Lab #1: Moveworks Access and SSO

---

🛠️ 1: Walkthrough

1.1: Access Moveworks & Moveworks Setup

Goal: Use the welcome email to gain initial administrative access.

1. Check your email for an onboarding message from noreply@moveworks.ai with the subject “[Moveworks] Welcome to MyMoveworks”. It contains your org name and the welcome URL for your lab instance.

   

   How to identify your data center: Look at the Visit URL in your onboarding email. If it contains prod3.us.moveworks.com, you are on the prod3 data center. If it contains my.moveworks.com, you are on the standard data center. You need this when configuring Okta in Section 1.2.

2. Click the Visit link in the email to open the login page. Enter your Work Email and Org Name (both in the onboarding email), then click Send Login Link. Save your org name in your notes; later steps use it.

   

3. Check your email for a message with the subject “[Login] Temporary access link to login into MyMoveworks” and click the link to open your Moveworks portal.

   

4. The link opens an assistant window in My Moveworks.

   1. Say Hi to start interacting with Moveworks. It can’t do much yet, because the instance still needs to be configured.
   2. Click Manage apps in the lower left to open the My Moveworks Product Page.

   

5. This page lists the products available in your Moveworks instance. Moveworks Setup is where you configure the base functionality of Moveworks. Select Moveworks Setup.

   

6. The Moveworks Setup Overview Page opens and shows the configuration modules for your instance. Next, set up SSO so you can log back in without a temporary link.

   

1.2: Set Up the Okta Trial Environment & Moveworks Application

Goal: Establish a sandbox Identity Provider (IdP) to simulate enterprise authentication.

1. Sign up: Go to Okta and sign up for a free trial using your business email address.

   

2. Register: Fill out the registration form and choose Workforce Identity Cloud if prompted. If asked to schedule a personalized tour, leave it unchecked. Click Finish.

   

3. If a four-screen onboarding flow starts with “Choose the apps that are most important to integrate”, select any values and continue through each screen. These selections don’t affect the lab.

   

4. Activate: Check your email for the activation link. Your Okta tenant URL looks like https://trial-#######.okta.com.

   You’ll set a password and enroll the Okta Verify app on your mobile device. Keep the device handy; you need Okta Verify each time you log in to the Okta Admin Console.

   

5. Admin Console: Log in and make sure you are in the Admin Console (click Admin in the top right if you land on the user dashboard). If you are prompted to import apps, click Skip.

   

6. Add user: Navigate to Directory > People > Add Person and create your own user account if it isn’t already listed. Fill in your details and click Save. Your user list should look like this:

   

7. Find the Moveworks app: Navigate to Applications > Applications > Browse App Integration Catalog, search for Moveworks, and select Moveworks OIDC.

   

   

8. Configure the Moveworks app:

   1. Application Label: Moveworks
   2. Subdomain: [moveworks-instance-name], replaced with your org name from the onboarding email (Section 1.1, step 1)
   3. Data Center: check the Visit URL in your onboarding email to confirm
      • Prod3 lab environments: prod3.us.moveworks.com
      • Standard environments: moveworks.com

   

9. Assign your user to the application: Go to the Assignments tab, click Assign > Assign to People, and select your user.

   

10. Save your credentials: On the Sign On tab, copy the Client ID and Client Secret to your notes. Section 1.3 needs them.

    

1.3: Set Up My Moveworks Okta SSO

Goal: Connect Moveworks and Okta using OIDC.

1. Keep your Okta tab with the application credentials open. In another tab, go back to Moveworks Setup.

2. In the search bar in the upper left, type SSO and navigate to Organizational Details > Tenant Settings > Single Sign-On (SSO).

3. Click Create.

   

4. Enter the configuration details:

   • Moveworks Product: Studio
   • Connector: moveworks
   • Authentication Protocol: OIDC
   • IDP Redirect URL: replace [moveworks-instance-name] with your org name from the onboarding email
     • Prod3 environments: https://[moveworks-instance-name].prod3.us.moveworks.com/login/sso/oidc
     • Standard environments: https://[moveworks-instance-name].moveworks.com/login/sso/oidc
   • IDP Issuer: your Okta trial instance URL, https://trial-[your_number].okta.com
   • IDP Client ID and Client Secret: the values from the Okta app’s Sign On tab
   Do not append -admin to your Okta URL. Using https://trial-[your_number]-admin.okta.com causes SSO to fail. The correct issuer URL ends in .okta.com.

   

5. Leave the other fields blank and click Submit.

   

6. Every configuration you save in Moveworks Setup records a change history entry, which appears in the Configuration Logs module. Always describe what you did in the change summary.

   

7. Verify SSO is working: In your Okta instance, click the Moveworks tile and confirm it logs you in.

   If the Okta tile does not log you in, recheck Section 1.2 step 8 and Section 1.3 step 4. The most common mistakes are a wrong Subdomain or IDP Redirect URL (wrong org name or wrong data center).

   

   

1.4: Set Up ServiceNow

Goal: Get a ServiceNow instance, add your user, and create the integration account Moveworks uses.

Complete Lab #2: ServiceNow Setup in a separate browser tab before starting Lab #3. It uses the ServiceNow instance your ILT host provided.

1.5: [OPTIONAL] Simplify the Okta Login

You always need an Okta Verify code to open the Okta Admin Console, but these steps make your end-user Okta session last longer and stop prompting for Okta Verify.

1. In the Okta Admin Console, navigate to Global Session Policy.

   

2. Edit the Default Policy.

   

3. Set Establish the user session with to A password.

   

4. Set Maximum Okta global session lifetime and Maximum Okta global session idle time to the length you want. We recommend 2 days for each.

   

1.6: [OPTIONAL] Share a Moveworks Instance with a Lab Teammate

Complete these steps if a teammate shares your Moveworks instance.

Step 1: Add your teammate in Okta

1. In the Okta Admin Console, go to Directory > People > Add Person.
2. Enter your teammate’s name and work email, then click Save.
3. Go to Applications > Applications, open the Moveworks app, and go to the Assignments tab.
4. Click Assign > Assign to People and assign your teammate.

Step 2: Add your teammate in ServiceNow (complete after Lab #2)

1. In your ServiceNow instance, go to User Administration > Users.
2. Click New and enter your teammate’s name and work email.
3. Set their Department to IT.
4. Click Submit.

Step 3: Grant your teammate admin access in Moveworks (complete after Lab #4)

1. In My Moveworks, click the grid icon in the upper right corner.
2. Select Roles and Permissions.
3. Find your teammate and assign them all roles.

---

✅ 2: Verification & Next Steps

1. Check success:
   • If you set up Okta SSO (Sections 1.2 and 1.3): In your Okta instance, click the Moveworks tile and confirm it opens Moveworks on Web.
   • If you skipped Okta: Use the temporary login link from your welcome email to confirm you can reach My Moveworks. Request a new link the next time you return.

---

🪞 3: Reflecting on This Configuration

Through this lab, you’ve learned the following:

• The difference between Moveworks temporary access links (one-time use) and SSO access (persistent, enterprise authentication)
• How to connect an Identity Provider (IdP) to Moveworks using OIDC for Single Sign-On
• Why user assignments in the IdP control who can reach the platform

---

⚙️ 4: Configuration Details

Use the table below to fill in the required fields accurately.