---
locale: "en"
updated_at: "2025-10-27T22:49:27.288Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/sso/configure-the-applications/servicenow"
---

# Configure ServiceNow for UserLock Single Sign-On (SSO)

Set up SSO access for ServiceNow users.

## Introduction

This guide explains how to integrate ServiceNow with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once configured, ServiceNow logins are authenticated by UserLock against Active Directory. This provides a seamless login experience and allows administrators to apply UserLock [access policies](/userlock/docs/reference/core-concepts/access-policies) (MFA, time, machine, or location restrictions) on SSO sessions.

🚩 **Before starting:**

- You need a **ServiceNow administrator account**.
- **UserLock SSO** must already be [installed and configured](/userlock/docs/guides/sso/install-configure-sso).

## Step 1. Enable ServiceNow in UserLock SSO

1. In the **UserLock console**, go to ⚙ **Server settings ▸ Single Sign-On**.
2. In the list of applications, select **ServiceNow**.
3. Fill in the fields with the following values:
  | Settings | Values |
  | --- | --- |
  | Application Domain | `https://<yourInstance>.service-now.com`  *(the domain of your ServiceNow instance)* |
  | Email domain | Domain used by users to authenticate (e.g. contoso.com) |
4. Save the profile.

![](https://a.storyblok.com/f/122374/569x855/1e6be3e788/servicenow_parametres.PNG)

## Step 2. Configure ServiceNow for Single Sign-On

1. Ensure the Multi-Provider SSO plugin is installed:
  - In the **ServiceNow search box**, type **Multi-Provider SSO**.
  - If it’s not listed, go to **System Definition ▸Plugins**.
  - Search for **Integration - Multiple Provider Single Sign-On Installer** and install or activate it.
2. Log in to **ServiceNow** with an administrator account.
3. Navigate to **Multi-Provider SSO ▸Identity Providers**, then click **New**.
4. When prompted for the SSO type, select **SAML**.
5. In the **Import Identity Provider Metadata** dialog box, choose **URL** and enter:
`https://<SSO_domain>/metadata`
  ![](https://a.storyblok.com/f/122374/638x384/1f27f83a60/servicenow_metadata.png)
6. Click **Import**.
  - If an error occurs during import:
    1. In the **UserLock console**, go to ⚙ **Server settings ▸ Single Sign-On**.
    2. Click on **Download  ▸  Metadata file**
    3. Open the downloaded file with a text editor (e.g. Notepad) and copy its contents.
    4. Return to the ServiceNow console, select **XML** in the import dialog, and paste the content.
7. Once imported, verify that all fields are populated correctly.
  ![](https://a.storyblok.com/f/122374/651x482/9ba17cd19f/servicenow_form.png)
8. Click **Test Connection**.
  - If the test is successful, click **Activate**.
  - If activation fails:
    1. Clear the **SingleLogoutRequest** field in the Identity Provider settings.
    2. Run the **Test Connection** and **Activate** process again.
    3. Once successful, you can re-enter the **SingleLogoutRequest** URL:
    `https://<SSO_domain>/connect/endsession`
    > **Note**
    >
    > The **SingleLogoutRequest** field is optional. Keeping it blank during setup helps display more detailed error messages.
9. In the Identity Provider record, under **Related Links**, click **Set as Auto Redirect IDP** to redirect to UserLock SSO the users accessing your instance homepage.
10. **Activate the SSO**
  1. Navigate to **Multi-Provider SSO ▸Administration ▸Properties**.
  2. Click **Enable multi provider SSO**.

## Troubleshooting

For common issues, see [Troubleshooting SSO](/userlock/docs/support/troubleshooting/sso-issues).
If the problem persists, please contact [IS Decisions Support](/support).

### Handling SSO unavailability  

- To disable SSO temporarily:
  1. Open the **Identity Provider** configuration in ServiceNow.
  2. Click **Deactivate**.
- To bypass SSO and log in with standard credentials:
  1. Go to `https://<yourInstance>.service-now.com/side_door.do`
  2. You’ll be redirected to the default ServiceNow login page where you can sign in using ServiceNow credentials.

### Redirected to “Logout Successful” after login

- The user account may not exist in ServiceNow.
- Alternatively, the SAML certificate may be outdated.

### Cannot activate configuration after successful test

This can occur when testing with a non-existent user.
To update a configuration after a successful test:

1. Deactivate the identity provider.
2. Update the configuration.
3. Run **Test Connection**.
4. Click **Activate** again.

## Next steps

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

- [Apply MFA on SaaS connections](/userlock/docs/guides/mfa-implementation/mfa-for-sso) to require stronger authentication.
- [Hour restrictions](/userlock/docs/reference/access-policies/time-restriction): define when users are allowed to connect.
- [Geolocation rules](/userlock/docs/reference/access-policies/geolocation): enforce access policies based on user location.
- [Session limits](/userlock/docs/reference/access-policies/session-limit): allow or deny SaaS logins entirely for specific users.