> This page is for Assistant Platform. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.moveworks.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server. # Lab #1: Moveworks Access and SSO > **Info** > > ## Overview > > * **Learning Objectives:** Configure the foundational environments for the Moveworks labs. By the end of this lab, you will have access to Moveworks Setup and, optionally, a Single Sign-On (SSO) connection through Okta. You then set up ServiceNow in [Lab #2: ServiceNow Setup](/ai-assistant/getting-started/labs/moveworks-setup/lab-2-servicenow-setup). > * **Recommendations:** > * Use two monitors. This lab involves a lot of copying and pasting between systems. > * Open a Notes or spreadsheet doc for the values you'll collect. > * Keep these pages open in separate browser tabs: > * Okta Admin Console *(if setting up SSO)* > * My Moveworks portal > * Your ServiceNow instance *(after Lab #2)* > * **Estimated Time:** 45 to 60 minutes, plus 20 minutes for Lab #2: ServiceNow Setup > * **Prerequisites:** > * Work email address > * Your Moveworks instance name and welcome email (provided by your ILT host) > * Okta Verify installed on your mobile device *(only if setting up SSO)* --- ## 🛠️ 1: Walkthrough ### 1.1: Access Moveworks & Moveworks Setup *Goal: Use the welcome email to gain initial administrative access.* > **Error** > > **Temporary access links are valid for only 15 minutes.** To log in again later, send yourself a new link from one of these pages: > > 1. [my.moveworks.com/welcome](https://my.moveworks.com/welcome) > 2. [my.prod3.us.moveworks.com/welcome](https://my.prod3.us.moveworks.com/welcome) > > Confirm with your ILT host which URL to use. 1. **Check your email** for an onboarding message from `noreply@moveworks.ai` with the subject **"\[Moveworks] Welcome to MyMoveworks"**. It contains your **org name** and the **welcome URL** for your lab instance. ![](/_fern-files/_img/19be89094fc9773d3ca7d4e9378dbbe94f33f1110866bc922880dda40442ed44.webp) > **Note** > > **How to identify your data center:** Look at the **Visit** URL in your onboarding email. If it contains `prod3.us.moveworks.com`, you are on the **prod3** data center. If it contains `my.moveworks.com`, you are on the **standard** data center. You need this when configuring Okta in Section 1.2. 2. Click the **Visit** link in the email to open the login page. Enter your **Work Email** and **Org Name** (both in the onboarding email), then click **Send Login Link**. Save your org name in your notes; later steps use it. ![](/_fern-files/_img/c092898fef015a64e544834144e443e91a8f701111b786c67e6282c1e72a7aac.webp) 3. **Check your email** for a message with the subject **"\[Login] Temporary access link to login into MyMoveworks"** and click the link to open your Moveworks portal. ![](/_fern-files/_img/beae8244e7b04079dd578514ee3903d6427e926da57c5ceec341de86a18df2ec.webp) 4. The link opens an assistant window in My Moveworks. 1. Say `Hi` to start interacting with Moveworks. It can't do much yet, because the instance still needs to be configured. 2. Click **Manage apps** in the lower left to open the **My Moveworks Product Page**. ![](/_fern-files/_img/fc36f52e1a45c249c095b41699783e33819361cc9eb92ead91279e432e0b3d47.webp) 5. This page lists the products available in your Moveworks instance. Moveworks Setup is where you configure the base functionality of Moveworks. Select **Moveworks Setup**. ![](/_fern-files/_img/d234af09968f166b5e50d33ba76f04b304fc0b181c6b3f68437ee514368d2d87.webp) 6. The **Moveworks Setup Overview Page** opens and shows the configuration modules for your instance. Next, set up SSO so you can log back in without a temporary link. ![](/_fern-files/_img/b1774ee378f9d36f6e8dad822cad078874a9af82757a6847f1a8d7da31bc186a.webp) ### 1.2: Set Up the Okta Trial Environment & Moveworks Application *Goal: Establish a sandbox Identity Provider (IdP) to simulate enterprise authentication.