---
updatedAt: 2026-05-14T14:56:28.000Z
---

# Service Desk Application for ServiceNow

The IBM Verify Service Desk Application allows you to securely connect three endpoints:

* IBM Verify Governance
* IBM Verify SaaS
* IBM Identity Manager

In case of IBM Verify Governance, Service Desk application supports the following functionalities:

* Request access to applications (for self and others)
  * Built in approvals and separation of duties checks.
  * Automated and manual provisioning of accesses.
* Request password change
* Approve access requests
* Review status of access requests
* Request to add, remove, modify, suspend, restore accounts
* Perform access and role attestation

In case of IBM Verify SaaS, Service Desk application supports the following functionalities:

* Request access to applications (for self and others)
* Request password change: Can change password only for the cloud directory and not the target accounts
* Approve access requests
* Review status of access requests
* Entitlement Load
* My Certifications

In case of IBM Security Identity Manager (ISIM), Service Desk application supports the following functionalities:

* Request access to applications (for self and others)
* Request password change

# Before you begin

You must fulfil the following system requirements before proceeding:

* A working environment for required endpoint (IGI or IBM Verify or ISIM)
* A working environment with ServiceNow latest supported version\
  *Note: Refer documentation from ServiceNow app store for required versions information.*

# Configuration and Settings

See the [Installation and Configuration Guide](https://store.servicenow.com/sn_appstore_store.do#!/store/application/a0f6ab11db30030066e5fbefbf961962/2.9.0?referer=%2Fstore%2Fsearch%3Flistingtype%3Dallintegrations%25253Bancillary_app%25253Bcertified_apps%25253Bcontent%25253Bindustry_solution%25253Boem%25253Butility%25253Btemplate%25253Bgenerative_ai%25253Bsnow_solution%26q%3DIBM%2520security\&sl=sh) which is present on ServiceNow Store page.

## Download the App

*Note: The following pre-requisite is only applicable for ISIM as an endpoint.*

### Creating ISIM System user

1. Login to ServiceNow as the System Administrator.
2. Navigate to **User Administration > Users**  menu and select **New**.
3. In the **User ID** field, enter **ISIM System**.
4. Check the **Active** checkbox and click **Submit**.
5. Search the ISIM System User ID.
6. Set the Password for the ISIM System user as **Verify\@2023** user.
7. Under the **Roles** tab, select **Edit** and assign **script\_include\_admin** role. Then, click **Save**.

Modify sc\_request table permission to allow, create and update the request

1. Login to ServiceNow as the System Administrator.
2. Navigate to **Tables**. Search table by **Request** Label and **sc\_request** Name.
3. Click the table label.
4. Click the **Application Access**. Enable setting **Can create**, **Can update** and **Allow Configuration**.
5. Click **Update** button to save the modified settings.

Now, download and install the IBM Verify Service Desk App from the ServiceNow App Store.

### Post Installation Verification

*Note: The following pre-requisite is only applicable for ISIM as an endpoint.*

The following file must exist in the respective table:

Navigate to ServiceNow dashboard > Search sys\_script\_include.list. Script ISIMGetLtpa2Token record must exist.

If the script is not created automatically, then, admin user needs to run Fix Scripts.

Follow the provided steps to run Fix Scripts:

1. Navigate to ServiceNow dashboard > Search **Fix Scripts** > Search **createGlobalScriptForISIM** > Open the record > Click **Run Fix Script** button > Click **Procced**.

## Create IGI System User

*Note: The following procedure is only applicable for IGI as an endpoint.*

1. Login to ServiceNow as the System Administrator.
2. Navigate to **User Administration > Users**  menu and select **New**.
3. In the **User ID** field, enter **IGI System**.
4. Check the **Active** and **Web service access only** checkboxes and click **Submit**.
5. Enter the **Password** for the IGI System user and click **Submit**.
6. Under the **Roles** tab, select **Edit** and assign the following roles and then, click **Save**:
   * import\_admin
   * import\_scheduler
   * import\_set\_loader
   * import\_transformer
   * itil
   * web\_service\_admin
   * workflow\_publisher
   * x\_155935\_igi.access\_hierarchy\_user
   * x\_155935\_igi.access\_properties\_user
   * x\_155935\_igi.access\_property\_name\_mapping\_user
   * x\_155935\_igi.access\_user
   * x\_155935\_igi.admin

