> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.moveworks.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server. # Lab #0: Setup Lab Environments ## Overview * **Learning Objectives:** Configure the foundational environments required for the Moveworks implementation. By the end of this lab, you will have access to Moveworks Setup and (if applicable to your track) a secured Single Sign-On (SSO) connection via Okta. You will then complete the ServiceNow setup using the track-specific page that matches how you're taking these labs. * **Recommendations:** * Leverage two monitors — there will be a lot of copy + pasting from disparate systems in this lab * Open a Notes or Spreadsheet doc * Maintain access to the following pages (keep them open in separate browser tabs): * Okta Dashboard *(if setting up SSO)* * My Moveworks portal * Your ServiceNow track page (Cloud Labs **or** PDI — see Section 1.4) * **Estimated Time:** 45–60 minutes (Moveworks + Okta), plus 10–15 minutes for your ServiceNow track page * **Prerequisites:** * Work email address * Access to Moveworks Tenant URL (provided by instructor for ILT, or by your Moveworks contact for On-Demand) * Okta Verify Application installed on your mobile device *(only if setting up SSO)* *** ## 🛠️ 1: Walkthrough ### 1.1: Access Moveworks & Moveworks Setup *Goal: Use the "side-door" entry to gain initial administrative access.* Temporary access links are only valid for 15 minutes. If you need to login to the environment again, send yourself an activation email via one of these links: 1. [my.moveworks.com/welcome](http://my.moveworks.com/welcome) 2. [my.prod3.us.moveworks.com/welcome](https://my.prod3.us.moveworks.com/welcome) Please confirm with your class instructor which URL to use. 1. **Check your email** for an onboarding message from `noreply@moveworks.ai` with subject **"\[Moveworks] Welcome to MyMoveworks"**. It contains your **org name** and the **welcome URL** for your specific lab instance. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/19be89094fc9773d3ca7d4e9378dbbe94f33f1110866bc922880dda40442ed44/docs/assets/images/setup-labs/lab0_mw_onboarding_email.png) **How to identify your data center:** Look at the **Visit** URL in your onboarding email. If it contains `prod3.us.moveworks.com`, you are on the **prod3** data center. If it contains `my.moveworks.com`, you are on the **standard** data center. You will need this when configuring Okta in section 1.2. 2. Click the **Visit** link in the email to open the login page. Enter your **Work Email** and **Org Name** (both provided in the onboarding email), then click **`Send Login Link`**. **Note: Retain your org name, you will need it for a later step** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/c092898fef015a64e544834144e443e91a8f701111b786c67e6282c1e72a7aac/docs/assets/images/setup-labs/lab0_mw_login_page.png) 3\. **Check your email** for a message with subject **"\[Login] Temporary access link to login into MyMoveworks"** and click the link to access your Moveworks portal. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/beae8244e7b04079dd578514ee3903d6427e926da57c5ceec341de86a18df2ec/docs/assets/images/setup-labs/lab0_mw_temp_access_email.png) 4\. Upon clicking the link, you will be redirected to an assistant window within My Moveworks 1. Say `Hi` to start interacting with Moveworks 1. Moveworks won't be able to do much yet, since this instance still needs to be configured! 2. Click the **`Manage apps`** in the lower left to be redirected to the **`My Moveworks Product Page`** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/fc36f52e1a45c249c095b41699783e33819361cc9eb92ead91279e432e0b3d47/docs/assets/images/setup-labs/lab0_0e89259c-2e8f-4c6e-8d53-5ae8ea1de2f3_image_-_2026-02-03T163316.761.png) 3. On this screen we can see all of the available products within this Moveworks instance. To start implementing Moveworks, we will use Moveworks Setup, which is how the base functionality of Moveworks is configured. 