* > **Tip** > > **Okta setup is optional.** To skip SSO, skip Sections 1.2 and 1.3 and use temporary login links from `my.moveworks.com/welcome` (or `my.prod3.us.moveworks.com/welcome`) for the rest of the labs. You'll need to request a new link each time your session expires, so complete 1.2 and 1.3 if you plan to return to your instance regularly. > **Info** > > **Keep this information in your notes:** > > * Moveworks org name (for example, `labsandbox-1-partner`) > * Okta Client ID and Client Secret (saved in step 10 below, if setting up SSO) > * ServiceNow integration account `sys_id` (saved in Lab #2: ServiceNow Setup) 1. **Sign up:** Go to [Okta](https://www.okta.com/free-trial/workforce-identity/) and sign up for a free trial using your business email address. ![](/_fern-files/_img/0d0a28b11f04331b98f6ebffe28f1b63d80b9102040f2e9ade593e31338519af.webp) 2. **Register:** Fill out the registration form and choose **Workforce Identity Cloud** if prompted. If asked to schedule a personalized tour, leave it unchecked. Click **Finish**. ![](/_fern-files/_img/70b5c3d3cb6530926cd0a1003d016fcf12756d5dab12fc086f579a2b5416a9c0.webp) 3. If a four-screen onboarding flow starts with **"Choose the apps that are most important to integrate"**, select any values and continue through each screen. These selections don't affect the lab. ![](/_fern-files/_img/1fa36c82ebdf3379abfd315a1b09ac873dffa97b548791628dce3f9bbc7fc3a2.webp) 4. **Activate:** Check your email for the activation link. Your Okta tenant URL looks like `https://trial-#######.okta.com`. > **Note** > > You'll set a password and enroll the Okta Verify app on your mobile device. Keep the device handy; you need Okta Verify each time you log in to the Okta Admin Console. ![](/_fern-files/_img/40f3970d67b73de491c0867a3a413eb18953a7f01bb30522f0a65fdf4cf3c3ba.webp) 5. **Admin Console:** Log in and make sure you are in the **Admin Console** (click **Admin** in the top right if you land on the user dashboard). If you are prompted to import apps, click **Skip**. ![](/_fern-files/_img/422b8840198925bc6bac36e978477b4f0e676f4b292a7dab028092af6f50f4df.webp) 6. **Add user:** Navigate to **Directory > People > Add Person** and create your own user account if it isn't already listed. Fill in your details and click **Save**. Your user list should look like this: ![](/_fern-files/_img/ba52900b74f1745cb67dea255bf6f0da7ccf6fc755792404594f9a57e9f5e823.webp) 7. **Find the Moveworks app:** Navigate to **Applications > Applications > Browse App Integration Catalog**, search for `Moveworks`, and select **Moveworks OIDC**. ![](/_fern-files/_img/c259262326a0a2a5f68c9bcbf7fd0e8a4a53f852072e7140fe7e91a627fe9cdd.webp) ![](/_fern-files/_img/86d3f800556e5f7914f7e6049de7ab8107f4d75bb725739f2fbc32f7a0990045.webp) 8. **Configure the Moveworks app:** 1. **Application Label:** `Moveworks` 2. **Subdomain:** `[moveworks-instance-name]`, replaced with your org name from the onboarding email (Section 1.1, step 1) 3. **Data Center:** check the **Visit** URL in your onboarding email to confirm * Prod3 lab environments: `prod3.us.moveworks.com` * Standard environments: `moveworks.com` ![](/_fern-files/_img/00005b62994491790b3a115e75268116f93c8123c0f2aa7feac067a78e4ee879.webp) 9. **Assign your user to the application:** Go to the **Assignments** tab, click **Assign > Assign to People**, and select your user. ![](/_fern-files/_img/0647a258f76a107656e57b7bd703d87e25f752d06041b389ff987a569fab4dfb.webp) 10. **Save your credentials:** On the **Sign On** tab, copy the **Client ID** and **Client Secret** to your notes. Section 1.3 needs them. ![](/_fern-files/_img/9242f807509dcbdeeb203f42f9f6bc8d30b0ffe69cab14f12337a9f4d87ddb2c.webp) ### 1.3: Set Up My Moveworks Okta SSO *Goal: Connect Moveworks and Okta using OIDC.