## Configure and Test SVG/IBM Verify/ISIM Connection

1. Log in as the ServiceNow System Administrator.
2. Access **System Settings** and select **Developer, Application: IBM Verify Service Desk App,** and Show application picker in header.
3. In the application picker, select IBM Verify Service Desk App and close the Settings window.
4. Search to open the Service Portal Home. In the opened screen, go to the top panel and **select IT Security Access Services.**
5. Select **Administration**. Enter the **SVG/ IBM Verify/ ISIM Connection details:**

*Note: Create an admin user on ISIM endpoint and assign all the privileges default admin user is having. Use this newly created admin for ISIM test connection.*

* **Endpoint**: Select IBM Verify Governance or IBM Verify or IBM Security Identity Manager option from the drop down.
* **Username/ Client Id**: Enter the SVG service username or IBM Verify client secret used in Basic Authentication (BA) header while calling IBM Verify Governance RESTAPIs or IBM Verify RESTAPIs, respectively. For ISIM, enter the ISIM user Id to generate the authentication token.
* **Password/ Client Secret**: Enter the SVG service account password or IBM Verify client secret provided in the Basic Authentication (BA) header when calling the IBM Verify Governance RESTAPIs or IBM Verify RESTAPIs, respectively. For ISIM, enter the ISIM user password to generate the authentication token.
* **Base URL**: Enter the base URL for IBM Verify Governance REST API (https\://<hostname>:<port>/igi/v2) or IBM Verify REST API (https\://\<hostname) or IBM Security Identity Manager REST API (https\://\<hostname).

6. Select **Save Settings** and then click **Test Connection**.

The following steps are only applicable for **IGI**:

7. When the test connection is completed successfully, set workflow name that is required for access request processing. It is mandatory to select workflow name created for service now app on SVG for access request.
8. Click the dropdown to select a workflow and then click **Save Workflow**. You can also search for workflow name in the search box.

*Note: Before upgrading the app, the Administrator must ensure that all the open access requests in the app are processed or closed.*

## Category for IBM Verify, SVG and ISIM Entitlements

Login to Service Now as System Administrator.
The IBM Verify, SVG and ISIM entitlements can be searched by the following categories in the **sc\_cat\_item.list** catalog items table.

* To find IBM Verify entitlements, search for **IT IBM Verify** in the **Category** column search box.
* To find SVG entitlements, search for **IT Security Access** in the **Category** column search box.
* To find ISIM entitlements, search for **IT Security Identity** in the **Category** column search box.

## Load IBM Verify and ISIM Entitlements

*Note: In the Load Entitlement page, entitlements can only be added and updated.*

1. If the selected endpoint is IBM Verify or ISIM, a new **Load Entitlement** tab is enabled in the **Administrative Settings** page.
2. To load IBM Verify or ISIM entitlements in ServiceNow, select the Load Entitlements tab. On left-hand side of the page, initially all IBM Verify Entitlements (Roles and Permissions) or ISIM Entitlements (Accesses) are listed. To add or update any entitlement from the list, click the entitlement and then click the **Add** icon. The entitlement is moved to the other side of the list, which includes all the entitlements that are to be loaded.
3. Click **Submit** to load the selected IBM Verify or ISIM entitlements in ServiceNow.
   * The entitlements can be searched from the list using different filters such as name, description, additional information, tags in case of ISIM and application name, entitlement name in case of IBM Verify.
   * For **ISIM**, enter the string in the **Search Entitlements** text box or select the category name from **Select Category** drop down to search entitlement based on category. For **IBM Verify**, enter the string in the **Search Entitlements** or **Search Application** text box. If multiple search values are provided, the tool searches all the entitlements that match the criteria.
   * Click **Search** to launch the search. Click the **Reset** button to clear the search boxes.\
     *Note: Search supports “is contains” match.*

## Update System Properties

1. Login to Service Now as System Administrator.
2. Access **System Properties** then **Categories**. In the **Search** drop down menu, select **Name** and enter **IT Security Access Services** in the text box.
3. Click **IT Security Access Services** from the list.
4. Click the **Show/Hide Filter** icon and add the condition **Display name contains**. Enter the property name and then press Enter. See the following table for the list of Property Names.
5. Select the property name. Enter the property value in the **Value** field and click **Update**.

