ServiceNow Multi-Factor Authentication (MFA) stands out as an important defense mechanism against unauthorized access. However, its effectiveness is based on proper setup and configuration. This guide walks you through setting up MFA in ServiceNow, best practices for configuration, and troubleshooting common issues.
The Integration - MFA (com.snc.integration.multifactor.authentication) plugin is installed by default, but it must be enabled by an administrator using a system property.
Step 1: Accessing MFA Settings:
Log in as an Administrator, navigate to the "Multi-Factor Authentication" section, and select "Properties."
Step 2: Enabling MFA:
In the MFA settings page, toggle the switch to enable Multi-Factor Authentication on your side. You can also change the properties below to customize MFA to meet your security requirements.
Use multi-factor criteria to determine which users and roles must use two-step multi-factor verification. You can use one of these criteria or a combination of them to suit your business needs.
User-based Multi-Factor Criteria
Use user-based multi-factor criteria to select individual users who are required to log in using MFA. Administrators update the Enable MFA field on a user record to enable or disable MFA requirements for a user.
1. Navigate to the "User Administration" section and select "Users".
2. Configure the list to show the Enable MFA column and save it.
3. Change the values of the Enable MFA column for the selected users to true. (When the user logs in with their username and password, they are prompted to set up MFA).
4. Save the user and enable MFA.
Role-based Multi-Factor Criteria
Use role-based multi-factor criteria to require MFA login for all users assigned to a specific role. The Role-based multi-factor authentication record on the Multi-factor Criteria [multi_factor_criteria] table contains the list of roles that require an MFA login.
1. Navigate to the "Multi-Factor Authentication" section and select "Multi-factor Criteria"
2. In the Multi-Factor Criteria List, open the "Role-based multi-factor authentication" record.
3. Use the "Multi-factor Roles" list to add or remove roles. To add a row, you have to double-click "Insert a new row," enter or select a role name, and click on the Save Icon to save the entry.
To remove a role, click on the delete icon to remove a role from the list.
4. Click Update.
Step 1: Accessing Instance Security Center Portal:
Log in as security_dashboard_user or admin, navigate to the " System Security" section and select "Instance Security Center".
Step 2: Access MFA Metrics:
Once you are on the ISC Portal, navigate to the "Metrics" section, and select "MFA Metrics."
Step 3: Monitoring MFA:
Upon reaching the MFA Metrics page, you'll find the following key indicators for monitoring.
1. Enforce MFA for All Users
Make MFA mandatory for all users accessing ServiceNow to ensure uniform protection across the organization.
2. Activate MFA for Administrators
ServiceNow recommends that customers enable MFA by default for all Admin users.
3. Use Multiple Authentication Methods
Offer a variety of MFA methods to meet different user preferences and needs. Options may include SMS authentication, authenticator apps, hardware tokens, or biometric authentication.
4. Educate Users About MFA
Provide clear instructions to users on how to set up and use MFA. Educate them about the importance of MFA and how it adds an extra layer of security to their accounts.
5. Monitor and Analyze Authentication
Regularly monitor authentication activities to track the adoption rate of MFA among users on the instance. This allows for informed decision-making and ensures ongoing security optimization.
Issue: User Unable to Receive Verification Code
Note that ServiceNow tests MFA with the following applications: Google Authenticator, Microsoft Authenticator, LastPass Authenticator, Authy, FreeOTP, Duo, and Okta Verify. Other authenticators not listed might also be compatible but have not been tested by ServiceNow.
Issue: Clone the Instance and MFA Doesn’t Work
Issue: Authentication Failure Despite Correct Credentials
Issue: Hardware Token Malfunction
Setting up and optimizing Multi-Factor Authentication (MFA) in ServiceNow is crucial for enhancing security and protecting against unauthorized access. This guide provides detailed steps on how to enable and configure MFA, best practices to ensure effective implementation, and solutions to common issues. By following these guidelines, organizations can significantly strengthen their security posture and ensure that their ServiceNow environment remains secure and resilient.