* > **Note** > > You need the Client ID, Client Secret, and URL from your Okta instance to complete this section. 1. Keep your Okta tab with the application credentials open. In another tab, go back to Moveworks Setup. 2. In the search bar in the upper left, type `SSO` and navigate to **Organizational Details > Tenant Settings > Single Sign-On (SSO)**. 3. Click **Create**. ![](/_fern-files/_img/3d627b0fd904960c3c938c3c17a93ac62aacca0d20aaf807370647688229f2f6.webp) 4. Enter the configuration details: * **Moveworks Product:** `Studio` * **Connector:** `moveworks` * **Authentication Protocol:** `OIDC` * **IDP Redirect URL:** replace `[moveworks-instance-name]` with your org name from the onboarding email * Prod3 environments: `https://[moveworks-instance-name].prod3.us.moveworks.com/login/sso/oidc` * Standard environments: `https://[moveworks-instance-name].moveworks.com/login/sso/oidc` * **IDP Issuer:** your Okta trial instance URL, `https://trial-[your_number].okta.com` * **IDP Client ID** and **Client Secret:** the values from the Okta app's **Sign On** tab > **Error** > > **Do not append `-admin` to your Okta URL.** Using `https://trial-[your_number]-admin.okta.com` causes SSO to fail. The correct issuer URL ends in `.okta.com`. ![](/_fern-files/_img/2b94937829e8c2499a17b14991b8cbf74bcfed40c0d4f332d284b3f8f1d51bcd.webp) 5. Leave the other fields blank and click **Submit**. ![](/_fern-files/_img/dcd7bda98bde949fc60d196cf7d130a81c9a4fd9a405f48aa2bac2794cd63540.webp) 6. Every configuration you save in Moveworks Setup records a change history entry, which appears in the **Configuration Logs** module. Always describe what you did in the change summary. ![](/_fern-files/_img/1c92466802249de5fbbad654390aefe40dd253493ba80bdb66ead01a798dd9f6.webp) 7. **Verify SSO is working:** In your Okta instance, click the **Moveworks** tile and confirm it logs you in. > **Error** > > **If the Okta tile does not log you in,** recheck Section 1.2 step 8 and Section 1.3 step 4. The most common mistakes are a wrong **Subdomain** or **IDP Redirect URL** (wrong org name or wrong data center). ![](/_fern-files/_img/ef9b515cbd11d884f7e959049703b5b50f3cb037462c5049c16fe764ced42e19.webp) ![](/_fern-files/_img/abb739dc31174b7c8bda8376571dac48ddecb868f0555877880e035914b273a7.webp) ### 1.4: Set Up ServiceNow *Goal: Get a ServiceNow instance, add your user, and create the integration account Moveworks uses.* Complete [Lab #2: ServiceNow Setup](/ai-assistant/getting-started/labs/moveworks-setup/lab-2-servicenow-setup) in a separate browser tab before starting Lab #3. It uses the ServiceNow instance your ILT host provided. ### 1.5: \[OPTIONAL] Simplify the Okta Login You always need an Okta Verify code to open the Okta Admin Console, but these steps make your end-user Okta session last longer and stop prompting for Okta Verify. 1. In the Okta Admin Console, navigate to **Global Session Policy**. ![](/_fern-files/_img/dae29f264369f0e5d55b3ea25a49fa9d9e0bdde364d068a659ee01a3d1d72d1b.webp) 2. Edit the **Default Policy**. ![](/_fern-files/_img/82ede0e9d4503bb9e2e0e505cd86933c9007449977cd223459e8093750f33b84.webp) 3. Set **Establish the user session with** to **A password**. ![](/_fern-files/_img/c7f25666ed7c9e7cb776b183f69b79e10da88326cf7b21aafb8757214cc8f1e6.webp) 4. Set **Maximum Okta global session lifetime** and **Maximum Okta global session idle time** to the length you want. We recommend 2 days for each. ![](/_fern-files/_img/9b9d3c82fee2dae1e3af89817d8ec5289f62aa51fc030dab985056708c076a1f.webp) ### 1.6: \[OPTIONAL] Share a Moveworks Instance with a Lab Teammate *Complete these steps if a teammate shares your Moveworks instance.