> This page is for Assistant Platform.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.moveworks.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moveworks.com/_mcp/server.

# Lab #2: ServiceNow Setup

> **Info**
>
> ## Overview
>
> * **Learning Objectives:** Get into your ServiceNow lab instance, add your personal user, create the integration account Moveworks uses to connect to ServiceNow, and capture that account's `sys_id` for Lab #4.
> * **Estimated Time:** 20 minutes
> * **Prerequisites:**
>   * [Lab #1: Moveworks Access and SSO](/ai-assistant/getting-started/labs/moveworks-setup/lab-1-moveworks-access-sso) complete (Moveworks portal access)
>   * A ServiceNow instance URL and admin credentials from your ILT host

> **Note**
>
> **Open ServiceNow in a new browser tab** so you can switch between ServiceNow and Moveworks Setup without losing your session in either.

---

## 🛠️ 1: Walkthrough

### 1.1: Sign In to Your ServiceNow Instance

*Goal: Log in to a ServiceNow instance as `admin`.*

1. Open the instance URL from your ILT host (`https://[your-instance].service-now.com`).
2. Sign in with the admin username and password your host provided.

### 1.2: Add Your Personal User

*Goal: Create a user record that represents you, separate from the `admin` account.*

1. Go to **User Administration > Users**. You can find it by searching for **Users** in the All menu filter.

   ![User Administration menu showing the Users option in ServiceNow](/_fern-files/_img/51d9cec66b6f6c60d8744d806e771562d637b8344ab3f1a91f4f0adcabf69c84.webp)

2. Click **New** and add a user with your work email address.

3. Set **Department** to `IT`, then click **Submit**.

   ![New User form in ServiceNow with the User ID, email, and name fields populated](/_fern-files/_img/2397324d5731dc919bdb5f05645f645ca56d2b63065456d91db100fc2dbe328c.webp)

> **Tip**
>
> **Sharing this instance with teammates?** Repeat this section for every teammate assigned to the same lab environment.

### 1.3: Create the Integration Account

*Goal: Create the account Moveworks uses to call ServiceNow.*

Moveworks authenticates to ServiceNow as a single **integration account**. The labs call it `machine_admin`. Lab #3 uses its credentials for the connector, and Lab #4 uses its email and `sys_id` for the Bot Account.

> **Note**
>
> **Why not use `admin`?** ServiceNow can require multi-factor authentication for interactive accounts like `admin`, which blocks the basic authentication the connector uses. A machine identity account isn't subject to that prompt.

1. In **User Administration > Users**, click **New** and create a user with:

   * **User ID:** `machine_admin`
   * **Email:** any address you control or a placeholder such as `machine_admin@example.com`. Lab #4 needs this value, so don't leave it blank.
   * **Time zone:** `GMT`, so that later labs behave consistently

   ![machine\_admin user record with Time zone set to GMT and the Set Password button highlighted](/_fern-files/_img/fc717b11c186daae458c7f94a77192e6e7e1ff9ef4cf63b8ea7ec49f87041533.webp)

2. Click **Submit**, reopen the record, click **Set Password**, and copy the generated password.

3. Open an incognito window (`Cmd+Shift+N` in Chrome), log in to your instance as `machine_admin`, and set a new password when prompted. Save the new password in your notes; Lab #3 uses it for the connector. Follow the prompts to register a device for multi-factor authentication.

4. Back in your admin session, open the `machine_admin` record, set **Identity type** to **Machine**, and click **Update**.

   ![machine\_admin user record with Identity type set to Machine and the Update button highlighted](/_fern-files/_img/b0c505a41dab95727fc80bf2f89ccafccf6dcd8dda797db933da40e51c36d1f1.webp)

   > **Note**
   >
   > Once **Identity type** is **Machine**, `machine_admin` can no longer sign in to the ServiceNow UI. Attempting to returns "Only interactive users are allowed to access UI." This is expected: the account is now for integration use only.

   ![ServiceNow login page in an incognito window showing the "Only interactive users are allowed to access UI" message](/_fern-files/_img/7c6dcd70631716a4bedb079be3ca098fdb7fdc40801e2184269fd03c391632bf.webp)

5. Reopen the `machine_admin` record. On the **Roles** tab, click **Edit** and add `admin`, `security_admin`, `snc_required_script_writer_permission`, and `snc_basic_auth_api_access`. Hold **Cmd** (or **Ctrl**) to select several roles at once.