1. Select `Moveworks Setup` ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/d234af09968f166b5e50d33ba76f04b304fc0b181c6b3f68437ee514368d2d87/docs/assets/images/setup-labs/lab0_a8f9833c-ba09-41a1-bf2c-5464b40d86c2_image_-_2026-02-03T163118.849.png) 4. You will be redirected to the **`Moveworks Setup Overview Page`** & be able to see all of the available configuration modules for this Moveworks instance. Next we will set up SSO so you can log back in without a temporary link. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/b1774ee378f9d36f6e8dad822cad078874a9af82757a6847f1a8d7da31bc186a/docs/assets/images/setup-labs/lab0_9a8ba863-de2d-43d1-9210-5e8cf372ac2a_setup_overview_page.png) ### 1.2: Setting up The Okta Trial Environment & Moveworks Application *Goal: Establish a sandbox Identity Provider (IdP) to simulate enterprise authentication.* **On-Demand / PDI track:** Okta setup is **optional**. If you don't want to configure SSO, skip sections **1.2 and 1.3** and use temporary login links from `my.moveworks.com/welcome` (or `my.prod3.us.moveworks.com/welcome`) for the rest of the labs. The downside: you'll need to request a new login link each time your session expires. We recommend completing 1.2 and 1.3 anyway if you plan to return to your instance regularly. **Open Okta in a new browser tab** so you can switch between Okta and Moveworks Setup without losing your session in either. **Keep these tabs open throughout the lab:** * Okta Admin Console *(if setting up SSO)* * Moveworks Setup * Your ServiceNow track page (Cloud Labs **or** PDI — see Section 1.4) **Keep this information on hand (Notes doc or spreadsheet recommended):** * Moveworks Instance Name (e.g. `labsandbox-1-partner`) * Okta Client ID & Client Secret (saved in step 9 below, if setting up SSO) * ServiceNow Admin `sys_id` (saved in your ServiceNow track page) 1. **Sign Up:** Go to [Okta](https://www.okta.com/free-trial/workforce-identity/) & sign up for a free trial of the Okta platform using your business email address. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/0d0a28b11f04331b98f6ebffe28f1b63d80b9102040f2e9ade593e31338519af/docs/assets/images/setup-labs/lab0_okta_free_trial_signup.png) 2. **Register:** Fill out the registration form and choose **Workforce Identity Cloud** if prompted. If asked to schedule a 1:1 for a personalized tour of Okta, leave it unchecked — this is not needed. Click **Finish**. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/70b5c3d3cb6530926cd0a1003d016fcf12756d5dab12fc086f579a2b5416a9c0/docs/assets/images/setup-labs/lab0_okta_register_form.png) 3. If prompted with a 4-window onboarding flow starting with **"Choose the apps that are most important to integrate"**, select any values and proceed through each screen. These selections do not affect the lab configuration — the only requirement is a provisioned Okta trial instance. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/1fa36c82ebdf3379abfd315a1b09ac873dffa97b548791628dce3f9bbc7fc3a2/docs/assets/images/setup-labs/lab0_okta_personalized_tour.png) 4. **Activate:** Check your email for the activation link. Your Okta Tenant URL will look like: `https://trial-#######.okta.com`. **Note:** You will need to configure a password & set up the Okta Verify app using your mobile device. Keep your mobile device handy, as you will need to use Okta verify again to login to the Okta Admin Dashboard ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/40f3970d67b73de491c0867a3a413eb18953a7f01bb30522f0a65fdf4cf3c3ba/docs/assets/images/setup-labs/lab0_c07c3137-537b-4e1f-bdb8-37676443e3c0_image.png) 5\. **Admin Console:** Log in and ensure you are in the **Admin Console** (click "Admin" in the top-right if you are on the user dashboard). **Note:** If you are prompted to import apps, select the **`skip`** button and continue ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/422b8840198925bc6bac36e978477b4f0e676f4b292a7dab028092af6f50f4df/docs/assets/images/setup-labs/lab0_649efcdf-951c-460d-bff3-388354cb99d3_okta_admin.png) 6\. **Add User:** Navigate to **`Directory > People > Add Person`** 1. Create your own user