* **Step 1: Add your teammate in Okta** 1. In the Okta Admin Console, go to **Directory > People > Add Person**. 2. Enter your teammate's name and work email, then click **Save**. 3. Go to **Applications > Applications**, open the **Moveworks** app, and go to the **Assignments** tab. 4. Click **Assign > Assign to People** and assign your teammate. **Step 2: Add your teammate in ServiceNow** *(complete after Lab #2)* 1. In your ServiceNow instance, go to **User Administration > Users**. 2. Click **New** and enter your teammate's name and work email. 3. Set their **Department** to `IT`. 4. Click **Submit**. **Step 3: Grant your teammate admin access in Moveworks** *(complete after Lab #4)* > **Note** > > Your teammate must be ingested into the Moveworks user roster (Lab #4) before you can assign them roles. 1. In My Moveworks, click the **grid icon** in the upper right corner. 2. Select **Roles and Permissions**. 3. Find your teammate and assign them **all roles**. --- ## ✅ 2: Verification & Next Steps 1. **Check success:** * *If you set up Okta SSO (Sections 1.2 and 1.3):* In your Okta instance, click the Moveworks tile and confirm it opens Moveworks on Web. * *If you skipped Okta:* Use the temporary login link from your welcome email to confirm you can reach My Moveworks. Request a new link the next time you return. > **Success** > > **Next:** [Lab #2: ServiceNow Setup](/ai-assistant/getting-started/labs/moveworks-setup/lab-2-servicenow-setup) --- ## 🪞 3: Reflecting on This Configuration Through this lab, you've learned the following: * The difference between Moveworks **temporary access links** (one-time use) and **SSO access** (persistent, enterprise authentication) * How to connect an Identity Provider (IdP) to Moveworks using OIDC for Single Sign-On * Why **user assignments** in the IdP control who can reach the platform --- ## ⚙️ 4: Configuration Details Use the table below to fill in the required fields accurately. | **Field Name** | **Action / Value to Enter** | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Section 1.1:** | **Access Moveworks & Moveworks Setup** | | **Work Email** | The work email you used to register for this lab | | **Org Name** | `[moveworks-instance-name]` provisioned to you for this lab | | **Section 1.2:** | **Set Up the Okta Trial Environment & Moveworks Application** | | **Okta > Add Person** | Your name and the email address you used to register for this lab | | **Application** | Moveworks OIDC | | **Application Label** | `Moveworks` | | **Subdomain** | `[moveworks-instance-name]` provisioned to you for this lab | | **Data Center** | Prod3: `prod3.us.moveworks.com` / Standard: `moveworks.com` | | **Assignment** | Your user assigned to the application | | **Section 1.3:** | **Set Up My Moveworks Okta SSO** | | **Moveworks Product** | `Studio` | | **Connector** | `moveworks` | | **Authentication Protocol** | `OIDC` | | **IDP Redirect URL** | Prod3: `https://[moveworks-instance-name].prod3.us.moveworks.com/login/sso/oidc` / Standard: `https://[moveworks-instance-name].moveworks.com/login/sso/oidc` | | **IDP Issuer** | `https://trial-[your_number].okta.com` | | **IDP Client ID** | The Client ID from your Okta app (Section 1.2) | | **IDP Client Secret** | The Client Secret from your Okta app (Section 1.2) |