Citrix ServiceNow – How Do I Enable MFA?

MFA allows users to add layers of security that make it harder for attackers to take over their accounts. It requires a verification factor or set of factors that cover knowledge (passwords, PINs), possession (smartphones with hardware OTP tokens) and inherence (fingerprints, voices, eyes, irises). Enable MFA Service

When it comes to email and banking, MFA offers protection against harmful cyberattacks. It ensures that even if a username and password gets stolen via phishing, an attacker won’t be able to gain access.

Enabling Multi-Factor Authentication (MFA) in ServiceNow involves a few steps. Please note that the exact steps might vary slightly based on your ServiceNow instance version and configuration.

Here Is A General Guide:

1. Access your ServiceNow instance: Log in to your ServiceNow instance with your administrator credentials.
2. Navigate to Multi-Factor Authentication Setup:
   • In the left navigation pane, open the “System Security” application.
   • Look for the “Multi-Factor Authentication” module or a similar option depending on your instance configuration.
3. Configure MFA Policies:
   • Within the Multi-Factor Authentication module, configure the MFA policies based on your organization’s requirements. This may include settings such as which users are required to use MFA, under what conditions MFA is triggered, and which MFA methods are allowed.
4. Configure MFA Methods:
   • Set up the MFA methods you want to enable. ServiceNow typically supports multiple MFA methods, such as SMS, email, time-based one-time password (TOTP), and more.
   • Configure the chosen MFA methods with the necessary details, such as phone numbers or email addresses for users.
5. Test MFA Configuration:
   • Before enforcing MFA for all users, it’s a good practice to test the configuration with a small group of users to ensure that everything works as expected.
6. Enable MFA:
   • Once you are satisfied with the MFA configuration and have tested it successfully, you can enable MFA for all users or for specific user roles.
7. Communicate Changes to Users:
   • Inform your users about the implementation of MFA. Provide clear instructions on how to set up and use MFA methods.
8. Monitor and Maintain:
   • Regularly monitor MFA usage and ensure that any issues are addressed promptly. Periodically review and update MFA policies based on security requirements and changes in your organization.

1. Log in to your account

When a user logs into ServiceNow, they will be prompted to authenticate using MFA if their administrator has enabled multi-factor authentication upon initial login. Users are able to select their preferred authenticator method (mobile app, push notification, or one-time password) in the Select Login Policy dropdown menu.

If a user has opted to use an authenticator app when they first log in, the instance will display a QR code that they can scan to quickly set up their authenticator app. (Note: if your user will be logging in with a biometric device or hardware key, they must register the authenticator before their initial login.)

In addition to the MFA step, users will be prompted to answer the security question that they have configured in their user profile. This step is used in case they are unable to answer the MFA question. This is also a good time to change the security question if needed.

2. Go to Settings

When you sign in to your account, Citrix sends a one-time code to your primary email address. This code is used to verify your identity. Once you have verified your identity, you can access the app store and select an authenticator app to use. Google

To configure this, download the XML file from the PhenixID MFA project on ServiceNow and change YOUR_PHENIXID_IDP_DOMAIN to the domain name of your PhenixID Authentication Services instance. You can also do this manually by clicking SAML 2 Single sign-on -> Properties and changing the user mail value (corresponding to the ServiceNow userID) to your email value.

3. Click on Security

MFA is an authentication process that requires more than just a user name and password. This extra layer of security makes it much more difficult for hackers to steal a user’s information because they will need a second factor to gain access. MFA is also a requirement under many compliance policies covering customer, patient, or financial information.

This helps protect against phishing attacks by ensuring that users are not trying to access sensitive information from an unknown or suspicious location. Enable MFA Service

4. Select MFA

If your administrator has enabled the option, you can use biometric authenticators or hardware security keys for authentication instead of your mobile app OTP. To enable this, follow the steps in Register a biometric authenticator or Register a hardware security key.

To configure SAML for MFA with AuthPoint as the identity provider, download the XML file from the PhenixID project on ServiceNow (recommended) or manually enter the values using the Admin Console. In the XML file, change YOUR_PHENIXID_IDP_DOMAIN to the domain name of your PhenixID Authentication Services instance. Enable MFA Service

On the MFA Settings page, select your desired MFA factors and create a sign-on rule for them as described in the Configuring MFA Factors tutorial.