account (if not already listed). * Fill in your details and click **`Save`**. After adding your own user account if should look like this: ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/ba52900b74f1745cb67dea255bf6f0da7ccf6fc755792404594f9a57e9f5e823/docs/assets/images/setup-labs/lab0_f6c58315-4479-4daa-b4ad-2675abc544a1_image.png) 7. **Find the Moveworks App:** Navigate to **`Applications > Applications > Browse App Integration Catalog`** * Search for **`Moveworks`** and select **`Moveworks OIDC`** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/c259262326a0a2a5f68c9bcbf7fd0e8a4a53f852072e7140fe7e91a627fe9cdd/docs/assets/images/setup-labs/lab0_a0976e68-f424-4d1b-bb17-f743ff4a2ed3_okta_browse_app_catalog.png) ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/86d3f800556e5f7914f7e6049de7ab8107f4d75bb725739f2fbc32f7a0990045/docs/assets/images/setup-labs/lab0_884b160b-832c-4f83-b1e2-9bcc50a0e8d0_okta_find_moveworks.png) 8. **Configure the Moveworks App.** 1. **Application Label:** **`Moveworks`** 2. **Subdomain:** **`[moveworks-instance-name]`** Replace `[moveworks-instance-name]` with your Moveworks org name from the onboarding email in step 1.1.1. 3. **Data Center:** *(check the Visit URL in your onboarding email to confirm)* * **Prod3 lab environments:** **`prod3.us.moveworks.com`** * **Standard environments:** **`moveworks.com`** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/00005b62994491790b3a115e75268116f93c8123c0f2aa7feac067a78e4ee879/docs/assets/images/setup-labs/lab0_okta_dc_and_subdomain.png) 4. **Assign your user to the application:** * Go to the **`Assignments`** tab. * Click **`Assign > Assign to People`** and select your user. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/0647a258f76a107656e57b7bd703d87e25f752d06041b389ff987a569fab4dfb/docs/assets/images/setup-labs/lab0_683ab603-3e3d-4cfc-9deb-1009cfa8e6fd_okta_assign_app.png) 5. **Save your Credentials:** 1. Navigate to the `Sign On` tab & save your **`Client ID & Client Secret`** 1. These credentials are required later when setting up **My Moveworks SSO Access in Step 1.3!** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/9242f807509dcbdeeb203f42f9f6bc8d30b0ffe69cab14f12337a9f4d87ddb2c/docs/assets/images/setup-labs/lab0_3960cf27-ce02-405e-bf2d-c7659d678c03_okta_sso_client_credentials.png) **Note: While going through the rest of the Moveworks Labs, we recommend keeping your Okta session opened in a tab on your browser, for ease of navigation** ### 1.3: Setup My Moveworks Okta SSO *Goal: Bridge Moveworks and Okta using OIDC.* **Note:** You will need the idp Client ID, Client Secret, and URL from your Okta instance to complete this step 1. Keep your Okta tab with the application credentials open. In another tab, navigate back to your Moveworks Setup instance. 2. In the upper left hand search bar, type in `SSO` and navigate to **`Organizational Details > Tenant Settings > Single Sign-On (SSO)`**, 3. Select **`Create`** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/3d627b0fd904960c3c938c3c17a93ac62aacca0d20aaf807370647688229f2f6/docs/assets/images/setup-labs/lab0_0807c090-1207-4a37-a52a-a4a1c2c8fd07_image.png) 4. Add the configuration details * **Moveworks Product:** `Studio` * **Connector:** **`moveworks`** * **Authentication Protocol:** `OIDC` * **IDP Redirect URL:** Replace `[moveworks-instance-name]` below with your Moveworks org name from the onboarding email in step 1.1.1. * Prod3 environments: `https://[moveworks-instance-name].prod3.us.moveworks.com/login/sso/oidc` * Standard environments: `https://[moveworks-instance-name].moveworks.com/login/sso/oidc` **Do NOT append `-admin` to your Okta URL.