Skip to navigation
Getting StartedLabsPartner Demo Guide

1. System Setup

View as Markdown

Overview

  • Objectives: Access Moveworks Setup, optionally configure Okta SSO, validate and prepare a partner-provided ServiceNow instance, capture the ServiceNow integration-account details, and install the update sets required by later sections.
  • Estimated Time: About 30 minutes without Okta SSO, or 75–90 minutes with SSO.
  • Prerequisites:
    • Work email address
    • Moveworks tenant URL and org name
    • A ServiceNow instance running Zurich Patch 10 or a later Zurich patch, or Australia Patch 3 or a later release
    • ServiceNow administrator access
    • Okta Verify on a mobile device if you choose to configure Okta SSO

Partner demo difference: You provide the ServiceNow instance used by this guide. The Partner Demo Guide does not provision an instance. Administrator access is required to retrieve configuration data, install update sets, assign roles, and prepare the integration account.

Use two monitors if available, keep Moveworks Setup, ServiceNow, and Okta in separate tabs, and save the values collected in this section in a password manager, notes document, or spreadsheet.

🛠️ 1: Walkthrough

1.1: Access Moveworks and Moveworks Setup

  1. Check your email for a message from noreply@moveworks.ai with the subject [Moveworks] Welcome to MyMoveworks. Save the org name and the welcome URL for your tenant.

    Use the Visit URL to identify the data center. A URL containing prod3.us.moveworks.com is on the prod3 data center. A URL containing my.moveworks.com is on the standard data center.

  2. Click Visit, enter your Work Email and Org Name, then click Send Login Link.

  3. Check your email for a temporary access link and open it.

    Temporary access links are valid for 15 minutes. If you need another link, use my.moveworks.com/welcome or my.prod3.us.moveworks.com/welcome, based on your data center.

  4. In the Assistant, say Hi, then click Manage apps in the lower-left corner.

  5. On the My Moveworks product page, select Moveworks Setup.

  6. Confirm that the Moveworks Setup overview page loads.

1.2: Optional — Configure Okta SSO

Okta is optional

If you are a Moveworks super admin, you do not need to configure Okta. You can return to your instance using the Visit link in your [Moveworks] Welcome to MyMoveworks email.

The trial Okta setup is included only to give you hands-on experience connecting your own identity provider for SSO. An Okta trial expires after 30 days, so do not rely on the trial as your long-term access method.

Complete this optional subsection only if you want to practice configuring SSO. Otherwise, skip to 1.3: Validate and Prepare Your ServiceNow Instance.

Create the Okta trial and Moveworks application

  1. Go to the Okta Workforce Identity free trial and register with your business email address.

  2. Choose Workforce Identity Cloud if prompted. A personalized tour is not required.

  3. If Okta displays a multi-screen onboarding flow, select any values and continue. The selections do not affect this demo.

  4. Activate the trial from your email, configure a password and Okta Verify, and save the tenant URL. It should resemble https://trial-#######.okta.com.

  5. Open the Admin Console.

  6. Navigate to Directory > People > Add Person and create your user if it is not already listed.

  7. Navigate to Applications > Applications > Browse App Integration Catalog, search for Moveworks, and select Moveworks OIDC.

  8. Configure the application:

    • Application Label: Moveworks
    • Subdomain: Your Moveworks org name
    • Data Center: prod3.us.moveworks.com for prod3, or moveworks.com for the standard data center

  9. On the Assignments tab, select Assign > Assign to People and assign your user.

  10. On the Sign On tab, save the Client ID and Client Secret.

Connect Okta to Moveworks

  1. In Moveworks Setup, search for SSO and navigate to Organizational Details > Tenant Settings > Single Sign-On (SSO). Click Create.

  2. Enter:

    • Moveworks Product: Studio
    • Select Connector: okta or moveworks, whichever is available in the tenant
    • Authentication Protocol: OIDC
    • IDP Redirect URL:
      • Prod3: https://[org-name].prod3.us.moveworks.com/login/sso/oidc
      • Standard: https://[org-name].moveworks.com/login/sso/oidc
    • IDP Issuer: Your Okta tenant URL, such as https://trial-[number].okta.com
    • IDP Client ID and Secret: The values saved from Okta

    Do not append -admin to the Okta issuer URL. The issuer must end in .okta.com.

  3. Click Submit and enter a clear change summary.

  4. Open Configuration Logs in Moveworks Setup and confirm that the SSO configuration was saved with your change summary.

    Configuration Logs showing the saved Okta SSO change

  5. Open the Moveworks tile in Okta and confirm that it signs you in.

1.3: Validate and Prepare Your ServiceNow Instance

ServiceNow release requirement for Employee Slate: Your instance must run Zurich Patch 10 or a later Zurich patch, or Australia Patch 3 or a later release. In ServiceNow, open stats.do to check the installed release and patch level.

Administrator access is required. You need sufficient ServiceNow access to install update sets, create or update users, assign roles, inspect records, and retrieve the identifiers and source data used in later sections.

Confirm the instance and access

  1. Sign in to the ServiceNow instance you will use for the demo.
  2. Open stats.do and confirm that the release meets the requirement above.
  3. Confirm that your ServiceNow account has administrator access.
  4. Save the instance base URL. You will enter it when creating the snow connector in Section 2.

