How Defender for Cloud Apps helps protect your ServiceNow environment

ServiceNow is a major CRM cloud provider. It stores sensitive data about customers, internal processes, incidents, and reports. As a business-critical app, people both inside and outside your organization use it, including partners and contractors. Many of these users might not follow security best practices. They could share sensitive data without meaning to. Malicious actors might also try to access your most sensitive customer assets.

Connecting ServiceNow to Defender for Cloud Apps improves insights into your users' activities. It also helps detect threats using machine-learning anomaly detection and information protection, such as identifying when sensitive customer data is uploaded to ServiceNow.

Use this app connector to access SaaS Security Posture Management (SSPM) features, via security controls reflected in Microsoft Secure Score. Learn more.

Main threats

Connecting ServiceNow to Defender for Cloud Apps helps you address the following threats:

• Compromised accounts and insider threats
• Data leakage
• Insufficient security awareness
• Unmanaged bring your own device (BYOD)

Protect your environment with Defender for Cloud Apps

You can protect your ServiceNow environment in these ways:

• Detect cloud threats, compromised accounts, and malicious insiders
• Discover, classify, label, and protect regulated and sensitive data stored in the cloud
• Enforce DLP and compliance policies for data stored in the cloud
• Limit exposure of shared data and enforce collaboration policies
• Use the audit trail of activities for forensic investigations

SaaS security posture management for ServiceNow

Connect ServiceNow to Microsoft Defender for Cloud Apps to get security tips for ServiceNow in Microsoft Secure Score.

In Secure Score, select Recommended actions. Filter by Product = ServiceNow. Examples include:

• Enable MFA
• Activate the explicit role plugin
• Enable high security plugin
• Enable script request authorization

For more information, see:

• Security posture management for SaaS apps
• Microsoft Secure Score

Control ServiceNow with built-in policies and policy templates

You can use the following built-in policy templates to detect and notify you about potential threats:

For more information about creating policies, see Create a policy.

Automate governance controls

You can also automate ServiceNow governance actions to fix detected threats. These actions run through Microsoft Entra ID:

For more information about remediating threats from apps, see Governing connected apps.

Protect ServiceNow in real time

Review our best practices for securing and collaborating with external users and blocking and protecting the download of sensitive data to unmanaged or risky devices.

Connect ServiceNow to Microsoft Defender for Cloud Apps

Use the app connector API to connect Microsoft Defender for Cloud Apps to your existing ServiceNow account. The ServiceNow app connector gives you visibility into and control over ServiceNow use. For threat detection, governance controls, and real-time protection guidance, see Protect ServiceNow.

Use this app connector to access SaaS Security Posture Management (SSPM) features, via security controls reflected in Microsoft Secure Score. Learn more.

Prerequisites

• In order to connect ServiceNow with Defender for Cloud Apps,
• Your ServiceNow instance must support API access.
• You must have an admin role.
• The admin account used to make the connection must have permissions to use the API.

Defender for Cloud Apps supports the following ServiceNow versions:

• Eureka
• Fiji
• Geneva
• Helsinki
• Istanbul
• Jakarta
• Kingston
• London
• Madrid
• New York
• Orlando
• Paris
• Quebec
• Rome
• San Diego
• Tokyo
• Utah
• Vancouver
• Washington
• Xanadu
• Yokohama
• Zurich
• Australia

For more information, see ServiceNow OAuth applications documentation.

How to connect ServiceNow to Defender for Cloud Apps using OAuth

Perform the following steps to create an OAuth profile in ServiceNow and connect it to Defender for Cloud Apps:

1. Sign in with an Admin account to your ServiceNow account.

   Note

   For earlier releases, a legacy connection mode is available based on user/password. The username/password provided are only used for API token generation and aren't saved after the initial connection process.

2. Create a new OAuth profile and then select Create an OAuth API endpoint for external clients.

3. Fill in the following Application Registries New record fields:

   1. Enter a name for your OAuth profile, for example, CloudAppSecurity.

   2. Copy the Client ID. You'll need it later.

   3. In the Client Secret field, enter a string. If left empty, a random secret is generated automatically. Copy and save it for later.

   4. Increase the Access Token Lifespan to at least 3,600.

   5. Change the Scope Restriction value to Broadly Scoped.

4. Select the name of the OAuth that was defined, and change the Refresh Token Lifespan to 7,776,000 seconds (90 days).

5. Establish an internal procedure to ensure that the connection remains active.

   1. Make sure to revoke the old refresh token before the expected expiration of the refresh token.
   2. In the Microsoft Defender Portal, edit the existing connector, using the same client ID and client secret. This will generate a new refresh token.

   Note

   Token rotation is a recurring process every 90 days. Without refreshing the token before expiration, the ServiceNow connection will stop working.

Connect ServiceNow to Microsoft Defender for Cloud Apps

To complete the connection in the Microsoft Defender Portal, follow these steps:

1. In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps. Under Connected apps, select App Connectors.

2. In the App connectors page, select +Connect an app, and then ServiceNow.

   

3. In the next window, give the connection a name and select Next.

4. In the Enter details page, select Connect using OAuth token (recommended). Select Next.

   

5. To find your ServiceNow user name, in the ServiceNow portal, go to Users and then locate your name in the table. (Optional) To use a non-admin user for this step, create a non-admin user by following the steps in the below section.

6. In the OAuth Details page, enter your Client ID and Client Secret. Select Next.

7. In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps. Under Connected apps, select App Connectors. Make sure the status of the connected App Connector is Connected.

After connecting ServiceNow, you'll receive events for 1 hour prior to connection.

Optional: Create a non-admin user in ServiceNow

Step 1: Create custom access control lists (ACLs) in ServiceNow

1. Sign in to ServiceNow with an administrator account.
2. Open the Elevate Roles menu and enable both admin and security_admin. These elevated roles are required to create ACLs for certain tables.
3. Navigate to Access Control (ACL) configuration.
4. Create a Read ACL for each of the following tables:
   • sys_user
   • sys_user_group
   • sys_user_grmember
   • sys_user_has_role
   • sys_properties
   • v_plugin
   • sysevent_script_action
   • sys_attachment
   • sys_attachment_doc
   • sysevent
   • syslog_transaction
   • incident
   • sys_user_role_contains
5. For each ACL, set Type = record, Operation = read, Name = the table name, and Required Role = a custom role such as custom_table_access.
6. Use the same custom role across all ACLs to simplify management.

Step 2: Create a non-admin user

1. In ServiceNow, go to User Administration > Users.
2. Create a new user account.
3. Record the username and password for later use in the integration setup.
4. Open the newly created user profile.
5. Scroll to the Roles section.
6. Assign the custom role created in Step 1 (for example, custom_table_access) to the user.

Legacy ServiceNow connection

To connect ServiceNow with Defender for Cloud Apps, you must have admin-level permissions and make sure the ServiceNow instance supports API access.

1. Sign in with an Admin account to your ServiceNow account.

2. Create a new service account for Defender for Cloud Apps and attach the Admin role to the newly created account.

3. Make sure the REST API plug-in is turned on.

Next steps

• If you have any problems connecting the app, see Troubleshooting App Connectors.

• Control cloud apps with policies