** Using `https://trial-[your_number]-admin.okta.com` will cause SSO to fail. The correct issuer URL ends in `.okta.com` only. * **IDP Issuer**: Your Okta Trial Instance URL * `https://trial-[your_number].okta.com` * **IDP Client ID + Secret** * Retrieved these values from the SSO tab in the Moveworks App created in Okta ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/2b94937829e8c2499a17b14991b8cbf74bcfed40c0d4f332d284b3f8f1d51bcd/docs/assets/images/setup-labs/lab0_moveworks_sso_config.png) 5\. The other information can be left blank. After you are finished **`Submit`** your configuration ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/dcd7bda98bde949fc60d196cf7d130a81c9a4fd9a405f48aa2bac2794cd63540/docs/assets/images/setup-labs/lab0_f18a7f6d-affe-4b97-89b5-a13baa30b7d7_submit_sso.png) 6\. Every time you save a configuration within Moveworks, you will leave a change history. This will appear in the `Configuration Logs` module. **Note:** Always describe what you did in your change summary. Your future self will thank you! ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/1c92466802249de5fbbad654390aefe40dd253493ba80bdb66ead01a798dd9f6/docs/assets/images/setup-labs/lab0_17c46007-008c-42a8-bc31-bcbdcb2ee4cd_trial_okta_confirmation.png) 7\. **Verify SSO is working:** Go to your Okta instance and click the **`Moveworks`** tile to confirm it logs you in successfully. If the Okta tile does not log you in, double-check your entries from steps 1.2.8 and 1.3.4 — the most common mistakes are an incorrect **Subdomain** or **IDP Redirect URL** (wrong org name or wrong data center URL). ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/ef9b515cbd11d884f7e959049703b5b50f3cb037462c5049c16fe764ced42e19/docs/assets/images/setup-labs/lab0_dee88de6-fce2-44fb-8a25-d39e6a90d48f_okta_sso_tile.png) ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/abb739dc31174b7c8bda8376571dac48ddecb868f0555877880e035914b273a7/docs/assets/images/setup-labs/lab0_bc9e87ca-60d1-4db8-808e-229fac8c18d2_image.png) ### 1.4: ServiceNow Setup — Choose Your Track *Goal: Get into a ServiceNow instance as `admin`, add your user, and capture the admin `sys_id` for Lab 1.* The ServiceNow setup steps differ depending on how you're taking these labs. Pick the track that matches your situation and complete that page in a separate browser tab before proceeding to Lab 1. You're attending a live, instructor-led session and your instructor has provided a **ServiceNow Cloud Labs reservation code**. \~10 minutes. You're working through the labs on your own time and using your own **ServiceNow Personal Developer Instance** from `developer.servicenow.com`. \~15 minutes. **Both tracks produce the same end state:** a ServiceNow instance with admin access, your work user added with `Department = IT`, and the `admin` account's `sys_id` saved to your notes. Labs 1–7 are identical regardless of which track you complete here. ### 1.5: \[OPTIONAL] Simplifying the Okta Login You will always need to enter an Okta Verify code to get into the `Admin` panel within your Okta trial instance, but you can take the following steps so that your end-user okta session persists longer & no longer prompts Okta Verify 1. Within the Okta Admin Console, navigate to `Global Session Policy` ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/dae29f264369f0e5d55b3ea25a49fa9d9e0bdde364d068a659ee01a3d1d72d1b/docs/assets/images/setup-labs/lab0_cba267ab-ea33-434a-844f-84aa4b32dd45_image.png) 2. Edit the Default Policy ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/82ede0e9d4503bb9e2e0e505cd86933c9007449977cd223459e8093750f33b84/docs/assets/images/setup-labs/lab0_2a852e48-2058-46cc-861d-ee4bb3d7790b_okta_edit.png) 3. Allow users to set **Establish the user session with:** **`A password`** ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/c7f25666ed7c9e7cb776b183f69b79e10da88326cf7b21aafb8757214cc8f1e6/docs/assets/images/setup-labs/lab0_5f0e457c-57c6-4331-aed9-3a500c20bda0_okta_password.png) 4. Set the `Maxmimum Okta global session lifetime` & `Maximum Okta global session idle time`to the desired length. We recommend 2 days for each. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/9b9d3c82fee2dae1e3af89817d8ec5289f62aa51fc030dab985056708c076a1f/docs/assets/images/setup-labs/lab0_b162025c-1aae-424f-9730-d892cc40f79a_okta_session_timers.png) ### 1.6: \[OPTIONAL] If Working with a Lab Teammate — Sharing a Moveworks Instance *If you are sharing a Moveworks instance with a lab teammate, complete the following steps to grant them access.