ServiceNow Licensing OAuth2

note

ServiceNow has updated its Subscription Management with the Washington DC release. This update involves changes to tables related to subscription data, subscribed users, and subscription applications. The updated tables include: subscription_detail, subscription_entitlement, user_has_subscription, and subscription_has_family.

ServiceNow Licensing OAuth2 manages how your ServiceNow subscriptions are used on your instances. ServiceNow provides cloud-based services such as Software as a Service (SaaS) and Platform as a Service (PaaS) that automate enterprise IT operations.

The following sections explain prerequisites, resources, and instructions for integrating with SaaS Management.

info

This ServiceNow integration requires the authentication method OAuth2 with password grant type.

Stored ServiceNow Licensing OAuth2 Information

The following table describes the available integration tasks and stored data within SaaS Management.

Available Integration Tasks	Information Stored
Application Access	User Name Email Last Login
Application Roster	Username Email First Name Middle Name Last Name Account Create Date Licenses Role Types OOB Roles Custom Roles Web Service User The ServiceNow access control restricts the retrieval of the security_admin role assignment. The following Application Roster fields are available only in the extensible Power BI report. To access this Power BI report, see the ServiceNow Power BI Reporting for Flexera One’s SaaS Management Knowledge Base article. Group Name Active Group Roles Group Manager Group Description Custom Fields Unknown Roles
License Differentiation	See the ServiceNow Licensing OAuth2 Subscriptions and Tracking Application Activity by License Type for License Differentiation.
License Information	Unique ID SKU Number Subscription Name Subscription Type Provisioned Measured Role Types Subscription Applications Effective Date Expiration Date License details of users are not tracked for the following Subscription (License) types: Capacity—The consumed and remaining quantity for the Capacity type license is displayed in the Assigned and Remaining columns on the ServiceNow Overview tab in the Licenses table. Unlimited—For an Unlimited subscription, any user in the sys_user table that has a user ID and has the Active field set to true is assigned to this subscription. Ideally, it would be all the active users in the ServiceNow account. Unrestricted User—For an Unrestricted User subscription, any user in the sys_user table that has a user ID and has the Active field set to true is assigned to this subscription. Ideally, it would be all the active users in the ServiceNow account.
Product Consumption	Unique ID Subscription Name Consumed As per the current behavior, if the unique ID of an existing license is updated by the vendor, the existing license expires, and its name updates with the text expired . Customers can deselect the expired license from the Licenses tab. However, in the Consumption tab, both the expired license (from the previous capture) and any newly captured licenses continue to display.
Reclamation	After the reclamation task is executed for the selected users: The entire account and licenses associated with that user will be deleted The user will no longer have access to ServiceNow OAuth2. For more information, see Reclaiming SaaS Licenses.
Setup	Release Sandbox Instances Application Name Custom Application Name Role Type ( None is displayed for roles without a role type.) Role Names The following Setup fields are available only in the extensible Power BI report. To access this Power BI report, see the ServiceNow Power BI Reporting for Flexera One’s SaaS Management Knowledge Base article. Group Name Group Roles Group Manager Application Name Application Roles display OOB Roles , Custom Roles , and Unknown Roles . Custom Application Roles display OOB Roles , Custom Roles , and Unknown Roles . Application ID Custom Application ID
Sub Application Accesses	Unique ID Product ID Period (monthly time frame) Access Count Insert Count Insert Other’s Request Count Insert Own Request Count Update Count Update Other’s Request Count Update Own Request Count Delete Count Delete Other’s Request Count Delete Own Request Count Fulfillment Count Producer Count

note

The information stored is subject to change as enhancements are made to the SaaS application.

Minimum Permissions Required for ServiceNow Licensing OAuth2

The minimum API required permissions are based on the following ServiceNow Licensing OAuth2 user roles.

note

The following SaaS application user roles are not applicable to Flexera One roles.

User Role	Description	Integration Task Name
admin, snc_read_only	These roles are required for retrieving the ServiceNow users, licenses, and their activities. For more information, see ServiceNow’s documentation topics: Base System Roles Read-Only Role.	Application Access Application Roster License Information Product Consumption Setup Sub Application Accesses
admin	This role is required to: Retrieve the ServiceNow users, licenses, and their activities Manage user licenses for the License Information task Register the Client Application Generate the Client ID and Client Secret in ServiceNow. For more information, see ServiceNow’s documentation topic, Base System Roles.	Application Access Application Roster License Information Product Consumption Reclamation Setup Sub Application Accesses

Authentication Method for ServiceNow Licensing OAuth2

The required authentication method is OAuth 2.0 With Password Grant Type. For more information, see ServiceNow’s documentation topic, OAuth API Request Parameters.

