Lab #0: Setup Lab Environments

---

🛠️ 1: Walkthrough

1.1: Access Moveworks & Moveworks Setup

Goal: Use the “side-door” entry to gain initial administrative access.

1. Check your email for an onboarding message from noreply@moveworks.ai with subject “[Moveworks] Welcome to MyMoveworks”. It contains your org name and the welcome URL for your specific lab instance.

2. Click the Visit link in the email to open the login page. Enter your Work Email and Org Name (both provided in the onboarding email), then click Send Login Link.

3. Check your email for a message with subject “[Login] Temporary access link to login into MyMoveworks” and click the link to access your Moveworks portal. 4. Upon clicking the link, you will be redirected to an assistant window within My Moveworks

1. Say Hi to start interacting with Moveworks
   1. Moveworks won’t be able to do much yet, since this instance still needs to be configured!
2. Click the Manage apps in the lower left to be redirected to the My Moveworks Product Page
3. On this screen we can see all of the available products within this Moveworks instance. To start implementing Moveworks, we will use Moveworks Setup, which is how the base functionality of Moveworks is configured.
   1. Select Moveworks Setup
4. You will be redirected to the Moveworks Setup Overview Page & be able to see all of the available configuration modules for this Moveworks instance. Next we will set up SSO so you can log back in without a temporary link.

1.2: Setting up The Okta Trial Environment & Moveworks Application

Goal: Establish a sandbox Identity Provider (IdP) to simulate enterprise authentication.

1. Sign Up: Go to Okta & sign up for a free trial of the Okta platform using your business email address.
2. Register: Fill out the registration form and choose Workforce Identity Cloud if prompted. If asked to schedule a 1:1 for a personalized tour of Okta, leave it unchecked — this is not needed. Click Finish.
3. If prompted with a 4-window onboarding flow starting with “Choose the apps that are most important to integrate”, select any values and proceed through each screen. These selections do not affect the lab configuration — the only requirement is a provisioned Okta trial instance.
4. Activate: Check your email for the activation link. Your Okta Tenant URL will look like: https://trial-#######.okta.com.

5. Admin Console: Log in and ensure you are in the Admin Console (click “Admin” in the top-right if you are on the user dashboard).

6. Add User: Navigate to Directory > People > Add Person

1. Create your own user account (if not already listed).

• Fill in your details and click Save. After adding your own user account if should look like this:

7. Find the Moveworks App: Navigate to Applications > Applications > Browse App Integration Catalog
   • Search for Moveworks and select Moveworks OIDC
8. Configure the Moveworks App.
   1. Application Label: Moveworks
   2. Subdomain: [moveworks-instance-name]

3. Data Center: (check the Visit URL in your onboarding email to confirm)
   • Prod3 lab environments: prod3.us.moveworks.com
   • Standard environments: moveworks.com
4. Assign your user to the application:
   • Go to the Assignments tab.
   • Click Assign > Assign to People and select your user.
5. Save your Credentials:
   1. Navigate to the Sign On tab & save your Client ID & Client Secret
      1. These credentials are required later when setting up My Moveworks SSO Access in Step 1.3!

1.3: Setup My Moveworks Okta SSO

Goal: Bridge Moveworks and Okta using OIDC.

1. Keep your Okta tab with the application credentials open. In another tab, navigate back to your Moveworks Setup instance.
2. In the upper left hand search bar, type in SSO and navigate to Organizational Details > Tenant Settings > Single Sign-On (SSO),
3. Select Create
4. Add the configuration details
   • Moveworks Product: Studio
   • Connector: moveworks
   • Authentication Protocol: OIDC
   • IDP Redirect URL:

• Prod3 environments: https://[moveworks-instance-name].prod3.us.moveworks.com/login/sso/oidc
• Standard environments: https://[moveworks-instance-name].moveworks.com/login/sso/oidc

• IDP Issuer: Your Okta Trial Instance URL
  • https://trial-[your_number].okta.com
• IDP Client ID + Secret
  • Retrieved these values from the SSO tab in the Moveworks App created in Okta

5. The other information can be left blank. After you are finished Submit your configuration

6. Every time you save a configuration within Moveworks, you will leave a change history. This will appear in the Configuration Logs module.

7. Verify SSO is working: Go to your Okta instance and click the Moveworks tile to confirm it logs you in successfully.

1.4: ServiceNow Setup — Choose Your Track

Goal: Get into a ServiceNow instance as admin, add your user, and capture the admin sys_id for Lab 1.

The ServiceNow setup steps differ depending on how you’re taking these labs. Pick the track that matches your situation and complete that page in a separate browser tab before proceeding to Lab 1.

1.5: [OPTIONAL] Simplifying the Okta Login

You will always need to enter an Okta Verify code to get into the Admin panel within your Okta trial instance, but you can take the following steps so that your end-user okta session persists longer & no longer prompts Okta Verify

1. Within the Okta Admin Console, navigate to Global Session Policy
2. Edit the Default Policy
3. Allow users to set Establish the user session with: A password
4. Set the Maxmimum Okta global session lifetime & Maximum Okta global session idle timeto the desired length. We recommend 2 days for each.

1.6: [OPTIONAL] If Working with a Lab Teammate — Sharing a Moveworks Instance

If you are sharing a Moveworks instance with a lab teammate, complete the following steps to grant them access.

Step 1 — Okta: Add your teammate as a user

1. In the Okta Admin Console, go to Directory > People > Add Person
2. Fill in your teammate’s name and work email, then click Save
3. Go to Applications > Applications, open the Moveworks app, and go to the Assignments tab
4. Click Assign > Assign to People and assign your teammate

Step 2 — ServiceNow: Add your teammate as a user

1. In your ServiceNow instance (Cloud Labs or PDI), go to User Administration > Users
2. Click New and fill in your teammate’s name and work email
3. Set their Department to IT
4. Click Save

Step 3 — Moveworks: Grant your teammate admin access (complete after Lab 2)

1. In My Moveworks, click the grid icon in the upper right corner
2. Select Roles and Permissions
3. Find your teammate’s name and assign them all roles

---

✅ 2: Verification & Next Steps

1. Check Success:
   • If you completed Okta + SSO (sections 1.2–1.3): Go to your Okta instance and click the Moveworks application tile to confirm it redirects you to Moveworks on Web.
   • If you skipped Okta (On-Demand track): Use the temporary login link from your welcome email to confirm you can reach My Moveworks. You’ll request a new link the next time you return.

---

🪞 3: Reflecting on This Configuration

Through this guide, you’ve learned the following:

• The difference between Moveworks Temporary Access Links (one-time use) and SSO Access (enterprise-grade, persistent authentication).
• How to connect an Identity Provider (IdP) to Moveworks using OIDC for Single Sign-On.
• The importance of User Assignments within the IdP to grant platform access.

---

⚙️ 4: Configuration Details

Use the table below to fill in the required fields accurately.