaluation
var StepUpAuth = Class.create();
StepUpAuth.prototype = {
  evaluateRisk: function(userSysId, ipAddress, requestedResource) {
    var riskScore = 0;
    
    // Check for unusual IP address
    var userLocationGR = new GlideRecord('sys_user_location_history');
    userLocationGR.addQuery('user', userSysId);
    userLocationGR.addQuery('ip_address', '!=', ipAddress);
    userLocationGR.query();
    if (userLocationGR.getRowCount() === 0) riskScore += 30;
    
    // Check for admin access
    if (gs.hasRole('admin') || gs.hasRole('security_admin')) riskScore += 40;
    
    // Check time of access
    var currentHour = new GlideDateTime().getHour();
    if (currentHour < 6 || currentHour > 22) riskScore += 20;
    
    return riskScore > 50;
  }
};

// Service account MFA bypass validation
var MFABypass = Class.create();
MFABypass.prototype = {
  shouldBypassMFA: function(userSysId, sourceIP) {
    var userGR = new GlideRecord('sys_user');
    userGR.get(userSysId);
    
    // Check if service account
    if (userGR.getValue('internal_type') == 'service' || gs.hasRole('web_service_admin')) {
      gs.log('MFA bypass granted for service account: ' + userGR.getValue('user_name'));
      return true;
    }
    
    // Check trusted IP ranges
    var trustedRanges = ['10.0.0.0/8', '192.168.0.0/16'];
    for (var i = 0; i < trustedRanges.length; i++) {
      if (this.isIPInRange(sourceIP, trustedRanges[i])) {
        return true;
      }
    }
    
    return false;
  }
};

// MFA monitoring and reporting query
var MFAReporting = Class.create();
MFAReporting.prototype = {
  generateMFAReport: function(startDate, endDate) {
    var reportData = {
      totalAttempts: 0,
      successfulAuth: 0,
      failedAuth: 0,
      bypassUsage: 0
    };
    
    var authLogGR = new GlideRecord('sys_audit');
    authLogGR.addQuery('tablename', 'sys_user_session');
    authLogGR.addQuery('sys_created_on', '>=', startDate);
    authLogGR.addQuery('sys_created_on', '<=', endDate);
    authLogGR.query();
    
    while (authLogGR.next()) {
      reportData.totalAttempts++;
      if (authLogGR.getValue('newvalue').indexOf('mfa_success') > -1) {
        reportData.successfulAuth++;
      }
    }
    
    return reportData;
  }
};

Common Use Cases

Troubleshooting

Pro Tips

• →Implement MFA device registration workflows using Service Catalog to provide users with self-service enrollment options while maintaining IT oversight and approval processes. Create catalog items that guide users through device enrollment, generate QR codes securely, and automatically provision access based on user roles and department policies, reducing help desk burden while maintaining security controls.
• →Configure MFA session persistence using encrypted browser tokens to balance security with user experience by reducing authentication frequency for trusted devices. Implement device fingerprinting using JavaScript fingerprinting libraries and store device trust tokens in encrypted format, allowing users to maintain authentication state across browser sessions while requiring fresh MFA challenges for new or suspicious devices.
• →Establish MFA policy testing environments using ServiceNow's clone capabilities to validate authentication flows and policy changes before production deployment. Create automated test scripts that simulate various authentication scenarios including success cases, failure modes, and edge cases using REST API calls, ensuring that policy updates don't inadvertently block legitimate access or create security gaps.
• →Leverage ServiceNow's Event Management framework to create real-time MFA security monitoring that detects unusual authentication patterns, failed MFA attempts, and potential credential stuffing attacks. Configure automated incident creation for security events that exceed defined thresholds and integrate with SIEM systems using webhook notifications to provide centralized security operations center visibility.
• →Implement progressive MFA enrollment campaigns using Notification framework and scheduled jobs to gradually roll out MFA requirements across different user populations based on risk levels and business impact. Create communication workflows that educate users about MFA benefits, provide training resources, and offer hands-on support during enrollment periods to maximize adoption rates and minimize resistance.
• →Design MFA backup authentication methods including SMS, voice calls, and hardware tokens to ensure business continuity during primary authentication method failures. Maintain backup method inventory in ServiceNow asset management and create automated failover logic that seamlessly transitions between authentication methods while logging all fallback events for security analysis and compliance reporting.

Known Limitations

• —Duo Security API rate limiting restricts authentication requests to 100 calls per minute per integration key, requiring implementation of request queuing and exponential backoff logic for high-volume environments. Organizations with more than 1000 concurrent users may need multiple Duo integrations or upgraded service plans to handle peak authentication loads during business hours.
• —ServiceNow's built-in TOTP implementation does not support advanced features like biometric authentication or hardware security keys, limiting options for users who require FIDO2 or WebAuthn compatibility. Third-party authentication providers or custom development may be necessary to support modern passwordless authentication methods.
• —MFA bypass rules cannot be dynamically updated based on real-time threat intelligence feeds, requiring manual policy adjustments when new security threats emerge. The static nature of bypass rule evaluation limits the ability to implement adaptive authentication that responds to changing risk landscapes or threat indicators.
• —Cross-instance MFA synchronization is not supported natively, requiring custom integration development for organizations that need consistent MFA policies across development, test, and production ServiceNow instances. User device enrollments and authentication histories do not automatically propagate between instances during data refreshes.
• —Integration Hub Professional license is required for advanced MFA spoke functionality and custom authentication flows, with standard Integration Hub licensing limiting the number of available authentication provider connections. Organizations may need to prioritize MFA providers based on licensing constraints and user population requirements.

Frequently Asked Questions