Required Credentials for ServiceNow Licensing OAuth2

The following credentials are required:

• Instance Domain

• Username

• Password

• Client ID

• Client Secret.

Optional Credentials for ServiceNow Licensing OAuth2

Custom Fields are optional.

ServiceNow Licensing OAuth2 Subscriptions

ServiceNow subscriptions assigned to users are displayed in the Users tab and the Activity tab. A ServiceNow subscription could be among the following types, which are displayed under the Subscription Type column of the Licenses tab.

ServiceNow Licensing OAuth2 Subscription Types Displayed in SaaS Management	Description
Per User	Your organization purchases a subscription for the number of fulfiller users for subscription applications and capabilities. Your instance can monitor and report usage by both subscribed users and users who are not subscribed.
Unrestricted User	Previously referred to as a Max User . Your organization purchases an anticipated maximum number of unrestricted-user licenses. Unrestricted user licenses have no restrictions on role assignment. Your ServiceNow instance auto-allocates active users from the sys_user table to the unrestricted-user licenses.
Capacity	Your ServiceNow instance auto-allocates resources such as users, devices, software, or nodes to Capacity subscriptions. For example, resources such as each CI that Discovery finds, or each password reset request.
Unlimited User	Your organization purchases a subscription for the number of fulfiller users for subscription applications and capabilities. Your instance can monitor and report usage by both subscribed users and users who are not subscribed.
PA-Indicator	Your organization purchases a subscription for an application family that uses Performance Analytics (PA) capabilities (for example, PA for ITSM or PA for Service Management). The PA admin creates indicators on tables that are used by the applications. Since there is no documentation found on PA-Indicator, Display, and Other subscriptions, Flexera pulls all the ServiceNow subscription types. For more subscription information, see ServiceNow’s documentation topic, Types of subscriptions.

Integrating ServiceNow Licensing OAuth2 With SaaS Management

Complete the following steps to integrate ServiceNow Licensing OAuth2 with SaaS Management.

1. Sign in to your ServiceNow instance using Administrator credentials.

2. From the Instance URL, note the ServiceNow Instance Domain. You will need this value to integrate ServiceNow Licensing OAuth2 with SaaS Management.

   For example, if the Instance URL is https://dev70003.service-now.com, then the Instance Domain is dev70003.

   info

   If you enter the ServiceNow Instance URL rather than the ServiceNow Instance Domain in the SaaS Management Instance Domain field, the integration will fail.

3. In the filter navigator search box on the left-hand side, enter Application Registry and click Application Registry in the search results to select it. The Application Registry page opens.

4. Click the New button and select Create an OAuth API endpoint for external clients.

5. Perform the following:

   1. Enter a Name.
   2. Note the Client ID. You will need the Client ID value to integrate ServiceNow Licensing OAuth2 with SaaS Management.
   3. Change the Access Token Lifespan value to 14,400.

6. Manually enter a Client Secret value, or you can generate it by clicking the Submit button. If you generated the Client Secret by clicking the Submit button, navigate to the Application Registry. Click Record which you created and click the Lock icon to reveal the Client Secret value. You will need the Client Secret value to integrate ServiceNow Licensing OAuth2 with SaaS Management.

7. In SaaS Management, add the ServiceNow Licensing OAuth2 application. For more information, see Adding an Application.

8. Copy and paste the following ServiceNow Licensing OAuth2 values into SaaS Management.

   • Instance Domain

   • Client ID

   • Client Secret

9. Enter the Username and Password of the ServiceNow user with privileges as outlined in the Minimum Permissions Required for ServiceNow Licensing OAuth2.

   Results:

   • In the ServiceNow Licensing OAuth2 Users tab, the ServiceNow Licensing OAuth2 Subscriptions appear in the Licenses column.

   • In the ServiceNow Licensing OAuth2 Activity tab, the ServiceNow Licensing OAuth2 Subscriptions appear in the License Type column.

10. As an option, enter the appropriate Custom Fields to fetch for user records. Begin each entry with u_ and separate multiple custom fields with commas.

    Example: u_test1,u_test2

    The following table lists the data types that are supported for custom fields.

    Data Types That Are Supported for Custom ServiceNow Fields in SaaS Management
    Currency	Integer	Price
    Date	Long	String
    Date/Time	Percent Complete	Table Name
    Decimal

11. Click Authorize.

    For further information on managing and optimizing your organization’s ServiceNow Licensing OAuth2 licenses, see the following topics.