Prepare the demo user and integration account

  1. Navigate to User Administration > Users.

    User Administration menu showing the Users option in ServiceNow

  2. Confirm that a personal demo user exists with your work email address. If it does not, click New and create it.

    The email addresses must match. The personal demo user’s work email address must be the same email address you use to access the Moveworks instance through the magic link.

    New User form in ServiceNow with personal-user fields populated

  3. Identify or create the dedicated ServiceNow account that Moveworks will use for the integration.

    Use a dedicated integration or service account instead of your personal administrator account. Follow the ServiceNow Access Requirements when assigning permissions.

  4. Open the integration account and set Time zone to GMT, then save the record. This prevents time-related differences in later exercises.

    The screenshot shows the admin account as an example. Apply the same Time zone setting to the dedicated integration account used by this guide.

    ServiceNow account record with Time zone set to GMT

  5. Save the integration account’s username, email address, password, and 32-character sys_id.

  6. Copy the integration account’s sys_id using either method:

    • Open the account record, select the form menu, then select Copy sys_id.

      ServiceNow form menu showing Copy sys_id

    • Right-click the form header and select Copy sys_id.

      ServiceNow form-header menu showing Copy sys_id

    Copy the sys_id for the dedicated integration account, not the personal demo user. The value is a 32-character hexadecimal string.

Store the instance URL and integration-account credentials securely. Sections 2 and 3 use these values to configure the connector and Moveworks service account.

1.4: Install the Moveworks Update Sets

Install the Base and ACL update sets now so the ServiceNow instance is ready for Enterprise Search in Section 4.

  1. Download the XML files from ServiceNow Update Sets.

  2. In ServiceNow, navigate to Retrieved Update Sets.

  3. Click Import Update Sets from XML.

  4. Upload each update-set XML file.

  5. Preview and commit moveworks.base first, then preview and commit moveworks.acl.

    Commit moveworks.base before any dependent update set. Committing the update sets out of order causes errors.

  6. Confirm that both required update sets have a Committed state.

  7. Navigate to Organization > Users and open the dedicated ServiceNow integration account.

    The following screenshot shows the admin account as an example. Open the dedicated integration account instead.

  8. Assign the moveworks_user role and save the record.

The Base and ACL update sets are sufficient through Enterprise Search. Later demo sections may require additional update sets; follow the prerequisites in those sections.

✅ 2: Verification & Next Steps

Before continuing, confirm:

  • You can open Moveworks Setup.
  • If configured, the Moveworks tile in Okta signs you in successfully.
  • The ServiceNow instance meets the Employee Slate release requirement.
  • Your ServiceNow administrator access is confirmed.
  • The ServiceNow instance URL and dedicated integration-account credentials are saved securely.
  • Your personal user exists in ServiceNow with the same work email address used for the Moveworks magic link.
  • The integration account’s Time zone is set to GMT.
  • The integration account’s email address, username, and sys_id are saved.
  • moveworks.base and moveworks.acl are committed.
  • The integration account has the moveworks_user role.

Next: Section 2 — Connectors & API Playground

❗ 3: Troubleshooting

The Okta tile does not sign me in.

Confirm the Moveworks subdomain, data center, redirect URL, and issuer URL. The issuer must not contain -admin.

The ServiceNow release does not meet the Employee Slate requirement.

Use an instance running Zurich Patch 10 or a later Zurich patch, or Australia Patch 3 or a later release. Coordinate the upgrade or request a different instance from the team that owns the ServiceNow environment.

I do not have ServiceNow administrator access.

Ask the ServiceNow owner to grant the required access or assign an administrator who can complete the instance-side steps and provide the required identifiers and configuration data.

An update set fails during preview or commit.

Confirm that moveworks.base was committed before moveworks.acl.

🪞 4: Reflecting on This Configuration

Through this guide, you’ve learned:

  • How temporary Moveworks access differs from optional persistent Okta SSO.
  • How to validate and prepare a partner-provided ServiceNow instance.
  • Why the ServiceNow release level and administrator access are blocking prerequisites for Employee Slate.
  • Why a personal test user and a service account are separate identities.
  • Why the personal demo user’s email address must match the email address used for the Moveworks magic link.
  • How to capture the ServiceNow sys_id used by later configuration.
  • How the Moveworks update sets and moveworks_user role prepare ServiceNow for knowledge ingestion.

⚙️ 5: Configuration Details

Save these values for the remaining sections.

VariableValue
Moveworks org name_____________________
Moveworks data centerStandard / Prod3
Okta tenant URL (optional)_____________________
Okta Client ID and Secret (optional)Stored securely
ServiceNow instance URL_____________________
ServiceNow release and patchZurich Patch 10+ or Australia Patch 3+
Administrator accessConfirmed
Integration-account username_____________________
Integration-account passwordStored securely
Integration-account email_____________________
Integration-account sys_id_____________________
Integration-account time zoneGMT
Personal userCreated with the email address used for the Moveworks magic link
Required update setsmoveworks.base and moveworks.acl committed
Service account rolemoveworks_user