How Defender for Cloud Apps helps protect your ServiceNow environment

As a major CRM cloud provider, ServiceNow incorporates large amounts of sensitive information about customers, internal processes, incidents, and reports inside your organization. Being a business-critical app, ServiceNow is accessed and used by people inside your organization and by others outside of it (such as partners and contractors) for various purposes. In many cases, a large proportion of your users accessing ServiceNow have low awareness of security and might put your sensitive information at risk by unintentionally sharing it. In other instances, malicious actors might gain access to your most sensitive customer-related assets.

Connecting ServiceNow to Defender for Cloud Apps improves insights into your users' activities. It also helps detect threats using machine-learning anomaly detection and information protection, such as identifying when sensitive customer data is uploaded to ServiceNow.

Use this app connector to access SaaS Security Posture Management (SSPM) features, via security controls reflected in Microsoft Secure Score. Learn more.

Main threats

• Compromised accounts and insider threats
• Data leakage
• Insufficient security awareness
• Unmanaged bring your own device (BYOD)

How Defender for Cloud Apps helps to protect your environment

• Detect cloud threats, compromised accounts, and malicious insiders
• Discover, classify, label, and protect regulated and sensitive data stored in the cloud
• Enforce DLP and compliance policies for data stored in the cloud
• Limit exposure of shared data and enforce collaboration policies
• Use the audit trail of activities for forensic investigations

SaaS security posture management

Connect ServiceNow to automatically get security recommendations for ServiceNow in Microsoft Secure Score.

In Secure Score, select Recommended actions and filter by Product = ServiceNow. For example, recommendations for ServiceNow include:

• Enable MFA
• Activate the explicit role plugin
• Enable high security plugin
• Enable script request authorization

For more information, see:

• Security posture management for SaaS apps
• Microsoft Secure Score

Control ServiceNow with built-in policies and policy templates

You can use the following built-in policy templates to detect and notify you about potential threats:

For more information about creating policies, see Create a policy.

Automate governance controls

In addition to monitoring for potential threats, you can apply and automate the following ServiceNow governance actions to remediate detected threats:

For more information about remediating threats from apps, see Governing connected apps.

Protect ServiceNow in real time

Review our best practices for securing and collaborating with external users and blocking and protecting the download of sensitive data to unmanaged or risky devices.

Connect ServiceNow to Microsoft Defender for Cloud Apps

This article provides instructions for connecting Microsoft Defender for Cloud Apps to your existing ServiceNow account using the app connector API. This connection gives you visibility into and control over ServiceNow use. For information about how Defender for Cloud Apps protects ServiceNow, see Protect ServiceNow.

Use this app connector to access SaaS Security Posture Management (SSPM) features, via security controls reflected in Microsoft Secure Score. Learn more.

Prerequisites

• In order to connect ServiceNow with Defender for Cloud Apps,
• Your ServiceNow instance must support API access.
• You must have an admin role.
• The admin account used to make the connection must have permissions to use the API.

Defender for Cloud Apps supports the following ServiceNow versions:

• Eureka
• Fiji
• Geneva
• Helsinki
• Istanbul
• Jakarta
• Kingston
• London
• Madrid
• New York
• Orlando
• Paris
• Quebec
• Rome
• San Diego
• Tokyo
• Utah
• Vancouver
• Washington
• Xanadu
• Yokohama
• Zurich

For more information, see the ServiceNow product documentation.

How to connect ServiceNow to Defender for Cloud Apps using OAuth

1. Sign in with an Admin account to your ServiceNow account.

   Note

   For earlier releases, a legacy connection mode is available based on user/password. The username/password provided are only used for API token generation and aren't saved after the initial connection process.

2. Create a new OAuth profile and then select Create an OAuth API endpoint for external clients.

3. Fill in the following Application Registries New record fields:

   1. Enter a name for your OAuth profile, for example, CloudAppSecurity.

   2. Copy the Client ID. You'll need it later.

   3. In the Client Secret field, enter a string. If left empty, a random secret is generated automatically. Copy and save it for later.

   4. Increase the Access Token Lifespan to at least 3,600.

4. Select the name of the OAuth that was defined, and change the Refresh Token Lifespan to 7,776,000 seconds (90 days).

5. Establish an internal procedure to ensure that the connection remains active.

   1. Make sure to revoke the old refresh token before the expected expiration of the refresh token.
   2. In the Microsoft Defender Portal, edit the existing connector, using the same client ID and client secret. This will generate a new refresh token.

   Note

   This is a recurring process every 90 days. Without this, the ServiceNow connection will stop working.

Connect ServiceNow to Microsoft Defender for Cloud Apps

1. In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps. Under Connected apps, select App Connectors.

2. In the App connectors page, select +Connect an app, and then ServiceNow.

   

3. In the next window, give the connection a name and select Next.

4. In the Enter details page, select Connect using OAuth token (recommended). Select Next.

   

5. To find your ServiceNow User ID, in the ServiceNow portal, go to Users and then locate your name in the table.

6. In the OAuth Details page, enter your Client ID and Client Secret. Select Next.

7. In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps. Under Connected apps, select App Connectors. Make sure the status of the connected App Connector is Connected.

After connecting ServiceNow, you'll receive events for 1 hour prior to connection.

Legacy ServiceNow connection

To connect ServiceNow with Defender for Cloud Apps, you must have admin-level permissions and make sure the ServiceNow instance supports API access.

1. Sign in with an Admin account to your ServiceNow account.

2. Create a new service account for Defender for Cloud Apps and attach the Admin role to the newly created account.

3. Make sure the REST API plug-in is turned on.

Next steps

• If you have any problems connecting the app, see Troubleshooting App Connectors.

• Control cloud apps with policies