    • Editing User Roles to Access Out-of-the-Box ServiceNow Subscription Apps

    • Editing User Roles to Access the ServiceNow Application Module

    • Auto-Populated License Information for ServiceNow Licensing OAuth2

    • Managing Available Licenses for ServiceNow Licensing OAuth2

    • Microsoft Power BI Reporting for ServiceNow Licensing OAuth2

    • Tracking Application Activity by License Type for License Differentiation

    • Reclaiming SaaS Licenses

Editing User Roles to Access Out-of-the-Box ServiceNow Subscription Apps

Users not assigned the subscription roles associated with an Out-of-the-Box (OOTB) subscription app can access these apps by having their roles edited in ServiceNow.

To edit user roles in ServiceNow for users to access OOTB subscription apps:

1. Go to the Navbar, enter sys_app_application.list, and then click Enter. The Application Menus page opens.
2. To open the appropriate Application Menu Record, click the link in the Title column.
3. Inside the Application Menu Record, go to Roles and click Edit to add or update the user role. All users assigned the added role can view and access the OOTB ServiceNow application in the Navbar.

Editing User Roles to Access the ServiceNow Application Module

The following steps explain how to edit user roles in ServiceNow so that users can access the application Module.

To edit user roles in ServiceNow for users to access the application Module:

1. Go to the Navbar, enter sys_app_module.list, and then click Enter. The Modules table opens.
2. To open the appropriate Module Record, click the link in the Title column.
3. Inside the Module Record, go to Roles and click Edit to add or update the user role. All users assigned the added role can view and access the application Module.

Auto-Populated License Information for ServiceNow Licensing OAuth2

The SaaS Management integration with ServiceNow Licensing OAuth2 offers a License Information integration task that automatically retrieves every 24 hours the following information for the SaaS Management Licenses tab:

• License Type

• Name (of the ServiceNow subscription application)

• Provisioned

• Effective Date

• Effective Date

• Subscription Type

• SKU Number

• Measured Role Types

This auto-populated ServiceNow Licensing OAuth2 license information provides a more complete view of your ServiceNow SaaS entitlements and component usage by displaying:

• Assigned entitlements

• User’s license activity (based on the user’s last sign in and application usage).

info

If you enable the License Information integration task, note the following:

• If you have manually managed ServiceNow Licensing OAuth2 application licenses data in SaaS Management prior to enabling the License Information Integration task, then the managed application's license information you previously entered in the Licenses Tab will be overwritten with the data ingested from ServiceNow.

• You need to enter and keep up to date the following Licenses Tab information. The License Information integration task does not pull in this information. The SaaS application’s annual spend calculation relies on entered and accurate license effective and expiration dates.

  • Cost
  • Currency
  • Payment Frequency

• If the start and end dates are not available for an active ServiceNow subscription, the discovery date becomes the Effective Date and an empty Expiration Date is displayed in the Licenses Tab. As a result, the license term is effective and will not expire.

To auto-populate ServiceNow Licensing OAuth2 license information, see Auto-Populated Managed SaaS Application License Information. When the License Information integration task is enabled, the following fields in the Licenses tab are disabled as this information is automatically populated:

• License Type

• Name

• Provisioned

• Subscription Type

• SKU Number

• Measured Role Types

The active and inactive ingested license data from ServiceNow can be compared against the Subscriptions data from the Subscription Overview dashboard of the Subscription Management application in ServiceNow.

Managing Available Licenses for ServiceNow Licensing OAuth2

After the License Information integration task for Auto-Populated License Information for ServiceNow Licensing OAuth2 is enabled, you can add or remove the ServiceNow Licensing OAuth2 product licenses you wish to manage within SaaS Management. To manage available ServiceNow Subscription Licensing licenses, see Managing Available SaaS Application Licenses.

note

If a user is not assigned any licenses, then the user is not filtered out of the ServiceNow Licensing OAuth2 Users tab, irrespective of the selection made under the Manage Available Licenses button on the Licenses tab. For further details, see What happens when a SaaS application’s license is filtered out?.

Microsoft Power BI Reporting for ServiceNow Licensing OAuth2

SaaS Management’s Microsoft Power BI report, which uses the SaaS Management API, provides the insights that enable improved governance and license management processes for complex ServiceNow environments. The Microsoft Power BI report insights can be shared with contacts within your organization who do not use SaaS Management.

To create the Microsoft Power BI report, see the ServiceNow Power BI Reporting for Flexera One’s SaaS Management Knowledge Base article.