* **Step 1 — Okta: Add your teammate as a user** 1. In the Okta Admin Console, go to **`Directory > People > Add Person`** 2. Fill in your teammate's name and work email, then click **`Save`** 3. Go to **`Applications > Applications`**, open the **`Moveworks`** app, and go to the **`Assignments`** tab 4. Click **`Assign > Assign to People`** and assign your teammate **Step 2 — ServiceNow: Add your teammate as a user** 1. In your ServiceNow instance (Cloud Labs or PDI), go to **`User Administration > Users`** 2. Click **`New`** and fill in your teammate's name and work email 3. Set their **`Department`** to `IT` 4. Click **`Save`** **Step 3 — Moveworks: Grant your teammate admin access** *(complete after Lab 2)* Your teammate must be ingested into the Moveworks roster (Lab 2) before you can assign them roles. 1. In My Moveworks, click the **grid icon** in the upper right corner 2. Select **`Roles and Permissions`** 3. Find your teammate's name and assign them **all roles** *** ## ✅ 2: Verification & Next Steps 1. **Check Success:** * *If you completed Okta + SSO (sections 1.2–1.3):* Go to your Okta instance and click the Moveworks application tile to confirm it redirects you to Moveworks on Web. * *If you skipped Okta (On-Demand track):* Use the temporary login link from your welcome email to confirm you can reach My Moveworks. You'll request a new link the next time you return. ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/ef9b515cbd11d884f7e959049703b5b50f3cb037462c5049c16fe764ced42e19/docs/assets/images/setup-labs/lab0_dee88de6-fce2-44fb-8a25-d39e6a90d48f_okta_sso_tile.png) ![](https://files.buildwithfern.com/moveworks.docs.buildwithfern.com/abb739dc31174b7c8bda8376571dac48ddecb868f0555877880e035914b273a7/docs/assets/images/setup-labs/lab0_bc9e87ca-60d1-4db8-808e-229fac8c18d2_image.png) **Next:** Complete the ServiceNow setup page that matches your track: * **ILT track:** [Lab #0 — ServiceNow Setup (Cloud Labs / ILT)](/ai-assistant/getting-started/labs/moveworks-setup/lab-0-servicenow-cloud-labs) * **On-Demand track:** [Lab #0 — ServiceNow Setup (PDI / On-Demand)](/ai-assistant/getting-started/labs/moveworks-setup/lab-0-servicenow-pdi) *** ## 🪞 3: Reflecting on This Configuration Through this guide, you've learned the following: * The difference between Moveworks **Temporary Access Links** (one-time use) and **SSO Access** (enterprise-grade, persistent authentication). * How to connect an Identity Provider (IdP) to Moveworks using OIDC for Single Sign-On. * The importance of **User Assignments** within the IdP to grant platform access. *** ## ⚙️ 4: Configuration Details Use the table below to fill in the required fields accurately. | **Field Name** | **Action / Value to Enter** | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Section 1.1:** | **Access Moveworks & Moveworks Setup** | | **Work Email ID** | Your Work Email that you used to register for this lab | | **Org Name** | `[moveworks-instance-name]` provisioned to you for this lab | | **Section 1.2:** | **Setting up The Okta Trial Environment & Moveworks Application** | | **Okta → Add Person** | Enter your Name + Email Address used to register for this lab session | | **Application** | **Moveworks OIDC** | | **Application Label** | Moveworks | | **Subdomain** | `[moveworks-instance-name]` provisioned to you for this lab | | **Data\_Center** | Prod3: `prod3.us.moveworks.com` / Standard: `moveworks.com` | | **Assignment** | Ensure you have assigned your user to the application | | **Section 1.3:** | **Setup My Moveworks Okta SSO** | | **Moveworks Product** | studio | | **Connector** | okta | | **Authentication Protocol** | OIDC | | **IDP redirect URL** | Prod3: `https://[moveworks-instance-url].prod3.us.moveworks.com/login/sso/oidc` / Standard: `https://[moveworks-instance-url].moveworks.com/login/sso/oidc` | | **IDP Client ID** | The Client ID field from your Okta environment in step 1.2 | | **IDP Client Secret** | The Client Secret field from your Okta environment in step 1.2 |