   `snc_basic_auth_api_access` lets the account authenticate REST API calls with basic authentication. Without it, the Lab #3 connector test fails even with the right password.

> **Note**
>
> For the full list of service account requirements, see [ServiceNow Access Requirements](https://docs.moveworks.com/service-management/access-requirements/ticketing-systems-and-itsms/servicenow-access-requirements).

### 1.4: Copy the Integration Account `sys_id`

*Goal: Capture the identifier you'll enter in Lab #4.*

Lab #4 needs the `machine_admin` account's 32-character `sys_id` to identify the account Moveworks acts as. With the `machine_admin` record open, copy it using any of these options:

> **Warning**
>
> **Copy the `sys_id` for `machine_admin`, not your personal user.**

**Option A: Hamburger menu.** Click the hamburger menu (three lines, top-left of the form), then **Copy sys_id**.

![Hamburger menu on the user record showing the Copy sys\_id option](/_fern-files/_img/7435c171f3d7c029f71377cac4229b1888bf2efa7c8a687a3cceb1b50ebe2613.webp)

**Option B: Right-click the form header.** Right-click the gray header bar of the form, then **Copy sys_id**.

![Right-click context menu on the record form header showing Copy sys\_id](/_fern-files/_img/98a962d633264eb2724324fda468317bb105ffaa36e69e1a4351c2de4184d6bb.webp)

**Option C: Copy it from the URL.** With the record open, the URL contains the `sys_id`:

```
https://{instance}.service-now.com/now/nav/ui/classic/params/target/sys_user.do%3Fsys_id%3D{sys_id}
```

> **Error**
>
> **Do not include the `3D` prefix.** `%3D` is a URL-encoded equals sign, not part of the `sys_id`. The `sys_id` is the 32-character hex string that starts immediately after `%3D`: `ed65ebcf8372e690cbcdc396feaad380`, not `3Ded65ebcf8372e690cbcdc396feaad380`.

---

## ✅ 2: Verification & Next Steps

You should now have, saved in your notes:

* Your ServiceNow instance URL and `admin` credentials
* Your personal user in ServiceNow with your work email and **Department** = `IT`
* The `machine_admin` integration account's user ID, password, email, and 32-character `sys_id`

> **Success**
>
> **Next:** [Lab #3: Connectors & API Playground](/ai-assistant/getting-started/labs/moveworks-setup/lab-3-connectors-api-playground)

---

## ❗ 3: Troubleshooting

**I can't sign in to my instance.**
Confirm the instance URL and admin credentials with your ILT host.

**The Copy sys_id option doesn't appear.**
Use Option B or Option C. The hamburger menu option varies by ServiceNow UI version.

---

## 🪞 4: Reflecting on This Configuration

Through this lab, you've learned the following:

* ServiceNow distinguishes between **integration accounts** used for system-to-system calls and **personal user accounts** that represent real employees. The Moveworks integration needs both.
* A **machine** identity type keeps the integration account out of interactive sign-in, so multi-factor authentication prompts don't block the connector.
* The `sys_id` is ServiceNow's 32-character record identifier. It appears in URLs, REST API calls, and scripts as the canonical way to reference any record, including users.

---

## ⚙️ 5: Configuration Details

Save these values to your notes. Later labs reference them.

| **Field Name**                        | **Action / Value to Enter**                                                                     |
| ------------------------------------- | ----------------------------------------------------------------------------------------------- |
| **Instance URL**                      | `https://[your-instance].service-now.com`                                                       |
| **Personal User**                     | Your name and work email, **Department** = `IT`                                                 |
| **Integration Account User ID**       | `machine_admin`                                                                                 |
| **Integration Account Email**         | The email you set on `machine_admin`                                                            |
| **Integration Account Time Zone**     | `GMT`                                                                                           |
| **Integration Account Identity Type** | Machine                                                                                         |
| **Integration Account Roles**         | `admin`, `security_admin`, `snc_required_script_writer_permission`, `snc_basic_auth_api_access` |
| **Integration Account `sys_id`**      | 32-character value from Section 1.4                                                             |