API Endpoints for ServiceNow Licensing OAuth2

Application Access

https://<<instance>>.service-now.com/api/now/stats/sys_user
 
https://<<instance>>.service-now.com/api/now/table/sys_user

Application Roster

https://<<instance>>.service-now.com/api/now/stats/license_role
 
https://<<instance>>.service-now.com/api/now/table/license_role
 
https://<<instance>>.service-now.com/api/now/stats/sys_user_has_role
 
https://<<instance>>.service-now.com/api/now/table/sys_user_has_role
 
https://<<instance>>.service-now.com/api/now/stats/sys_user_has_license
 
https://<<instance>>.service-now.com/api/now/table/sys_user_has_license
 
https://<<instance>>.service-now.com/api/now/stats/sys_user
 
https://<<instance>>.service-now.com/api/now/table/sys_user
 
https://<<instance>>.service-now.com/api/now/stats/sys_user_group
 
https://<<instance>>.service-now.com/api/now/table/sys_user_group
 
https://<<instance>>.service-now.com/api/now/stats/sys_user_grmember
 
https://<<instance>>.service-now.com/api/now/table/sys_user_grmember
 
https://<<instance>>.service-now.com/api/now/stats/sys_group_has_role
 
https://<<instance>>.service-now.com/api/now/table/sys_group_has_role
 
https://<<instance>>.service-now.com/api/now/stats/subscription_detail
 
https://<<instance>>.service-now.com/api/now/stats/user_has_subscription
 
https://<<instance>>.service-now.com/api/now/table/user_has_subscription

License Information

https://<<instance>>.service-now.com/api/now/table/license_details
 
https://<<instance>>.service-now.com/api/now/stats/license_has_family
 
https://<<instance>>.service-now.com/api/now/table/license_has_family
 
https://<<instance>>.service-now.com/api/now/table/sys_choice
 
https://<<instance>>.service-now.com/api/now/table/license_role_type
 
https://<>.service-now.com/api/now/stats/sys_app
 
https://<>.service-now.com/api/now/table/sys_app
 
https://<>.service-now.com/api/now/stats/license_role 
 
https://<>.service-now.com/api/now/table/license_role
 
https://<<instance>>.service-now.com/api/now/stats/subscription_detail
 
https://<<instance>>.service-now.com/api/now/table/subscription_detail
 
https://<<instance>>.service-now.com/api/now/stats/subscription_has_family
 
https://<<instance>>.service-now.com/api/now/table/subscription_has_family

Product Consumption

https://<<instance>>.service-now.com/api/now/table/license_details

https://<<instance>>.service-now.com/api/now/stats/subscription_detail

https://<<instance>>.service-now.com/api/now/table/subscription_detail

Reclamation

https://<<instance>>.service-now.com/api/now/v2/table/sys_user/{sys_id}

Setup

https://<<instance>>.service-now.com/api/now/table/sys_properties
 
https://<<instance>>.service-now.com/api/now/stats/sys_user_group
 
https://<<instance>>.service-now.com/api/now/table/sys_user_group
 
https://<<instance>>.service-now.com/api/now/stats/sys_group_has_role
 
https://<<instance>>.service-now.com/api/now/table/sys_group_has_role
 
https://<<instance>>.service-now.com/api/now/stats/license_role
 
https://<<instance>>.service-now.com/api/now/table/license_role
 
https://<<instance>>.service-now.com/api/now/stats/sys_app
 
https://<<instance>>.service-now.com/api/now/table/sys_app
 
https://<<instance>>.service-now.com/api/now/stats/sys_app_application
 
https://<<instance>>.service-now.com/api/now/table/sys_app_application
 
https://<<instance>>.service-now.com/api/now/stats/license_has_family
 
https://<<instance>>.service-now.com/api/now/table/license_has_family
 
https://<<instance>>.service-now.com/api/now/stats/subscription_detail
 
https://<<instance>>.service-now.com/api/now/stats/subscription_has_family
 
https://<<instance>>.service-now.com/api/now/table/subscription_has_family

Sub Application Accesses

https://<<instance>>.service-now.com/api/now/stats/ua_app_usage
 
https://<<instance>>.service-now.com/api/now/table/ua_app_usage
 
https://<<instance>>.service-now.com/api/now/stats/license_has_family
 
https://<<instance>>.service-now.com/api/now/table/license_has_family
 
https://<<instance>>.service-now.com/api/now/stats/sys_app
 
https://<<instance>>.service-now.com/api/now/table/sys_app
 
https://<>.service-now.com/api/now/stats/license_role 
 
https://<>.service-now.com/api/now/table/license_role
 
https://<<instance>>.service-now.com/api/now/stats/subscription_detail
 
<https://<<instance>>.service-now.com/api/now/stats/subscription_has_family
 
<https://<<instance>>.service-now.com/api/now/table/subscription_has_family