| **Property Name**                          | **Description**                                                                                                                                                                                                                                     | **Value** |
| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| igi.sn.ui.deep.link.uri                    | The IBM Verify Governance deep link URI prefix is used in My Recertification (Applies if end point selected as SVG) it will redirect user from ServiceNow to IBM Verify Governance Server’s Dashboard. Example Value: https\://{svghostname}:{port} | String    |
| igi.sn.workflow\.requestor.igi.system.user | Username for the service account used by the SVG synchronizer Default = ‘IGI System’ user                                                                                                                                                           | String    |
| igi.sn.cryptojs.sharedsecret               | Shared secret for Crypto-js encryption/decryption                                                                                                                                                                                                   |           |

## Assign User roles

The following table lists the roles available and the functions that are available for each role. All users have access to Request Access for Me and View Your Requests when IGI is the Endpoint.

| **Role**                              | **Role Name**                           | **Available Functions**                                                                                                                                        |
| ------------------------------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Requestor                             | x\_155935\_igi.requestor                | <br> Request Access for Another User <br> Request Access for Multiple Users                                                                                    |
| Approver                              | x\_155935\_igi.approver                 | View your Approvals                                                                                                                                            |
| Supervisor                            | x\_155935\_igi.supervisor               | <br> My Recertifications (for SVG) <br> My Certifications (for IBM Verify)                                                                                     |
| Administrator                         | x\_155935\_igi.admin                    | <br> Request Access for Another User <br> Request Access forMultiple Users <br> View Your Approvals <br> My Passwords <br> Manage Accounts <br> Administration |
| My Passwords (for SVG and ISIM)       | x\_155935\_igi.my\_passwords\_access    | My Passwords                                                                                                                                                   |
| Manage Accounts (only for SVG)        | x\_155935\_igi.manage\_accounts\_access | Manage Accounts                                                                                                                                                |
| IBM Verify User (only for IBM Verify) | x\_155935\_igi.isv\_user                | To All Users to Access IBM Verify Request Flows                                                                                                                |
| ISIM User (Only for ISIM)             | x\_155935\_igi.isim\_user               | To all users to access Request Flows                                                                                                                           |
| Manual Approver (only for SVG)        | x\_155935\_igi.manual\_task\_approve    | Manual Fulfilment                                                                                                                                              |
|                                       |                                         |                                                                                                                                                                |

*Note: Manage Accounts related roles are not applicable in case of IBM Verify or ISIM endpoint. User having x\_155935\_igi.admin should have target specific roles to access Request Flows and Administration Setting functionality. This is applicable for ISIM or IBM Verify as an endpoint.*

To assign user roles(s):

1. Login as ServiceNow System Administrator.
2. Access **System Security, Users and Groups, Users**.
3. Search for the user to whom you wish to assign the roles.
4. Under the **Roles** tab, click **Edit**.
5. In the search box, enter **x\_** to view the IBM Verify Service Desk App roles. See the table for a list of the role names.
6. Highlight the role(s) to assign to the user and click the **right-arrow** icon (Shift-click to select multiple accesses). Use the **left-arrow** icon to remove roles(s). Click **Save**.

*Note: If the user is an Approver, assign the following additional roles:*

* *Catalog*
* *Itil*
* *Approver\_user*

*Note: If the user is a Requestor or user is requesting for himself when two level approval flow is set, assign the following additional roles:*

* *itil*

*Note: If the user is an IBM Verify user, assig the following role:*

* *x\_155935\_igi.isv\_user*

*Note: If the user is an ISIM user, assig the following role:*

* *x\_155935\_igi.isim\_user*

## Set Approvers

There are two ways to set up the approvers:

* Approver for all access or account request catalog items.
* Approver for per individual catalog item.

*Note: See Assign user roles section for additional roles required for Approvers.*

### Approver for All Catalog Items

To set up an approver for all access or account request catalog items:

1. Login as ServiceNow System Administrator.
2. Access **System Properties** and then **Categories**.
3. In the **Go to** drop down menu, select **Name** and enter **IT Security Access Services** in the search box.
4. Click **IT Security Access Services** from the list.
5. Click the **Show/Hide Filter** icon and add the condition **Display name contains**. Enter the property name and press the Enter key.
   *Approver for access requests: x\_155935\_igi.igi.sn.workflow\.default.access.request.approver
   Approver for account: x\_155935\_igi.sn.workflow\.default.account.request.approver*
6. Enter the **User ID** or **Group** that approves the requests in the **Value** field and then click **Update**. Use comma (,) to separate multiple User IDs or Groups.

### Approver Per Catalog Item

To set up an approver based on the requested catalog item:

1. Login as ServiceNow System Administrator
2. Access **Service Catalog, Catalog Definitions** and **Maintain Catalogs**.
3. Select **IT Security Access Catalog**.
4. Under the **Catalog Items** tab, select the catalog item for which you are setting the approver.
5. From the **Additional Actions** drop down menu, select **Configure** and then **Related Lists**.
6. Click the **Edit this View** in Global option.
7. From the **Available** box, select **Approved By**. Click the **right-arrow** icon and then **Save**.
8. Select the **Approved By** tab and then **Edit**.
9. Highlight the role(s) to assign to the user and click the **right-arrow** icon (Shift-click to select multiple accesses). Use the **left-arrow** icon to remove roles(s). Click **Save**.

## Enable Entitlement owner as an Approver

The entitlement owner value is pushed into ServiceNow from SVG by SVG-ServiceNow synchronizer and from IBM Verify or ISIM by load-entitlement panel or on request creation.\
Follow the provided steps to enable entitlement owner as an approver for that catalog item:

1. Login as ServiceNow System Administrator.
2. Access **System Properties** and then **Categories.**
3. In the **Go to** drop down menu, select **Name** and enter **IT Security Access Services** in the search box.
4. Click **IT Security Access Services** from the list.
5. Click the **Show/Hide Filter** icon and add the condition **Display name contains**. Enter the property name and press the Enter key.\
   *x\_155935\_igi.igi.sn.workflow\.ent.owner.approver*
6. Enter true in the **Value** field and click **Update**.

## Configure Approval flow

The approval flow, applicable to SVG, IBM Verify and ISIM endpoints, can be configured in the following two ways:

* Single-level approval
* Two-level approval

*Note: Two-level approval is not applicable for ISIM endpoint.*

### Configure Single level Approver

In the Single level approval flow, there are three possibilities for setting the approver.

* The Approver per catalog item set by the admin holds the highest preferences. If it exists, the request is sent to that user for approval. See **Set Approvers > Approver Per Catalog Item** section for details.
* If the catalog item approver is not set by the admin, the request is sent to the entitlement owner, only if the entitlement owner is enabled as approver in ServiceNow. See **Enable Entitlement owner as an Approver  section for details.**
* If none of the two previous cases apply, the request is forwarded to the default approver(s)/group(s) from the property set by the admin for All catalog items. See **Set Approvers > Approver for all Catalog Items**  section for details.

### Configure Two-level Approver

To enable a Two-level Approver, set **x\_155935\_igi.igi.sn.workflow\.multi.level.approver** property to true.\
To set the property, see steps 1 to 4 in **Set Approvers** section. Then, in step 5 select **x\_155935\_igi.igi.sn.workflow\.multi.level.approver** and set it to true.

The Two-level approval process requires two approval requests.

1. The first level request goes to the manager of the user (Beneficiary/Requestee) for approval. The manager-reporter relationship must be defined on the ServiceNow side.If the user's manager is not defined or is deactivated, the request is sent to the default All catalog items approver(s)/group(s) from the property set by admin.
   *Note: See **Set Approvers > Approver for all Catalog Items** section for details.*
2. The second level request goes to the catalog-item approver set by the admin in ServiceNow, where a catalog item-approver relationship exists.
   *Note: See **Set Approvers > Approver Per Catalog Item** section for details.*
   * If the catalog item approver is not set by the admin, the request goes to the entitlement owner, if the 'Entitlement owner as approver' property is enabled in ServiceNow.
     *Note: See **Enable Entitlement owner as an Approver**  section for details.*
   * If none of the two previous cases apply, the request is forwarded to the default approver(s)/group(s) from the property set by the admin for All catalog item.
     *Note: See **Set Approvers > Approver for all Catalog Items** section for detail.*
3. If no first level and second level approvers are available and the request is sent to the default approver, the request goes for just one approval step and follows the single-level approver flow, with default approver (Approver for all catalog items) as an approver.